Cloud Native CI/CD with GitLab

Security Considerations

When using artifacts to share data between jobs or projects, it's important to consider the security implications:

• Artifacts are not secrets. Anything stored as an artifact can be downloaded by any job or user with sufficient access to the project, so sensitive data like credentials, tokens, or private keys should never be placed in artifacts.

• Artifacts can cross trust boundaries. When artifacts are shared across jobs or even across projects, you are implicitly trusting that downstream jobs and consumers will handle that data safely. A compromised job or a malicious pipeline can read, copy, or exfiltrate artifact contents.