How to audit a GitLab instance in 2026
Which GitLab version is public?
Deeper than a manual audit or a tool. At the scale AI agents attack.
The audit starts after signup. $49 for one month. Your report stays in your account.
- Version
- Known CVEs
- Public projects
- Sign-up and GraphQL
01 / 08·running
Public surface
Other hosts and open ports
Signals
- VersionThe GitLab release your headers and help page already publish.
- Known CVEsPublished holes in that release.
- Public projectsExplore and the projects API answering with no login.
- Sign-up and GraphQLRegistration left open, and GraphQL reachable from the internet.
How the GitLab audit runs
What else is on this domain
Other hostnames on the same domain, then the ports those servers leave open, before anything GitLab-specific.
Subdomains
Staging, old admin hosts, and the other names on your domain.
Live hosts
Which of those names actually answer.
Open ports
What is listening, including the version when the server says it.
On your GitLab
GitLab version, projects readable without an account, open registration, and GraphQL.
Version
The GitLab release your headers and help page already publish.
Known CVEs
Published holes in that release.
Public projects
Explore and the projects API answering with no login.
Sign-up and GraphQL
Registration left open, and GraphQL reachable from the internet.
A report you can act on
Each issue names the host, shows the evidence, and says what to fix. Anything we could not confirm stays marked that way.
Evidence
The URL or file that proved it.
CVE ids
Only when we saw the version the advisory is about.
Account
The report opens after the $49 month is paid.
Questions about a GitLab audit
What the run covers, and when the report opens in the account.
Contact usAudit GitLab from the outside.
Deeper than a manual audit or a tool. At the scale AI agents attack.