Aikido Security found that GitLab's built-in 'Email work item to this project' addresses, which embed a long-lived credential token, are being publicly exposed in READMEs, contributing guides, and support pages. Anyone who obtains one of these addresses can email GitLab to create issues, and by swapping the '-issue' suffix for '-merge-request,' can open merge requests as if they were the token owner, since GitLab does not verify the sender's email matches the token owner and the technique also bypasses IP restrictions.
bleepingcomputer.com
· 2026-09-24
ImpactGate is a new open-source tool that scores code changes for structural decay before they merge, running as a CLI, git pre-commit hook, or CI plugin for GitHub, GitLab, and Jenkins. It calculates an impact score based on files changed, existing complexity in the code being touched, cyclomatic complexity, and lines changed, making edits to already-bloated classes costlier than new additions.
github.com
· 2026-09-16
A software engineering essay, part of a series called 'Conquering Entropy,' examines how AI-generated code changes the trust relationships within engineering organizations—from trusting the ticket author and reviewing engineer to trusting test suites, CI/CD pipelines, and even AI-driven site reliability tools. The author argues that as AI agents make code generation faster and cheaper, teams need explicit accountability: whoever ships a PR should be responsible for fixing it if it breaks in production.
kaeruct.github.io
· 2026-09-06
GoKawiil