https://about.gitlab.com/blog/2021/05/17/prevent-crypto-mining-abuse/ Get free trial * Product Gitlab cogs icon svg GitLab Professional Services Accelerate your software lifecycle with help from GitLab experts Popular GitLab use cases Enterprise Small Business Continuous Integration (CI/CD) Source Code Management (SCM) Out-of-the-box Pipelines (Auto DevOps) Security (DevSecOps) Agile Development Value Stream Management GitOps * Pricing * Resources All-Remote Community Get Started Upcoming Events Is GitLab any good? Customer Case Studies 2021 DevSecOps Survey Topics GitLab docs * Blog * Partners * Support Contact Support Licensing and Subscriptions Caring for Customers Support Resources Partners * Install GitLab * Explore * Sign in * Get free trial Gitlab x icon svg * Product Gitlab cogs icon svg GitLab Professional Services Accelerate your software lifecycle with help from GitLab experts Popular GitLab use cases Enterprise Small Business Continuous Integration (CI/CD) Source Code Management (SCM) Out-of-the-box Pipelines (Auto DevOps) Security (DevSecOps) Agile Development Value Stream Management GitOps * Pricing * Resources All-Remote Community Get Started Upcoming Events Is GitLab any good? Customer Case Studies 2021 DevSecOps Survey Topics GitLab docs * Blog * Partners * Support Contact Support Licensing and Subscriptions Caring for Customers Support Resources Partners * Install GitLab * Explore * Sign in * Get free trial [ ] Blog / News CI news security How to prevent crypto mining abuse on GitLab.com SaaS GitLab * May 17, 2021 * 3 min read * Leave a comment Tanuki GitLab profile --------------------------------------------------------------------- Recently, there has been a massive uptick in abuse of free pipeline minutes available on GitLab.com and on other CI/CD providers to mine cryptocurrencies. In addition to the cost increases, the abuse creates intermittent performance issues for GitLab.com users and requires our teams to work 24/7 to maintain optimal services for our customers and users. To discourage and reduce abuse, starting May 17, 2021, GitLab will require new free users to provide a valid credit or debit card number in order to use shared runners on GitLab.com. A user will be able to run pipelines without providing a credit or debit card if they use their own runner and disable shared runners. Although imperfect, we believe this solution will reduce the abuse. We plan to rollout this change gradually and increase the scope if needed as follows: * Start with adding the new requirement for new free users created on or after May 17, 2021. * If we continue to see abuse through existing free accounts, we plan to extend the requirement to additional users. This change does not currently impact any of the following users: * GitLab self-managed customers and users (free or otherwise) * Paid or program users (e.g., education, open source) on GitLab.com * Users created before May 17, 2021 When you provide the card, it will not be charged but instead will be verified with a one-dollar authorization transaction. No charge will be made and no money will transfer. A credit or debtit card is one (of many) controls we have put in place to reduce abuse of our platform. We will never fully solve platform abuse, but the more barriers we put up, the more difficult and expensive it becomes to engage in abuse. The GitLab team members have already activated and shipped many improvements. These were helpful in deterring abuse, although are not sufficient. A sampling of the fixes we have delivered to mitigate pipeline abuse include: 1. Fail creation of jobs when pipeline minutes quota is exceeded. 2. Fail pipelines after user exceeds pipeline minutes quota. 3. Adding restrictions to the creation of namespaces via the API. 4. Enabling the termination of pipelines when blocking a user. 5. Ensuring pipelines do not run when pipelines are owned by a blocked user. 6. Closing gaps in jobs running by user accounts deleted by users. 7. Utilizing and enhancing the External Pipeline Validation Service specifically around authentication, payload, and access restriction. 8. Ensuring scheduled pipelines don't run by blocked users. We expect to make enhancements to harden our pipeline system against abuse. We believe using pipeline minute quotas as the foundation for free minute usage will be the best mechanism for failing jobs and pipelines to stop abuse. Including this effort, our other pipeline abuse improvements are below: 1. Include public projects in pipeline minutes quota for free users. 2. Expand application limits for preventing abuse of webhooks. A user impacted by this change has the following options: * Provide a credit or debit card and use the four hundred free minutes with shared runners. * A user can also run pipelines without providing a credit or debit card if they use their own runner and disable shared runners for their project. * Decline to provide the card and continue to utilize many of the GitLab capabilities for free. In this case, any feature within GitLab that relies on our pipelines won't work, such as: A pipeline (CI/CD generally), scheduled pipelines including on-demand DAST scans, defining your own pipelines, utilizing AutoDevOps. * Switch to GitLab self-managed Validating an account Continue the conversation Please share your questions and feedback with us on the community forum. --------------------------------------------------------------------- Tags: CI news security More to explore engineering Why iterative software development is critical Tanuki GitLab profile GitLab news How a DevOps Platform helps protect against supply chain attacks Tanuki GitLab profile GitLab engineering How we prevented security fixes leaking into our public repositories Tanuki GitLab profile GitLab All Blog Posts Recently, there has been a massive uptick in abuse of free pipeline minutes available on GitLab.com and on other CI/CD providers to mine cryptocurrencies. In addition to the cost increases, the abuse creates intermittent performance issues for GitLab.com users and requires our teams to work 24/7 to maintain optimal services for our customers and users. To discourage and reduce abuse, starting May 17, 2021, GitLab will require new free users to provide a valid credit or debit card number in order to use shared runners on GitLab.com. A user will be able to run pipelines without providing a credit or debit card if they use their own runner and disable shared runners. Although imperfect, we believe this solution will reduce the abuse. We plan to rollout this change gradually and increase the scope if needed as follows: * Start with adding the new requirement for new free users created on or after May 17, 2021. * If we continue to see abuse through existing free accounts, we plan to extend the requirement to additional users. This change does not currently impact any of the following users: * GitLab self-managed customers and users (free or otherwise) * Paid or program users (e.g., education, open source) on GitLab.com * Users created before May 17, 2021 When you provide the card, it will not be charged but instead will be verified with a one-dollar authorization transaction. No charge will be made and no money will transfer. A credit or debtit card is one (of many) controls we have put in place to reduce abuse of our platform. We will never fully solve platform abuse, but the more barriers we put up, the more difficult and expensive it becomes to engage in abuse. The GitLab team members have already activated and shipped many improvements. These were helpful in deterring abuse, although are not sufficient. A sampling of the fixes we have delivered to mitigate pipeline abuse include: 1. Fail creation of jobs when pipeline minutes quota is exceeded. 2. Fail pipelines after user exceeds pipeline minutes quota. 3. Adding restrictions to the creation of namespaces via the API. 4. Enabling the termination of pipelines when blocking a user. 5. Ensuring pipelines do not run when pipelines are owned by a blocked user. 6. Closing gaps in jobs running by user accounts deleted by users. 7. Utilizing and enhancing the External Pipeline Validation Service specifically around authentication, payload, and access restriction. 8. Ensuring scheduled pipelines don't run by blocked users. We expect to make enhancements to harden our pipeline system against abuse. We believe using pipeline minute quotas as the foundation for free minute usage will be the best mechanism for failing jobs and pipelines to stop abuse. Including this effort, our other pipeline abuse improvements are below: 1. Include public projects in pipeline minutes quota for free users. 2. Expand application limits for preventing abuse of webhooks. A user impacted by this change has the following options: * Provide a credit or debit card and use the four hundred free minutes with shared runners. * A user can also run pipelines without providing a credit or debit card if they use their own runner and disable shared runners for their project. * Decline to provide the card and continue to utilize many of the GitLab capabilities for free. In this case, any feature within GitLab that relies on our pipelines won't work, such as: A pipeline (CI/CD generally), scheduled pipelines including on-demand DAST scans, defining your own pipelines, utilizing AutoDevOps. * Switch to GitLab self-managed Validating an account Continue the conversation Please share your questions and feedback with us on the community forum. Sign up for GitLab's twice-monthly newsletter Thanks for subscribing! Try all GitLab features - free for 30 days GitLab is more than just source code management or CI/CD. It is a full software development lifecycle & DevOps tool in a single application. Try GitLab Free * Twitter * Facebook * YouTube * LinkedIn Why GitLab? * Product * Solutions * Services * DevOps tools * Is it any good? * Releases * Pricing * Get started Resources * All resources * All-Remote * Blog * Newsletter * Events * Webcasts * Topics * Training * Docs * Install Community * Customers * Contribute * Community Programs * Direction * Technology Partners * Channel Partners * Open Source Partners * GitLab for Open Source * GitLab for Education * GitLab for Startups * Shop * Community Forum Support * Get help * Contact Sales * Contact Support * Support options * Status * Customers Portal Company * About * What is GitLab? * Jobs * Culture * Team * Press * Analysts * Handbook * Security * Contact * Terms * Privacy * Trademark Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license View page source -- Edit in Web IDE -- please contribute. Creative Commons License Try GitLab risk-free for 30 days. No credit card required. Have questions? Contact us. Get Your Free Trial Today Gitlab x icon svg