Two dozen firms breached through GitLab-stored secrets, and GitLab shipped the cure a day later
CloudSEK traced a ransomware affiliate's two-dozen-victim run to credentials harvested from GitLab pipelines and repository history; a day later GitLab launched a secrets-scoping security stack pitched at exactly that failure. The December 1 print decides whether the fear converts to revenue before the margin finishes eroding.
Vincent Jiang · 3 min read
A registry and a deleted database
A government-linked financial registry lost more than 120,000 records to a ransomware affiliate who works under the name Azazel, who then used a Python script to stop its PostgreSQL server and delete the production data directory 1. His run reached more than two dozen organizations across six countries 1. One intrusion alone, which spread from a software platform into more than a dozen customer environments, gained access to more than 150 databases and hundreds of source repositories 1. A medical-imaging company lost six terabytes through an unauthenticated AI imaging API 12.
The keys were in the pipelines
CloudSEK's report, The Gentlemen Files, published October 5 2, traced most compromises to credentials stolen from GitLab CI/CD pipelines, configuration variables and repository history: database passwords, API keys, access tokens, SSH private keys 12. Many of those secrets, in the researchers' judgment, had been deleted from the current version of repositories and survived in earlier commits 2. Azazel staged the haul on a 29TB server feeding a 22TB vault and used an AI coding assistant over MCP to send commands to a compromised machine 2. Nothing in the findings describes a breach of GitLab itself. It describes what its customers leave inside it.
The cure arrived a day later
On October 6 GitLab announced its governed software factory: Secrets Manager, now generally available, which scopes each secret to the job that needs it and revokes a leaked credential in one click; a Dependency Firewall in early access; and a five-control Security Standard 3. Anthropic's Claude Mythos 5 and 5.1 will power the new remediation flows 3, the same day Jamie Dimon said cyber risk "went up 10-fold" after Mythos 4. Every token Azazel harvested from a pipeline is a use case in the stack GitLab announced a day after the report.
The growth is real, the margin is the bill
GitLab reported Q2 fiscal 2027 on September 1: revenue of $286.25 million, up 21.3 percent, adjusted EPS of $0.24 against $0.18 expected 56. Below the line the picture inverts. Non-GAAP gross margin fell to 86 percent from 90, GAAP gross margin has declined six straight quarters to 84.1 percent, and operating cash flow swung to minus $3.09 million from plus $49.37 million a year earlier 67. Paid AI consumption cleared a $40 million run rate against a management target above $100 million by fiscal year-end 6.
GitLab's gross margin has fallen six quarters straight, from 89.2% to 84.1%
Data
| GAAP gross margin | |
|---|---|
| Q1 '24 | 88.9% |
| Q2 '24 | 88.3% |
| Q3 '24 | 88.7% |
| Q4 '24 | 89.2% |
| Q1 '25 | 88.3% |
| Q2 '25 | 87.9% |
| Q3 '25 | 86.8% |
| Q4 '25 | 86.6% |
| Q1 '26 | 85.8% |
| Q2 '26 | 84.1% |
Seventy dollars against forty-seven
Canaccord lifted its target from $40 to $70 the day after the print 8. Baird went to $59 at outperform 8. Barclays, still underweight, moved to $47, and consensus sits at $51.75 8; the stock closed October 6 at $51.63 5. The bull case leans on net retention of 117 percent 8 and, on GitLab's own count, agentic-development users up 200 percent year over year 3. The bear case is the margin line and the cash-flow line.
Canaccord's $70 target towers over Barclays' $47 and the $51.63 close
Data
| Price target or close | |
|---|---|
| Canaccord | $70 |
| Baird | $59 |
| Consensus | $51.75 |
| Close, Oct 6 | $51.63 |
| Barclays | $47 |
What December 1 settles
Q3 lands December 1 6, with full-year guidance of $1.129 billion to $1.133 billion conceding deceleration to 18 or 19 percent growth 6. The tell is whether Secrets Manager and Duo consumption show up in revenue while gross margin holds. Security fear is now a product category, and the next print prices it.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
