Tracked topic
So, as the adversary, we started out with the pre-provisioned CEO slack account and logged in. Next, we needed to learn more about GitLab and find the weakest link in the chain to exploit. Luckily, GitLab makes all the information we need publicly available within the handbook and team pages.
Agile iteration: My unique onboarding experience at GitLab… Assume compromise of the CEO's Slack identity. For the objectives of this exercise, we don't care how Sid's identity got compromised. In fact, the impersonated Slack account was provisioned before this exercise. …
… Slack slash commands integration removed GitLab Self-Managed | Dedicated The Slack slash commands integration is deprecated in favor of the GitLab for Slack app , which provides a more secure integration with the same capabilities. …
… A single emoji reaction can turn a Slack message into a tracked ticket. …
… Aggregating risk information at GitLab involves searching the following sources among others : GitLab - GitLab objects i.e., epics, issues, and merge requests related to our risk Google Drive - documents, spreadsheets, and presentations Shared calendars - meetings, agendas, and recordings Slack - r… …
… Engineering managers answer the question live in the executive review, not in a Slack follow-up three days later. …
… At GitLab, working async looks like optional meetings with detailed agendas and Slack channels are busy but without the pressure of an immediate reply. …
… The team has used VSCode live share a few times but enjoys open discussion and sending patches to each other. “The best format so far is someone posts a "🍐 request" in the frontend pairs Slack channel – people show interest – a time is scheduled on the calendar – then we do somewhat of a mob progra… …