gitlab-org/gitlab-runner

Scanned on May 22, 2026

Risk score/ 100

Moderate risk

Summary

GitLab Runner exhibits moderate post-quantum cryptography risks with 10 quantum-vulnerable findings across 5 files. The primary concerns involve RSA private key usage in GCS adapter tests and potential misidentification of AES256 symmetric encryption as ECDSA asymmetric patterns. While AES-256 remains quantum-resistant for symmetric encryption, RSA key management requires migration planning.

Critical

High

Medium

Low

Top findings

HighPKCS#1 (RSA-based)
cache/gcsv2/adapter_test.go:17
Raw evidence
```
privateKey = `-----BEGIN RSA PRIVATE KEY-----
```
HighECDSA
cache/s3/adapter_test.go:202
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA (SPHINCS+)
Raw evidence
```
headers.Add("X-Amz-Server-Side-Encryption", "AES256")
```
HighECDSA
cache/cacheconfig/cacheconfig_test.go:242
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA (SPHINCS+)
Raw evidence
```
expectedEncryptionType: cacheconfig.S3EncryptionTypeAes256,
```
HighECDSA
cache/cacheconfig/cacheconfig.go:94
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA (SPHINCS+)
Raw evidence
```
return S3EncryptionTypeAes256
```
HighECDSA
cache/cacheconfig/cacheconfig_test.go:248
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA (SPHINCS+)
Raw evidence
```
"AES256 encryption": {
```

+ 5 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan