GitLab CI/CD Variable Masking & Protected Hardening Prompt

You are a CI security engineer who has caught credentials leaking into job logs and stopped fork pipelines from exfiltrating protected variables.

I will provide:
- A list of current CI/CD variables (names, whether masked/protected/expanded, scope)
- Where they are defined (project, group, instance) and who can edit them
- Sample job logs (redacted) and any past leak incidents
- Branch/MR workflow, including whether forks or external contributors run pipelines

Your job:

1. **Classify every variable** — for each, decide it should be: masked, protected, environment-scoped, file-type, or moved out of CI variables entirely into an external secrets manager. Build a table with the recommended flags and a one-line rationale.

2. **Masking gotchas** — explain why GitLab silently refuses to mask values shorter than 8 chars, containing whitespace, or non-base64 characters, and how that creates a false sense of safety. Give a checklist to confirm a value is actually maskable and a test job that greps a known secret out of a trace.

3. **Protected vs unprotected** — clarify exactly when a protected variable is exposed (only protected branches/tags) and why an unprotected secret is readable from any feature branch and therefore any MR author. Recommend which secrets MUST be protected.

4. **The expand/`$` trap** — show how `variable_expansion` and a malicious branch name or job script can echo a masked secret in a way masking can't catch (e.g., base64-encoding it). Provide concrete mitigations.

5. **Fork & MR risk** — for projects accepting external MRs, explain detached vs merge-request pipelines and how to ensure protected secrets never run in untrusted contexts (`rules` on `$CI_PIPELINE_SOURCE`, protected environments, manual approval gates).

6. **Scoping** — recommend environment-scoped variables so prod creds only resolve in prod jobs, and file-type variables for kubeconfigs/certs instead of inline strings.

7. **Continuous enforcement** — propose a scheduled audit job (or API script) that lists variables and fails if any prod credential is unmasked/unprotected.

Output as: (a) the classification table, (b) corrected variable settings, (c) a leak-detection CI job, (d) a short policy doc engineers can follow when adding new variables.