Send GitLab an email, push to main

GitLab’s “email an issue to this project” address is a credential, and a stronger one than it looks. Aikido’s Joe Leon swapped -issue for -merge-request, attached a patch touching .gitlab-ci.yml, and landed code on main - past 2FA and past an IP allowlist that blocked both his browser and git clone. The glimt- token never expires and reaches every project the victim can. GitLab called it intended behaviour. Go rotate yours.