Independent GitLab Security and CI/CD Review for One Private Project

We’re looking for an experienced GitLab security/DevSecOps reviewer to assess one private software project before controlled human testing.

We need a practical review of the project’s CI/CD configuration and the controls actually in effect. Existing configuration, test evidence and review notes will be provided privately once the scope is agreed.

Scope:
- Project permissions and relevant inherited group controls
- Protected branches, merge permissions, approvals and possible bypasses
- Runner isolation, job trust boundaries and execution permissions
- CI/CD variables, secrets, token permissions and exposure risks
- Artifact access, retention and unintended data exposure
- Dependencies or security checks within the pipeline, including gaps in the existing evidence
Recommendations should work with GitLab Free wherever possible. Clearly identify anything requiring a paid tier. Distinguish controls verified from actual settings or evidence from controls that could not be verified.

Deliverables:
- A written report identifying the configuration/version and settings reviewed
- Prioritised findings with severity, supporting evidence and practical remediation steps
- A clear summary of verified controls, unresolved risks and exclusions
- One clarification round and a clearly bounded recheck of agreed fixes
Please include in your proposal:
1. Your hands-on GitLab security-review experience, ideally three years or more, with examples of controls you have assessed.
2. A redacted sample report or equivalent evidence of your own review work. Relevant certifications are welcome alongside practical examples.
3. Who will personally perform the review and whether you use subcontractors or external AI services.
4. Your fixed-price quote, scope limits and availability. Ideally we’d like delivery within 2–3 days of agreeing the scope and receiving the materials; please confirm what is realistic.
The review starts read-only using agreed, least-privilege access or owner-supplied evidence. Changes, pipeline runs and active tests require separate approval. Confidential materials must not be uploaded to external services or shared with others without approval.

We are also seeking a Python application security review. If you have demonstrable experience in both areas, please provide separate prices and an optional combined fixed-price quote, with evidence of your Python security-review experience.