It depends on the project's visibility and the Project-based pipeline visibility setting. With the setting selected, anyone who can see a public project can see its pipelines, logs and artifacts. With it cleared, logs and artifacts in public and internal projects are limited to project members with the Reporter role or higher.
Why logs and artifacts matter
Job logs show commands, environment output and error messages. Artifacts can hold test reports, build outputs and sometimes files that were never meant to leave the pipeline. Anything a job prints or saves is readable by whoever can open the pipeline, so visibility is a secrets and information control, not just a convenience.
What GitLab documents
Under Settings, CI/CD, General pipelines, the Project-based pipeline visibility checkbox works like this:
| Project type | Checkbox selected | Checkbox cleared |
|---|---|---|
| Public | Pipelines visible to everyone | Job logs and artifacts visible only to Reporter or higher. Others see only pipeline and job status, on merge requests or commits |
| Internal | Visible to all authenticated users except external users | Visible only to Reporter or higher. Other authenticated users see only status |
| Private | Visible to members at Guest or higher | Visible only to Reporter or higher |
For public projects there is also a CI/CD option under Settings, General, Visibility, project features, permissions. Choosing Only project members restricts pipeline viewing to members. That option has no effect on internal or private projects, or when project-based pipeline visibility is disabled.
Steps
- Check each project's visibility, not just the group's.
- Decide who needs to read logs. Open source projects often want public logs. Commercial ones usually do not.
- Clear the pipeline visibility checkbox on projects where logs may contain anything sensitive.
- Review artifacts. Set expiry on artifacts and avoid saving whole workspaces.
- Treat any secret that ever appeared in a log as exposed. Rotate it, even if you later restrict visibility.
What visibility does not fix
Restricting who can read a log does not make it safe to print a secret into it. Members at Reporter or above, and anyone who ever had access earlier, can still read it. Fix the job so it does not print secrets, and use masked and protected variables.
A short audit
Pick five projects, including your busiest public one, and check: the project visibility, the pipeline visibility checkbox, artifact expiry, and whether any recent job log contains a token, a URL with credentials, or a customer identifier. If you find one, rotate it, fix the job, and delete the log. Repeat the audit after any change to your CI templates, since a shared template can change what every project prints.
Quick check
I made the project private. Are old logs safe?
They are limited to members, but anyone who copied them earlier still has them. Rotate any secret that appeared in them.
Do external users see pipelines in internal projects?
With the checkbox selected, GitLab says internal pipelines are visible to authenticated users except external users.
Safeguard scans the dependencies your pipelines install and can enforce policies and gates on merge requests. Try the free scan.
Sources
Last reviewed: 19 October 2026.
