The mistake happens at copy time
Most leaks of this kind are not attacks. They are copy-paste errors made minutes before publishing a bio, a portfolio page or a forum signature. The browser address bar can show a feed address while the page you are looking at feels like “my activity,” so the URL that gets copied is the one that authenticates a request rather than the one that simply names your profile.
GitLab’s personal activity feed URL contains a token that authenticates the feed request. Source
That is the whole reason this check matters: the token is not a separate secret you can revoke later in isolation. It is embedded in the link, and the link is what you are about to publish.
A public profile URL and an authenticated activity-feed URL serve different purposes. Source
Treat that sentence as the decision rule for the rest of this guide. If the URL you are holding could be used to fetch private feed content, it is not a profile link, no matter how it looks.
Step 1: Identify which link type you are holding
You do not need to understand the token format to make the decision. You need to know which page produced the URL. Use the table below as an inspection checklist before anything is pasted publicly.
| What you copied | Typical sign | Public-safe? | What to do |
|---|---|---|---|
| Profile page URL | Opens your profile when logged out | Yes, if the profile itself is public | Use this one |
| Activity feed URL | Contains a long token segment and returns feed data | No | Discard it; do not paste, shorten or screenshot it |
| A link from a settings or token page | You were in an authenticated area when you copied | Treat as private | Replace with the profile URL |
| A link someone else sent you | Unknown origin | Unverified | Open it logged out before trusting it |
Two limits are worth stating plainly. First, this table is an editorial inspection routine, not a platform feature; GitLab does not label links for you. Second, a URL that opens fine in your own logged-in browser proves nothing, because your session may be supplying access that a stranger would not have.
A practical test that does not expose anything: open the candidate link in a private window where you are not signed in. If it asks you to authenticate, or returns feed content you would not want a stranger to read, stop and go back to your profile page to copy the address again. Do not paste the failing URL into a chat, a ticket or a public post to “check” it.
Step 2: Replace it with the public profile URL
Once you have decided a link is the wrong type, replacement is the safe action. The following sequence keeps the private URL out of every intermediate place it could be stored.
- Close the tab that shows the feed or token-bearing address without copying it again.
- Navigate to your profile the ordinary way, through the site interface rather than a saved bookmark to the feed.
- Confirm the profile is the one you intend to publish, and that its visibility is what you expect.
- Copy the address from the profile page only.
- Paste it into a plain text editor first, not directly into the bio field, so you can look at the full string before it goes anywhere.
- Check the pasted string against the table above. If any part looks like a long credential rather than a name or path, discard it and repeat from step 2.
- Paste the verified profile URL into the bio, then preview the bio as a logged-out visitor would see it.
Step 5 is not ceremony. Bio fields, rich-text editors and link previews can store or fetch what you paste, and a preview fetch of a token-bearing URL is one more place the link has traveled.
Step 3: Decide whether the feed itself should be visible
A profile link and a feed link are separate questions. You may have a perfectly safe profile URL and still be uncomfortable with how much your activity reveals. That is a visibility decision, not a link-format decision, and it should be made before you publish anything that points people toward your profile.
The personal feed includes activity from membership projects regardless of the activity tab or filter selected. Source
That matters for the judgment call: if you are relying on a tab or filter to keep certain activity out of view, the feed behavior described above means the filter is not a privacy boundary. Decide whether the feed as a whole is acceptable, rather than assuming a narrower view protects you.
If you conclude it is not acceptable, the next step is to review what remains publicly visible after you adjust profile visibility, not just to change one setting and move on. A relevant follow-up is the guide on making your GitLab profile private and checking what remains public, which addresses the visibility side of this decision.
If the link has already been shared
Act on the assumption that anything published publicly may have been copied, cached or indexed, even if you delete it a minute later. Deleting a post does not recall copies that others or automated systems already made, and this guide will not pretend otherwise.
Use the site’s own authorized token and account controls, or its support channels, to deal with a credential that has been exposed. The exact menu path and the available recovery options are not established by the reviewed material here, so check them in your account rather than following a remembered sequence from an older interface. Do not paste the exposed URL into a public issue, a social post asking for help, or a third-party site; describe the problem without reproducing the link.
After you have taken action through the authorized route, re-check the places you published: bio fields on each site, signatures, portfolio pages, pinned posts and any document you shared. Replace each occurrence with the profile URL, and note which places you could not edit.
Where a username lookup fits, and where it stops
If your concern is how widely a handle is reused across sites, a username lookup can surface public matches to review. TraceSeek covers 3,000+ platforms and offers a free first scan that takes 20-30 seconds according to the product. That is a lead-generation step, not proof of ownership: a matching handle on another site may belong to someone else, and a search is not a complete inventory of every account.
What a lookup cannot do is tell you whether a specific URL you copied contains a credential. That judgment comes from the inspection in Step 1. Keep the two tasks separate: use the lookup to find public profiles worth reviewing, and use the link-type check to decide what is safe to publish.
Quick checklist before you paste
- I copied the URL from my profile page, not from a feed, settings or token page.
- The full string contains no long credential-like segment.
- The link opens as expected in a private window with no session.
- I pasted it into a plain text editor before the bio field.
- I previewed the bio as a logged-out visitor.
- I have decided whether the activity feed as a whole is acceptable to expose.
- If I already shared a feed link, I used authorized account controls or support and did not repost the link.
- I re-checked every place the old link appeared.
If any box is unchecked, the safe default is to publish nothing and return to the profile page for a fresh copy.