Adding AI Code Review to a Self-Hosted GitLab — Without Handing It the Keys

Short summary

This article describes a secure two-stage architecture for integrating Claude AI code review into self-hosted GitLab. The design prevents prompt injection by separating untrusted AI execution from trusted token-holding operations using inter-container boundaries. The trusted stage handles API posting with real credentials while the AI runs sandboxed with no token access, ensuring attackers cannot exploit model hijacking to steal credentials.

• •Two-stage pipeline separates untrusted AI execution from trusted token operations
• •Prevents prompt injection by removing credentials from the container where untrusted input runs
• •Trusted stage recomputes diffs and sanitizes findings before posting comments

Generated with AI, which can make mistakes.