TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

DevSecOps Platform Evolution

9 posts · Sep 2018 – Jul 2026

What this trail covers

GitLab's DevSecOps platform continues to evolve, integrating security throughout the software development lifecycle. This includes addressing the complexities of software supply chain security beyond traditional dependency scanning, encompassing source, build, artifact, deployment, and tool security. The platform is also adapting to the emerging risks introduced by AI, such as model supply chain attacks and insecure AI-generated code. Key efforts focus on bridging the gap between developer velocity and security, with recent advancements including secure package publishing with signing and attestation using Sigstore's Cosign, and automated vulnerability scanning.

All GitLab trails
  1. Application security testingThis post details the integration of GitLab's DevSecOps platform with application security testing tools, including SAST, secret detection, DAST, dependency scanning, container scanning, and license management. It explains how these tools are integrated into CI/CD pipelines to provide inline feedback within merge requests and consolidated reports via security dashboards. Future enhancements like IAST and fuzzing are also mentioned.
  2. When a version bump breaks your build, GitLab fixes itThis post introduces Dependency Scanning Auto-Remediation, a new beta feature that automates the process of fixing vulnerable dependencies. It consists of two stages: automated dependency version bumping and agentic breaking change resolution. The latter utilizes GitLab Duo Agent Platform to analyze pipeline errors, dependency changelogs, and code usage to commit fixes for breaking changes. It supports multiple package managers and plans to add Rust and Go. Safeguards and configuration options are detailed, and the feature is available on GitLab.com and rolling out to Self-Managed and Dedicated instances.
  3. One vulnerability view: From scanner coverage to AI governanceThis post introduces the enforcement of third-party scanners (outputting SARIF) across all GitLab projects, with vulnerabilities flowing into a single view. It details the integration of these findings into the GitLab Duo Agent Platform's auto-remediation workflow, including SAST False Positive Detection and Agentic SAST Vulnerability Resolution for automated fixes. Secret detection now scans every commit on a new branch, and Secret False Positive Detection (now GA) adds confidence scores and explanations to findings. For AI agents, the beta release of AI audit event streaming records agent actions, and Agent tool approval guardrails (also beta) allow administrators to control agent capabilities (run, pause for approval, or block), with all approval decisions logged as audit events.
  4. Full security scanner coverage of your codebase in minutesIntroduces Security Configuration Profiles as a centralized UI-based method to manage SAST, dependency scanning, and secret detection scanners across projects. Defines default profiles with specific scan triggers: merge request pipelines, branch pipelines (default branch only), and real-time push protection for secret detection. This aims to automate scanner enablement at scale and address configuration drift.
  5. Harden your pipeline perimeter for the era of AI-assisted codingThis post details how GitLab Ultimate enhances its DevSecOps platform to address the security challenges of AI-assisted coding. It introduces three key dimensions: 'See' (Group Security Dashboard, Credentials Inventory, Token Lifetime Enforcement, Audit Event Streaming, group SBOM), 'Enforce' (Scan Execution Policies, Pipeline Execution Policies, MR Approval Policies, Compliance Center, Secret Push Protection), and 'Fix' (MR security widget, Advanced SAST, AI-driven false positive scoring, Security Analyst Agent, Agentic Vulnerability Resolution). The post emphasizes integrating security directly into the development workflow to keep pace with AI-driven code changes.
  7. Automate detection testing with GitLab CI/CD and DuoThis post introduces the WATCH (Weekly Attack Testing for Continuous Health) framework, an automated system for validating security detections. WATCH simulates real malicious behavior in a staging environment and verifies that expected alerts propagate through the SIEM, SOAR, and monitoring dashboards. It leverages GitLab CI/CD for scheduling, execution, and reporting. The framework simplifies test creation by providing a `BaseSecurityTest` abstract class and integrates with GitLab Duo for AI-assisted test generation. The post details the lifecycle of a WATCH test, its CI/CD implementation, and how to write new tests using the provided framework.
  8. Prepare your pipeline for AI-discovered zero-daysThis post details how to prepare CI/CD pipelines for AI-discovered zero-day vulnerabilities, emphasizing the need for security enforcement at the point of change (merge requests). It highlights the acceleration of attackers due to AI and the corresponding need for defenders to harness AI models within their development workflows. Key concepts include: embedding security into every merge request, catching simple issues at authoring time (IDE), automating triage with AI for false positives and reachability, and governing AI-based remediation like any other change. It proposes a scenario where a security agent can quickly identify affected projects and versions, and an agent can suggest and apply fixes, with all actions logged and auditable.
  9. Pipeline security lessons from March supply chain incidentsThis post introduces and details GitLab Pipeline Execution Policies (PEPs) as a mechanism to enforce security controls across all CI/CD pipelines. It explains how PEPs can be used to address supply chain attacks by injecting mandatory, non-skippable jobs into pipelines. The post outlines three specific use cases with corresponding open-source policies: Artifact Hygiene (preventing accidental IP exposure in package publishing), Dependency Integrity (detecting tampering and lockfile manipulation), and Tool/Action Pinning (ensuring trusted references for build tools and actions). It provides concrete examples of how these policies would have prevented recent supply chain incidents and includes links to ready-to-use policies and test projects.
  10. Track vulnerability remediation with the updated GitLab Security DashboardThis post details the enhancements to the GitLab Security Dashboard in release 18.9, focusing on new filters and charts for visualizing trends like open vulnerabilities, remediation velocity, vulnerability age distribution, and risk score over time. It introduces risk scoring based on vulnerability age, EPSS, and KEV scores. The post highlights how these features help application security and development teams track program effectiveness, focus on targeted remediation, identify training needs, and reduce manual reporting.
  11. AI-powered vulnerability triaging with GitLab Duo Security AgentThis post introduces the GitLab Duo Security Analyst Agent, an AI-powered tool that automates vulnerability triaging. It integrates with existing GitLab security scanners and the Vulnerability Report to analyze exploitability, reachability, and risk, providing actionable remediation recommendations. The post details how to enable and use the agent, contrasting its automated workflow with the manual triaging process.
  12. A developer's guide to building secure retail apps with GitLabThis post details how an integrated DevSecOps platform, specifically GitLab, can be used by retail teams to address the unique challenges of application security in the retail sector. It highlights the limitations of traditional security approaches and emphasizes the benefits of embedding security throughout the development lifecycle. The post outlines GitLab's comprehensive security scanning capabilities (SAST, DAST, dependency scanning, container scanning, secret detection, IaC scanning, fuzz testing) and how they integrate into CI/CD pipelines. It also discusses the importance of policy enforcement, automated compliance reporting, and shared security responsibility, including developer empowerment through AI-assisted vulnerability explanation and resolution, and automated compliance features like SBOM generation. The article contrasts the benefits of a unified platform with point tools for retailers.
  13. Secure Rust development with GitLabThis post details how to leverage GitLab CI/CD for secure Rust development. It provides a concrete example of a Rust mortgage calculator application with a `.gitlab-ci.yml` file that demonstrates automated building (including cross-compilation for Linux, Windows, and macOS), unit and integration testing, code quality checks (Clippy), and code formatting checks. It also showcases publishing Rust applications as tar archives to GitLab's generic package registry and containerizing applications for storage in GitLab's Container Registry. The post highlights the use of Docker-based CI/CD, caching mechanisms for Rust's compilation times, and the integration of security scanning within the pipeline.
  14. Software supply chain security guide: Why organizations struggleThis post elaborates on the challenges of software supply chain security, extending the scope beyond dependency scanning to include source, build, artifact, deployment, and tool security. It highlights the impact of AI on both attack sophistication and the introduction of new risks within the AI development supply chain (model supply chain attacks, insecure AI-generated code, compromised AI toolchains). The post identifies four key barriers to effective action: false economy mindset, skills shortage, misaligned organizational incentives, and tool complexity overload. It emphasizes the true costs of supply chain insecurity, including time to containment, reputation damage, regulatory reality, and operational disruption. The article critiques current approaches like massive scanning and collaboration breakdowns, advocating for integrated DevSecOps platforms that bring security into the development workflow.
  15. Bridging the visibility gap in software supply chain securityThis post introduces two new capabilities: Security Inventory and Dependency Path visualization. Security Inventory provides a centralized, portfolio-wide view of risk and scan coverage across GitLab groups and projects, helping identify blind spots and prioritize mitigation. Dependency Path visualization displays the full route from a top-level package to a vulnerable component following an SCA scan, clarifying how open source vulnerabilities are introduced through the dependency chain. These features aim to improve software supply chain security by enhancing visibility and enabling effective remediation within the existing DevSecOps workflow.
  16. 3 best practices for building software in the era of LLMsThis post outlines three best practices for building software in the era of LLMs, focusing on security. It emphasizes a 'never trust, always verify' approach to AI-generated code, treating it like input from a junior developer requiring review. It highlights the importance of prompt engineering for security-aware prompts, referencing OWASP best practices and research showing improved secure code generation with specific prompts. Finally, it stresses the non-negotiable need for comprehensive automated scanning (SAST, SCA, Secret Detection) at every stage of development to mitigate risks introduced by increased code volume and AI generation. It positions GitLab Duo Code Review and other GitLab security features as tools to enhance these practices.
  17. GitLab catches MongoDB Go module supply chain attackThis post details GitLab's development and application of an automated detection system for software supply chain attacks. The system combines automated typosquatting detection, semantic code analysis, and AI-assisted initial screening. It was used to identify and report a live typosquatting attack involving a malicious MongoDB Go module (`github.com/qiniiu/qmgo`), which was subsequently taken down. The threat actor quickly redeployed a second malicious version, which was also detected and mitigated. The post outlines the multi-layered attack payload and provides indicators of compromise. It emphasizes the importance of proactive monitoring and detection systems to close the gap left by reactive package manager takedowns.
  18. Why are organizations moving to a unified DevSecOps platform?This post elaborates on the benefits of a unified DevSecOps platform, specifically highlighting GitLab's capabilities. It details how GitLab integrates Agile project management, linking issues and epics to automation processes. It emphasizes built-in security features like dependency scanning, SAST, DAST, secret detection, and container scanning, which are integrated into the CI/CD pipeline for early feedback. The post also discusses Compliance Frameworks for enforcing policies and regulatory requirements. Furthermore, it highlights AI-powered development with GitLab Duo, including its context-aware assistance for tasks like code review, test generation, and vulnerability detection. It specifically mentions GitLab Duo Self-Hosted for regulated organizations, ensuring data privacy and compliance. The post concludes by inviting users to explore interactive demos of GitLab Premium and Ultimate with Duo, security scanning, and compliance frameworks.
  19. Strengthen data security with custom PII detection rulesetsThis post details how to extend GitLab Secret Detection with custom rulesets for Personally Identifiable Information (PII) detection. It provides a step-by-step guide on creating a custom ruleset file (`rules/pii-data-extenson.toml`) with regex patterns for passport numbers, phone numbers, and email addresses, and how to extend the default configuration using `.gitlab/secret-detection-ruleset.toml`. It also demonstrates how to leverage GitLab Duo Chat to generate regex patterns and outlines best practices for PII detection.
  20. Vulnerability risk prioritization made simple with GitLabThis post details the integration of CVSS, KEV, and EPSS frameworks into GitLab's vulnerability management system. It explains how these frameworks are used to prioritize vulnerabilities, particularly for dependency and container image scanning. The post outlines the steps to add security scanners to CI/CD pipelines, view vulnerability insights including the new risk metrics, and change vulnerability statuses. It highlights the practical application of these frameworks for effective risk assessment and remediation.
  21. Introducing GitLab’s Open Source Security CenterGitLab is launching the Open Source Security Center, a central repository of security-focused projects developed by GitLab's internal security team. This initiative aims to empower teams by sharing tools, templates, and frameworks to improve software security and resilience. Featured projects include StORM templates for standardizing risk tracking and reporting, the GUARD Framework for automating response and detection with a detections-as-code approach, and the GitLab CIS Benchmark Scanner for auditing against security benchmarks.
  22. Tutorial: Security scanning in air-gapped environmentsThis post details the technical process of running GitLab's security scanners in air-gapped environments. It explains the prerequisites (Ultimate subscription, offline cloud license, Self-Managed cluster), the necessity of downloading and transferring scanner container images (e.g., `registry.gitlab.com/security-products/secrets:6`), and the steps involved: downloading images using tools like Podman, saving them as tarballs, transferring them to the offline environment (e.g., via SCP), and loading them into the offline container registry. It also demonstrates how to configure GitLab Runners to use these local images by setting the pull image policy to `if-not-present` and provides firewall rule examples for blocking internet egress.
  23. Automating cybersecurity threat detections with GitLab CI/CDThis post details the implementation of a Detections as Code (DaC) workflow for managing SIEM threat detections using GitLab CI/CD. Key contributions include: defining a JSON format for threat detections, establishing a CI/CD pipeline for automated validation (query format, field validation, SIEM API checks), integrating merge request approvals for peer review, and automating the creation/update/deletion of detections and MITRE ATT&CK mapping in the SIEM upon merge. It also provides a sample `gitlab-ci.yml` configuration and a workflow diagram.
  24. Introducing GitLab Advanced Vulnerability TrackingIntroduced Advanced Vulnerability Tracking for SAST, which uses syntax-tree context and location fingerprints to identify and deduplicate vulnerabilities. This approach is 30% more effective than traditional line-based tracking and reduces manual auditing effort. The underlying study will be presented at ICSE 2025.
  25. Secure and publish Python packages: A guide to CI integrationThis post details the implementation of a CI/CD pipeline for Python packages that incorporates package signing and attestation using Sigstore's Cosign. It outlines the six stages: Build, Signing, Verification, Publishing, Publishing Signatures, and Consumer Verification. Key technical details include using Python 3.10, Cosign 2.2.3, OIDC tokens for authentication with Sigstore, and uploading signed packages and their signatures/certificates to GitLab's package registry. The post emphasizes supply chain security, compliance, traceability, and trust verification.
  26. Reduce supply chain risk with smarter vulnerability prioritizationIntroduces new enhancements to GitLab's Software Composition Analysis (SCA) solution: Static Reachability Analysis to identify exploitable vulnerabilities, a Known Exploited Vulnerabilities (KEV) Indicator, and Exploit Prediction Scoring System (EPSS) to predict exploitation likelihood. These features leverage acquired technologies from Oxeye and Rezilion to help Application Security teams prioritize and remediate vulnerabilities more effectively. Future plans include automated merge request fixes, enriching package metadata with OpenSSF scorecard ratings, and improving open-source software license detection.
  27. 5 things to know from our LinkedIn Live Security Deep DiveThis post details advancements in GitLab's DevSecOps platform, specifically highlighting: 1. The challenge of security teams keeping pace with rapid development, evidenced by survey data. 2. The introduction of Advanced SAST with cross-file/cross-function scanning and taint analysis, including a code flow view for vulnerability tracing. 3. A new secret push protection feature that checks commits before they are pushed to prevent accidental secret leaks. 4. The evolution of GitLab Duo to provide contextual security assistance within merge requests via Quick Chat. 5. A static reachability feature for Python and Java that reduces security noise by identifying only used dependencies.
  28. Container image provenance with Cosign in GitLab CI/CDThis post introduces and demonstrates the integration of Cosign into GitLab CI/CD pipelines for automated container image signing and annotation. It details the setup of a `.gitlab-ci.yml` file that builds Docker images, pushes them to the GitLab container registry, signs them using Cosign with keyless signing via OIDC tokens, and attaches detailed build provenance metadata (user, pipeline, job, commit, project details). The post also includes a verification step using `cosign verify` to ensure the integrity of the signature and annotations, providing a concrete example of enhancing software supply chain security for containerized applications.
  29. Get to know the security and governance updates in GitLab 17, 17.1This post details security and governance updates in GitLab 17 and 17.1. Key enhancements include SAST analyzer streamlining by consolidating language-specific analyzers into a Semgrep-based one, introducing Android dependency scanning with SBOM generation via a CI/CD catalog component, and improving custom roles with UI editing and instance-level management. Secret detection gains support for remote rulesets and advanced vulnerability tracking, with secret push protection entering beta. Container registry updates include image signing, last published date display, tag sorting, and container scanning for the registry. API security scanning also sees updates.
  30. 7 steps to enhance application security without slowing developer velocityThis post details a 7-step process for enhancing application security without sacrificing developer velocity. It outlines how to assess current development states, enable security scans (secrets detection, dependency scanning, SAST) using scan execution policies, evaluate scan results for false positives and noise, adjust scan analyzers and rulesets (including custom rules for SAST and secrets detection), prioritize initial vulnerabilities for remediation, integrate scans into development pipelines (running in parallel with other CI jobs, using merge request widgets for visibility, and potentially scheduling slower scans like DAST), and finally, rinse and repeat for continuous improvement. It emphasizes educating developers and fostering collaboration between development, security, and operations.
  31. GitLab's Commitment to Enhanced AppSec in Modern DevOpsThis post details the security features introduced in GitLab 15, building upon the modernization efforts in GitLab 14. Key enhancements include a global rule registry for policy customization, a new browser-based DAST scanner for modern APIs and SPAs, expanded language support for Semgrep-based SAST, and new vulnerability management capabilities. Specific features highlighted include Container Scanning availability in all tiers, audit changes to group IP allowlist, revoking personal access tokens without PAT ID, project-level Secure Files (open beta), dependency scanning support for poetry.lock files, Semgrep-based SAST for early adoption, Access and Verify actions for environments, Terraform CI/CD template authentication to module registry, GitLab advisory data in container scanning results, new audit events for merge settings, Reporter role management of iterations and milestones, dependency path information, Secure and Protect analyzer major version updates, Static Analysis analyzer updates, approving deployments from Environments detail page, and scan result policies in MR approval settings. The post also notes the migration of SAST, Container Scanning, and Secret Detection scanners to the Free tier, and outlines the additional scanners and enhanced developer/security team lifecycle features available in the Ultimate tier.
  32. How DevSecOps can protect businesses from future supply chain attacksThis post details how GitLab's DevSecOps platform integrates with Jscrambler to provide client-side code protection (obfuscation, code locks, runtime protection) and real-time monitoring for web supply chain attacks. It emphasizes the zero-trust approach enabled by Jscrambler's rules engine and the platform's ability to provide visibility and control over third-party script behavior.
  33. A deep dive into how we investigate and secure GitLab packagesThis post details GitLab's investigation into supply chain attacks, specifically dependency confusion. It highlights the security of GitLab's package registries for Ruby, JavaScript, and Go, noting that only the npm registry forwards to public registries after checking GitLab.com. It also discusses the development and planned open-sourcing of Package Hunter for dynamic behavior analysis of packages and the upcoming Dependency Firewall product category, which will include features for verifying package integrity, allow-listing packages, and delaying suspicious updates.
  34. GitLab Version 12 Year In Review: Releases 12.0 to 12.10This post reviews the key features and improvements released in GitLab versions 12.0 through 12.10, highlighting advancements across the Dev, Sec, and Ops stages. For Dev, it details productivity analytics, new package repositories (Conan, NuGet), and pipeline enhancements like DAGs and parent-child pipelines. For Sec, it covers dependency lists, security dashboards with project security grades, improved vulnerability management, autoremediation for container scanning, and container network security. For Ops, it introduces the Environments Dashboard, Merge Trains, group-level deploy tokens, HashiCorp Vault integration, EKS integration, and Log Explorer. It also emphasizes community contributions and the overall mission of making DevOps a reality.
  35. Why implementing security as code is important for DevSecOpsThis post defines 'security as code' as the practice of embedding security policies, tests, and scans into DevOps tools and workflows. It emphasizes automating security scans (SAST, DAST, pen testing) within pipelines, creating continuous feedback loops for developers, monitoring automated policies, automating manual tests, testing in staging environments, and creating logs for review dashboards. It positions security as code as a best practice for achieving DevSecOps.
  36. GitLab and WhiteSource: the easy way to secure your open source codeThis post introduces the integration of WhiteSource with GitLab Ultimate, enabling developers to find and fix open source vulnerabilities within their native coding environment and GitLab CI/CD pipelines. It highlights how vulnerable components are surfaced in merge requests and the Security Dashboard, providing actionable insights alongside other security scan results. The integration aims to secure open source code without compromising agility.
  37. How to overcome toolchain security challenges with GitLabThis post highlights the challenges of managing complex, integrated toolchains and how GitLab's single application approach addresses security risks by integrating security into the DevOps lifecycle. It emphasizes DevSecOps as a product of the shift-left movement, bringing security into the earliest phases of DevOps to save time, energy, and resources. GitLab's platform is presented as a solution for authentication and security requirements, offering built-in security measures across various DevOps lifecycle phases.
  38. Defending the CI/CD pipelineThis post details how to defend CI/CD pipelines against security risks by focusing on four key aspects: automation (integrating security testing at scale), access management (securing human-to-tool and tool-to-tool interactions, managing secrets), user experience (seamless integration, reducing friction, immediate feedback), and transparency (single source of truth, logging, accountability). It highlights the benefits of a single CI/CD tool for the entire lifecycle, embedding security checks within the development workflow.
  39. How to ensure security at the speed of DevOpsThis post outlines six strategies to integrate security into the DevOps lifecycle: making small, frequent changes; educating developers and security teams; failing fast and fixing fast; prioritizing risks based on severity and likelihood of exploitation; automating security processes; and testing more frequently. It emphasizes communication and transparency between teams and highlights the benefit of integrated tools like GitLab for a unified DevSecOps approach.
  40. 5 Security testing principles every developer should knowThis post introduces five principles for integrating security testing into the development lifecycle: evangelizing security efforts, testing early and often (SAST, DAST, dependency scanning), verifying changes with code reviews, maintaining a master log of deployments and dependencies, and diversifying the security testing portfolio. It highlights the importance of shifting security left and achieving a DevSecOps model.
  41. Announcing GitLab for DevSecOpsThis post announces the evolution of GitLab into a single application for the DevSecOps lifecycle, integrating security features like SAST, DAST, dependency scanning, and container scanning into the CI/CD pipeline. It also introduces security dashboards and auto-remediation capabilities, aiming to shift security left and improve efficiency.
  42. Monkton's journey to GitLab: Focusing on automationThis post details Monkton's migration to GitLab, highlighting the consolidation of disparate tools into a single platform for source control, CI/CD, and DevOps. Key technical contributions include the automation of previously manual processes such as code scans (e.g., uploading to Fortify) and the development of pipelines for automated publishing to MDM. The narrative emphasizes the benefits of repeatability in their security and delivery processes, enabling rapid updates and consistent outcomes. The focus is on removing human error through automation in testing, deployment, and security vulnerability scanning.
  43. Speed up secure software delivery with DevSecOpsThis post introduces the concept of embedding security into the developer workflow to accelerate software delivery. It highlights the use of Static Application Security Testing (SAST) within GitLab's pipeline reports to present individual vulnerability alerts to developers for review and remediation. The post also mentions the Security Group Dashboard for security analysts to track unresolved or dismissed alerts. It emphasizes the benefits of DevSecOps in reducing release times and improving collaboration by integrating security checks into CI/CD processes.
  44. GitLab's security tools and the HIPAA risk analysisThis post details the integration of SAST, DAST, Container Scanning, and Secret Detection into GitLab's CI/CD pipelines. It outlines how these tools identify vulnerabilities in source code, running web applications, Docker images, and secrets respectively, and how their results are displayed in merge requests and security reports. It also announces upcoming features like IAST and fuzzing.
  45. GitLab Runner update required to use SAST in Auto DevOpsThis post details a required update to GitLab Runner (to v11.5+) to support the new `reports` syntax in SAST job definitions for Auto DevOps. This syntax change is necessary for displaying SAST results in the Group Security Dashboard. Users not meeting specific criteria (using Auto DevOps, older runners, and interested in security reports) are not affected. The change will be deployed with GitLab 11.6.
  46. Security dashboards secure applications at DevOps speedThis post introduces the Security Dashboard as a new feature in GitLab 11.1, designed to help security professionals view vulnerabilities across a project. It highlights the integration of SAST, DAST, container scanning, and dependency scanning as built-in security products within GitLab, aiming to reduce context switching for engineers and enable proactive security by scanning all code commits early in the development process.
  47. What our summit in South Africa taught me about cybersecurityThis post introduces a new analogy for application security testing, comparing it to smartphone photography. It argues that the primary objective of application security should be to get vulnerabilities fixed, which requires integrating security findings directly into the developer's workflow. GitLab's approach is presented as analogous to a smartphone camera: always available, easy to use, and integrated with sharing mechanisms (developer workflow). It contrasts this with traditional, separate security tools that require developers to log into a different system. The post highlights that GitLab shows security vulnerabilities alongside other pipeline results in merge requests, enabling developers to act on them immediately. It also mentions the Security Dashboard as a tool for security teams to evaluate and create remediation issues.