GitLab strengthens supply chain with compliance features

This post introduces new capabilities for securing the software supply chain and enhancing compliance. New features include Infrastructure as Code (IaC) scanning for configuration files (YAML, Kubernetes, CloudFormation, Terraform), improved container scanning using Trivy, and API security testing with fuzzing technology and a beta DAST scanner. Future plans include production container scanning, general availability of the DAST API scanner, and API Discovery. For security governance, continuous compliance is enhanced with automated enforcement of scans and controls, and a policy editor for fine-grained risk management. Future plans include compliance checks in merge requests and group-level governance. The benefits of a single DevOps platform are highlighted with unified vulnerability management and reporting, and the adoption of Semgrep as a proprietary SAST scanner. Future plans include securing the full software supply chain, inline security training, and intelligent code security.