GitLab's security trends report – our latest look at what's most vulnerable

This post analyzes security vulnerability trends across thousands of projects hosted on GitLab.com, identifying trends and patterns for security practitioners. It provides recommendations for security issue triage, applying security fixes for containers and project dependencies, static and dynamic analysis, secret storage, web application security, and fuzz testing. It also details trends by CWE, including Improper Input Validation (CWE-20), Out of Bounds Write (CWE-787), and Uncontrolled Resource Consumption (CWE-400). Dependency scanner trends show an increase in projects finding issues with dependent libraries, and container scanner trends show a decrease in projects finding issues with containers. Static analysis trends remain mostly unchanged, with specific vulnerabilities like 'Password in URL' and 'Insecure usage of temporary file' highlighted. Secret handling vulnerabilities include PKCS, RSA Key, and AWS API keys. DAST trends show an increase in projects finding vulnerabilities.