Top 6 security trends in GitLab-hosted projects
Apr 2, 2020Wayne Haber
Summary
This post introduces GitLab's first security trends report, analyzing vulnerability data from GitLab.com-hosted projects. It identifies six common vulnerability types: components with known vulnerabilities, XSS, lack of secret management, CSP, CSRF, and SQL injection. The report details trends in vulnerability scanning volume and specific vulnerability types, highlighting an increase in scanning activity and detected vulnerabilities. It also provides best practices for mitigating each vulnerability type, leveraging GitLab's security scanning tools (SAST, DAST, dependency scanning, container scanning, secret detection).
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting