GitLab secret push protection
Blocking credentials before they reach the repository: how push protection works, skipping it for false positives, automatic revocation for some secret types and rollout across existing projects.
GitLab security scanning and supply chain
Running GitLab's application security scanners, security policies, SBOMs and build provenance on self-managed and offline instances, and knowing which tier each needs.
GitLab container scanning with Trivy
Scanning container images in pipelines with GitLab's Trivy integration, which results Free shows versus Ultimate, registry scanning on latest tags and allowlisting accepted vulnerabilities.
GitLab SBOM-based dependency scanning
Setting up the recommended SBOM-based dependency scanning in Ultimate, continuous rescans when advisories change and how results feed the dependency list and approval policies.
GitLab DAST with the browser-based analyzer
Running dynamic scans of web apps and SPAs from pipelines, schedules or on demand, choosing safe targets, and how DAST in Ultimate differs from a manual penetration test.
GitLab scan execution and merge request approval policies
Enforcing scanners and security approvals across groups with policies: the security policy project, policy_scope targeting, required roles and avoiding conflicting links.
Running GitLab security scanners offline
Mirroring analyzer images and vulnerability databases into an air-gapped GitLab: Secure-Binaries pipelines, SECURE_ANALYZERS_PREFIX, package mirrors and the cloud licensing opt-out to arrange first.
Exporting CycloneDX SBOMs from GitLab
Producing SBOMs from the GitLab dependency list for customers and regulators: CycloneDX, JSON and CSV exports, license data and what dependency scanning must run first.
SLSA build provenance with GitLab Runner
Generating SLSA 1.0 provenance for build artifacts with RUNNER_GENERATE_ARTIFACTS_METADATA, the in-toto statement format and how to store and verify the metadata files.
Migrate from Gemnasium to SBOM-based dependency scanning in GitLab
Moving off the deprecated Gemnasium analyzer before its proposed removal in GitLab 20.0: switching templates, comparing findings and updating policies that reference old jobs.
GitLab security scanning in Free vs Ultimate
What security testing you get without Ultimate: SAST, secret detection and container scanning in Free, versus Ultimate-only dependency scanning, DAST, policies, vulnerability management and SBOM export.
