5 ways to fix misleading vulnerability severities with policy
… Use cases with ready-to-use configurations Each example below includes a policy configuration you can copy, customize, and apply immediately. …
Search
Get better container security with GitLab: 4 real-world examples
… The malicious code modifies configurations on the container's file system that further exposes the container to attack, or perhaps, escalates the attacker's privileges. …
AI-powered vulnerability triaging with GitLab Duo Security Agent
… Available security scanners GitLab offers the following security scanning capabilities: Static Application Security Testing SAST : Analyzes source code for vulnerabilities Dependency Scanning : Identifies vulnerabilities in project dependencies Container Scanning : Scans Docker images for known vul… …
OWASP Top 10 2025: What's changed and why it matters
… Perform Secret Detection to identify credentials in configuration files, environment variables, and code, preventing plaintext password storage and ensuring secrets are properly managed through GitLab's CI/CD variables with masking and encryption. …
Critical remote code execution in Serena, a popular MCP coding agent
… Project configuration files were treated as trusted input. A repository's configuration files are authored by the repository owner. In any threat model where the repository may be untrusted, those files are attacker-controlled input. …
Meet the demand for SBOMs with GitLab and Rezilion
… You can also use the Configuration UI to set up and configure these security scanners. You can check out the set up instructions for each scanner in the GitLab appsec configuration documentation. …
Harden your pipeline perimeter for the era of AI-assisted coding
… Advanced SAST uses cross-file taint analysis to follow untrusted input across multiple functions and files — the way an attacker would reason about your code. …
Top ten GitLab hacks for all stages of the DevOps Platform
… For GitLab CI/CD, open the pipeline editor and use the following configuration: Note that it is important to specify the TF ROOT and TF ADDRESS variables since you can manage multiple Terraform state files . variables : TF ROOT : ${CI PROJECT DIR} TF ADDRESS : ${CI API V4 URL}/projects/${CI PROJECT… …
Manage CI/CD credentials with GitLab Secrets Manager
… It lands in an over-scoped CI/CD variable, a config file, or a .env committed “just for a moment.” GitLab Secrets Manager, now in public beta with GitLab 19.0, keeps credentials in the same platform that runs your code and pipelines. …
GitLab automates instrumented fuzzing via American Fuzzy Lop
… Fabric can be used to configure the instances, start AFL, and so on. …