Implementing Security Scanning

1. Running SAST Scans

Option	Values	Description
sast:	`enabled`	Enable SAST in the pipeline
sast.config_file	`path/to/config.yml`	Path to SAST configuration file
sast.cache_path	`cache/sast`	Cache directory for SAST tools

Example: Basic SAST job configuration

sast:
  image: "registry.gitlab.com/gitlab-org/security-products/analyzers/sast:latest"
  script:
    - sast
  artifacts:
    paths:
      - gl-sast-report.json

Example: SAST with custom config

sast:
  image: "registry.gitlab.com/gitlab-org/security-products/analyzers/sast:latest"
  script:
    - sast
  artifacts:
    paths:
      - gl-sast-report.json
  variables:
    SAST_CONFIG_FILE: "custom-config.yml"

Note: SAST scans are performed during the pipeline execution and report findings in gl-sast-report.json.

Warning: Ensure that the SAST image version matches your GitLab version for compatibility.

2. Running Dependency Scanning

Option	Values	Description
dependency_scanning	`true`	Enable dependency scanning in the pipeline
config_file	`.gitlab/dependency-scanning-report.json`	Path to the configuration file for dependency scanning
report_format	`json`	Output format of the report (e.g., `json`, `html`)

Example: Enable Dependency Scanning in a Pipeline

stages:
  - scan

dependency_scan:
  stage: scan
  image: registry.gitlab.com/gitlab-org/security-products/dependency-scanning:latest
  script:
    - dependency-scanning
  artifacts:
    reports:
      dependency_scanning: gl-dependency-scanning-report.json

Note: Dependency scanning is available in GitLab CI/CD for projects using the registry.gitlab.com/gitlab-org/security-products/dependency-scanning image.

Warning: Ensure that the dependency-scanning image is compatible with your project's environment and dependencies.

3. Using Container Scanning

Example: Enable container scanning in GitLab CI

include:
  - template: Security/Container-Scanning.gitlab-ci.yml

scan:
  stage: test
  variables:
    CONTAINER_SCAN_IMAGE: "my-app:latest"

Variable	Default Value	Description
CONTAINER_SCAN_IMAGE	`registry.gitlab.com/group/project:latest`	Image to scan for vulnerabilities
CONTAINER_SCAN_DOCKERFILE	`Dockerfile`	Path to Dockerfile used for building image
CONTAINER_SCAN_REPORT_FORMAT	`json`	Report format (json, sarif)

Note: Container scanning requires GitLab Runner with Docker support enabled.

Warning: Scans are performed in a separate container and do not affect the main job environment.

Container Scanning Workflow

Builds the container image using provided Dockerfile
Runs vulnerability scan on the built image
Generates report in JSON or SARIF format
Uploads results to GitLab for display in Security Dashboard

4. Running DAST Scans

Option	Values	Description
dast_config	`string`	Path to the DAST configuration file
dast_target_url	`string`	URL to scan for vulnerabilities
dast_scan_timeout	`integer`	Maximum time (in seconds) to run the scan

Example: DAST Scan Configuration

variables:
  DAST_CONFIG: "config/dast.yaml"
  DAST_TARGET_URL: "https://example.com"
  DAST_SCAN_TIMEOUT: "300"

dast:
  stage: security
  image: "gitlab/gitlab-dast:latest"
  script:
    - dast-scan --config $DAST_CONFIG --target $DAST_TARGET_URL --timeout $DAST_SCAN_TIMEOUT
  artifacts:
    reports:
      dast: "gl-dast-report.json"

Note: Ensure that the target URL is accessible from the runner environment and that proper authentication is configured if required.

5. Implementing Secret Detection

Option	Values	Notes
secret_detection.enabled	`true`	Enable secret detection in the pipeline
secret_detection.rules	`default`	Predefined rules for secret detection
secret_detection.exclude_paths	`["/vendor/", "/node_modules/"]`	Paths to exclude from secret scanning

Example: Basic secret detection configuration

secret_detection:
  enabled: true
  rules: default
  exclude_paths:
    - "**/vendor/**"
    - "**/node_modules/**"

Note: GitLab CI/CD secret detection uses a set of predefined rules to identify potential secrets in your codebase. These rules are updated regularly to detect new types of secrets.

Warning: Ensure that sensitive data is not committed to the repository. Secret detection helps identify such data but does not prevent it from being committed.

6. Using License Scanning

Option	Values	Description
license_scanning.enabled	`true`	Enable or disable license scanning in the pipeline
license_scanning.config_file	`.gitlab/license-scanning.yml`	Path to the license scanning configuration file
license_scanning.report_format	`json`, `csv`	Output format for the license report

Example: License Scanning Configuration

license_scanning:
  enabled: true
  config_file: .gitlab/license-scanning.yml
  report_format: json

Note: License scanning is available in GitLab Premium and Ultimate editions.

License Type	Description	Compliance Status
`MIT`	Permissive open-source license	Compliant
`GPL v3`	Copyleft license with restrictions	Non-compliant
`BSD-3-Clause`	Permissive open-source license	Compliant

Example: License Report Output

{
  "licenses": [
    {
      "name": "MIT",
      "count": 5,
      "compliant": true
    },
    {
      "name": "GPL v3",
      "count": 1,
      "compliant": false
    }
  ]
}

7. Running Coverage-Guided Fuzzing

Coverage-guided fuzzing is a technique used to find bugs and vulnerabilities in software by automatically generating inputs that maximize code coverage. GitLab CI/CD supports integration with tools like libFuzzer and AFL++ for running such fuzzing campaigns.

Feature	Description	Support Status
Fuzzing Tool	Supports `libFuzzer`, `AFL++`	NEW in GitLab 16.0
Coverage Metrics	Tracks code coverage during fuzzing runs	NEW in GitLab 16.0
Integration with CI	Can be integrated into GitLab CI jobs using `fuzzing` job type	NEW in GitLab 16.0

Example: Configuring a Fuzzing Job

fuzzing:
  stage: fuzz
  image: "golang:latest"
  script:
    - go install github.com/AdaLogics/go-fuzz/cmd/go-fuzz@latest
    - go-fuzz -bin=<binary> -workdir=<workdir>
  artifacts:
    paths:
      - "fuzzing-results"

Note: Fuzzing jobs require a properly configured build environment and must be run in a secure CI context to prevent abuse.

8. Implementing API Security Testing

Test Type	Description	Tool/Command	Notes
Static API Analysis	Scans API definitions (OpenAPI/Swagger) for security vulnerabilities	`swagger-codegen` with security plugins	Can detect insecure endpoints, missing auth checks
Dynamic API Testing	Tests live API endpoints for vulnerabilities like SQLi, XSS	`OWASP ZAP`, `Postman`	Requires running API instance for testing
Authentication Testing	Verifies API authentication mechanisms (OAuth, JWT)	`jwt.io`, `curl`	Check token expiration, scope validation

Example: API Security Scan with OWASP ZAP

docker run -t owasp/zap2docker-stable zap.sh -cmd -quickurl https://api.example.com/v1 -quickout results.json

Note: Ensure API endpoints are accessible and properly configured before running security tests.

Warning: Avoid scanning production APIs without prior approval to prevent service disruption.

Security Test	Scan Type	Frequency	Integration
JWT Token Validation	Static Analysis	Daily	GitLab CI Pipeline
Endpoint Fuzzing	Dynamic Analysis	Weekly	Manual or Scheduled Job
Vulnerability Scanning	Static + Dynamic	On Merge	GitLab CI Pipeline

9. Using Security Dashboards

Example: Configuring Security Dashboard in GitLab

stages:
  - scan
  - report

security_scan:
  stage: scan
  image: <security-scanner-image>
  script:
    - <security-scan-command>
  artifacts:
    reports:
      security:
        sarif: <path-to-sarif-file>
  only:
    - main
    - merge_requests

security_dashboard:
  stage: report
  image: gitlab/gitlab-security-dashboard:latest
  script:
    - <dashboard-setup-command>
  artifacts:
    reports:
      security:
        sarif: <path-to-sarif-file>
  only:
    - main

Dashboard Component	Description	Configuration	Status
Vulnerability Scanning	Scans for known vulnerabilities in dependencies and code	`security_scan` job with `sarif` report	NEW
SAST Integration	Static Application Security Testing results	`sast` job in pipeline	NEW
Container Scanning	Scans container images for vulnerabilities	`container_scanning` job	NEW

Note: Security dashboards require GitLab Premium or Ultimate license.

Security Dashboard Features

Vulnerability Overview - Centralized view of all security findings
SAST Results - Static analysis scan results
Container Scan Reports - Image-based vulnerability reports
Compliance Metrics - Security compliance status and trends

Setting Up Security Dashboard

Create a new CI job for security scanning
Configure artifact reporting in SARIF format
Set up a dashboard job using GitLab's security dashboard image
Ensure proper permissions and access control for the dashboard
Review dashboard reports in GitLab UI or API

10. Configuring Security Policies

Policy Type	Description	Configuration Example	Status
SAST Policy	Static Application Security Testing policy to detect vulnerabilities in source code	`include: - template: Security/SAST.gitlab-ci.yml`	NEW
DAST Policy	Dynamic Application Security Testing policy to scan running applications	`include: - template: Security/DAST.gitlab-ci.yml`	NEW
Container Scanning Policy	Scans container images for vulnerabilities in dependencies	`include: - template: Security/Container-Scanning.gitlab-ci.yml`	NEW
Dependency Scanning Policy	Scans project dependencies for known vulnerabilities	`include: - template: Security/Dependency-Scanning.gitlab-ci.yml`	NEW

Example: SAST Policy Configuration

sast:
  image: "registry.gitlab.com/gitlab-org/security-products/analyzers/sast:latest"
  script:
    - sast
  artifacts:
    reports:
      sast: gl-sast-report.json

Example: DAST Policy Configuration

dast:
  image: "registry.gitlab.com/gitlab-org/security-products/analyzers/dast:latest"
  script:
    - dast
  artifacts:
    reports:
      dast: gl-dast-report.json

Note: Ensure that security policies are integrated into your CI pipeline stages and artifacts are properly reported for compliance.