GitLab Security Specialist case studies
GitLab Security Specialist · Put your knowledge to work in context.
The GitLab Security Specialist credential is an independent, vendor-neutral exam designed for security engineers, DevSecOps practitioners, platform administrators, and compliance leads who want to validate their ability to harden a software factory built on GitLab and to let AI agents operate with earned autonomy without trading away security. The exam is delivered in English and is structured around five equally weighted domains: Application Security Testing, Governance & Compliance, Secrets Management, Supply Chain Security, and Visibility & Measurement. Each domain accounts for 20% of the scored content, so no single area can be skipped. Questions test practical judgment in realistic GitLab scenarios: how scanning and policies run inside the pipeline rather than beside it, how findings land in merge requests, how secrets stay under existing permissions, how SBOM tracking and air-gapped deployment support supply chain assurance, and how audit trails capture every human and agent action. The GitLab Security Specialist case studies are 5 cases and about 4,356 words.
1Reintroducing DAST Without Blowing the Merge Request Budget
Northwind Payments runs 38 GitLab projects in one group. Merge request pipelines run SAST, dependency scanning, secret detection, and container scanning.
958 words, about 5 min2What the Compliance Framework Actually Enforces
Helio Health is a 400-engineer company under SOX-style change control. It applied a GitLab compliance framework named SOX-IT to 60 projects containing financial reporting code.
880 words, about 4 min3A Maintainer Token Leaked Fourteen Months Ago
Vertex Logistics had a GitLab personal access token with api scope committed to a private repository's deployment script 14 months ago. Secret detection flagged nothing because the feature was enabled after the commit.
800 words, about 4 min4Dependency Confusion and Unsigned Images in Checkout
Kestrel Retail's checkout service builds a container image in GitLab CI and deploys it to Kubernetes with Helm. The Dockerfile runs npm install from the public registry.
895 words, about 4 min5A Remediation Metric the Board Should Not See
Orion Media's security dashboard reports a mean time to remediate of 41 days across 120 projects. The CISO's board report repeats 41 days; engineering says the real number is closer to 90.
823 words, about 4 min