Static Application Security Testing analyzes source code without executing it. In GitLab, SAST runs as a CI job using language-specific analyzers and reports vulnerabilities in the merge request and security dashboard.

Dynamic Application Security Testing probes a running application over HTTP. GitLab DAST requires a deployed target URL and runs as a CI job or on-demand scan.

A GitLab scanner that inspects project dependencies for known vulnerabilities using the GitLab Advisory Database. It reports per-dependency findings and supports SBOM generation.

A GitLab scanner that checks container images for vulnerable OS packages and language libraries. It runs after image build and can scan images from the registry.

A GitLab scanner that searches repository commits and merge requests for credentials using regex and entropy rules. Findings appear as vulnerabilities and can be blocked by push protection.

A GitLab security scanner that sends generated requests to API endpoints to discover crashes and unexpected behavior. It requires an OpenAPI, Swagger, or HAR specification and a target.

A GitLab feature that identifies dependency licenses and compares them to an allow/deny policy. A denied license creates a policy violation, not a vulnerability.

Scan Execution Policy

A GitLab governance policy that enforces security scans such as SAST, DAST, or Secret Detection on scheduled or pipeline triggers without editing the project CI file.

A GitLab construct that maps regulatory controls to project settings and features. Attaching a framework to a project produces compliance status and audit evidence.

Merge Request Approval Policy

A GitLab policy that requires approvals based on scan findings, such as any Critical vulnerability, and is evaluated when the merge request is created and updated.

GitLab records of actions such as project changes, permission changes, and policy edits. They support filtering and streaming to external destinations for retention.

A control that prevents one person from both authoring and approving a change. GitLab implements it via protected branches, approval rules, and protected environments.

A pass/fail indicator per compliance control for a project. Failed controls link to the specific setting or project that must be remediated.

Audit Event Streaming

A GitLab Ultimate feature that sends audit events to an external HTTP endpoint or cloud storage. It requires a destination configured at group or instance level.

Protected CI/CD Variable

A variable exposed only to pipelines running on protected branches or tags. It is not available to feature-branch pipelines, reducing exposure of production secrets.

Masked CI/CD Variable

A variable whose value is hidden in job logs. Masking requires at least 8 Base64-compatible characters and does not prevent job code from reading the value.

External Secrets Integration

A GitLab capability that injects secrets from providers such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager at job runtime.

Secret Push Protection

A GitLab feature that blocks pushes containing detected secrets before they reach the remote repository. It must be enabled for the project or group.

GitLab resolves CI/CD variables in order: instance, group, project, pipeline, manual job. The most specific scope wins when names collide.

Short-lived JSON Web Tokens issued to CI jobs via the id_tokens keyword. They let jobs authenticate to cloud providers without storing long-lived credentials.

Leaked Secret Remediation

Revoke and rotate the secret at its source. Deleting the commit or file does not remove the secret from Git history, caches, or forks.

GitLab generates a Software Bill of Materials in CycloneDX JSON format for a project or group. It lists direct and transitive dependencies for supply chain visibility.

A GitLab view of direct and transitive dependencies for a project. It supports SBOM export and feeds dependency scanning and license reporting.

GitLab Advisory Database

The vulnerability database used by GitLab Dependency Scanning. It maps affected package versions to CVEs and provides severity and remediation guidance.

Commits signed with GPG or SSH keys that GitLab verifies and marks as verified. They provide provenance evidence in the supply chain.

License Approval Policy

A GitLab policy that defines allowed and denied dependency licenses. When enforced, a denied license blocks the merge request.

Pipeline Composition Analysis

A GitLab Ultimate view of components and dependencies used in a pipeline, including container images and CI/CD components, for supply chain visibility.

A GitLab view listing findings per project or group with severity, status, and scanner. Statuses include Detected, Confirmed, Dismissed, and Resolved.

A GitLab view summarizing vulnerability trends across projects. Visibility depends on role and tier, with project-level and group-level dashboards.

Mean Time To Remediate, the average time between a vulnerability being detected and resolved. It is derived from finding creation and resolution timestamps.

Mean Time To Detect, the average time between a vulnerability being introduced and detected. It is derived from scan and finding timestamps.

Pipeline Security Tab

A GitLab pipeline view showing per-job scan results. It allows downloading JSON artifacts for external reporting and review.

GitLab Security Specialist study materials

GitLab Security Specialist flashcards

GitLab Security Specialist · Build recall with a focused review session.

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SAST: Static Application Security Testing analyzes source code without executing it. In GitLab, SAST runs as a CI job using language-specific analyzers and reports vulnerabilities in the merge request and security dashboard.
DAST: Dynamic Application Security Testing probes a running application over HTTP. GitLab DAST requires a deployed target URL and runs as a CI job or on-demand scan.
Dependency Scanning: A GitLab scanner that inspects project dependencies for known vulnerabilities using the GitLab Advisory Database. It reports per-dependency findings and supports SBOM generation.
Container Scanning: A GitLab scanner that checks container images for vulnerable OS packages and language libraries. It runs after image build and can scan images from the registry.
Secret Detection: A GitLab scanner that searches repository commits and merge requests for credentials using regex and entropy rules. Findings appear as vulnerabilities and can be blocked by push protection.
API Fuzzing: A GitLab security scanner that sends generated requests to API endpoints to discover crashes and unexpected behavior. It requires an OpenAPI, Swagger, or HAR specification and a target.
License Scanning: A GitLab feature that identifies dependency licenses and compares them to an allow/deny policy. A denied license creates a policy violation, not a vulnerability.
Scan Execution Policy: A GitLab governance policy that enforces security scans such as SAST, DAST, or Secret Detection on scheduled or pipeline triggers without editing the project CI file.
Compliance Framework: A GitLab construct that maps regulatory controls to project settings and features. Attaching a framework to a project produces compliance status and audit evidence.
Merge Request Approval Policy: A GitLab policy that requires approvals based on scan findings, such as any Critical vulnerability, and is evaluated when the merge request is created and updated.
Audit Events: GitLab records of actions such as project changes, permission changes, and policy edits. They support filtering and streaming to external destinations for retention.
Separation of Duties: A control that prevents one person from both authoring and approving a change. GitLab implements it via protected branches, approval rules, and protected environments.
Compliance Status: A pass/fail indicator per compliance control for a project. Failed controls link to the specific setting or project that must be remediated.
Audit Event Streaming: A GitLab Ultimate feature that sends audit events to an external HTTP endpoint or cloud storage. It requires a destination configured at group or instance level.
Protected CI/CD Variable: A variable exposed only to pipelines running on protected branches or tags. It is not available to feature-branch pipelines, reducing exposure of production secrets.
Masked CI/CD Variable: A variable whose value is hidden in job logs. Masking requires at least 8 Base64-compatible characters and does not prevent job code from reading the value.
External Secrets Integration: A GitLab capability that injects secrets from providers such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager at job runtime.
Secret Push Protection: A GitLab feature that blocks pushes containing detected secrets before they reach the remote repository. It must be enabled for the project or group.
Variable Precedence: GitLab resolves CI/CD variables in order: instance, group, project, pipeline, manual job. The most specific scope wins when names collide.
ID Tokens (OIDC): Short-lived JSON Web Tokens issued to CI jobs via the id_tokens keyword. They let jobs authenticate to cloud providers without storing long-lived credentials.
Leaked Secret Remediation: Revoke and rotate the secret at its source. Deleting the commit or file does not remove the secret from Git history, caches, or forks.
SBOM Export: GitLab generates a Software Bill of Materials in CycloneDX JSON format for a project or group. It lists direct and transitive dependencies for supply chain visibility.
Dependency Graph: A GitLab view of direct and transitive dependencies for a project. It supports SBOM export and feeds dependency scanning and license reporting.
GitLab Advisory Database: The vulnerability database used by GitLab Dependency Scanning. It maps affected package versions to CVEs and provides severity and remediation guidance.
Signed Commits: Commits signed with GPG or SSH keys that GitLab verifies and marks as verified. They provide provenance evidence in the supply chain.
License Approval Policy: A GitLab policy that defines allowed and denied dependency licenses. When enforced, a denied license blocks the merge request.
Pipeline Composition Analysis: A GitLab Ultimate view of components and dependencies used in a pipeline, including container images and CI/CD components, for supply chain visibility.
Vulnerability Report: A GitLab view listing findings per project or group with severity, status, and scanner. Statuses include Detected, Confirmed, Dismissed, and Resolved.
Security Dashboard: A GitLab view summarizing vulnerability trends across projects. Visibility depends on role and tier, with project-level and group-level dashboards.
MTTR: Mean Time To Remediate, the average time between a vulnerability being detected and resolved. It is derived from finding creation and resolution timestamps.
MTTD: Mean Time To Detect, the average time between a vulnerability being introduced and detected. It is derived from scan and finding timestamps.
Pipeline Security Tab: A GitLab pipeline view showing per-job scan results. It allows downloading JSON artifacts for external reporting and review.