Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
GitLab provides an integrated DevSecOps platform that embeds security testing directly into the CI/CD pipeline. By leveraging GitLab's built-in security scanners---SAST, DAST, container scanning, dependency scanning, secret detection, and license compliance---teams can shift security left, catching vulnerabilities during development rather than post-deployment. GitLab Duo AI assists with false positive detection for SAST vulnerabilities, helping security teams focus on genuine issues.
When to Use
When deploying or configuring building devsecops pipeline with gitlab ci capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
These mistakes make the pipeline look green while the security gate is a no-op:
allow_failure: true on scanners. GitLab's managed templates default sast/dependency_scanning/secret_detection/container_scanning to allow_failure: true, so findings never fail the pipeline. Set allow_failure: false on every scanner job you intend to gate on.
Findings reported but never gated. A vulnerability report artifact in the MR widget is not a gate — without a Merge Request Approval Policy that blocks on Critical/High, the MR still merges.
Scanners not running on the branch you think.rules: that restrict jobs to $CI_DEFAULT_BRANCH mean feature branches and MRs are never scanned. Confirm jobs actually appear in the pipeline for MR events.
Container scan threshold too loose / scans wrong image. Verify CS_IMAGE/CS_SEVERITY_THRESHOLD point at the freshly built $DOCKER_IMAGE, not :latest.
DAST against an empty/unreachable staging URL silently passes — confirm DAST_WEBSITE returns the real app.
Concrete verification: Open an MR that adds a known secret (AKIAIOSFODNN7EXAMPLE plus a fake aws_secret_access_key) and a deliberately vulnerable dependency (e.g. lodash@4.17.4). Confirm the pipeline fails (red, non-zero exit) on and and that the MR is blocked from merging — not merely annotated. Then remove the test commit.
secret_detection
dependency_scanning
Prerequisites
GitLab Ultimate license (required for full security scanner suite)
GitLab Runner configured (shared or self-hosted)
.gitlab-ci.yml pipeline configuration familiarity
Docker-in-Docker (DinD) or Kaniko for container builds
Application deployed to a staging environment for DAST scanning
Core Security Scanning Stages
Static Application Security Testing (SAST)
SAST analyzes source code for vulnerabilities before compilation. GitLab supports 14+ languages using analyzers such as Semgrep, SpotBugs, Gosec, Bandit, and NodeJsScan. The simplest inclusion uses GitLab's managed templates.
Dynamic Application Security Testing (DAST)
DAST tests running applications by simulating attack payloads against HTTP endpoints. It detects XSS, SQLi, CSRF, and other runtime vulnerabilities that static analysis cannot find. DAST requires a deployed, accessible target URL.
Container Scanning
Uses Trivy to scan Docker images for known CVEs in OS packages and application dependencies. Runs after the Docker build stage to gate images before they reach a registry.
Dependency Scanning
Inspects dependency manifests (package.json, requirements.txt, pom.xml, Gemfile.lock) for known vulnerable versions. Operates at the source code level, complementing container scanning.
Secret Detection
Scans commits for accidentally committed credentials, API keys, tokens, and private keys using pattern matching and entropy analysis. Runs on every commit to prevent secrets from reaching the repository.
Implementation
Complete Pipeline Configuration
# .gitlab-ci.ymlstages:-build-test-security-deploy-staging-dast-deploy-productionvariables:DOCKER_IMAGE:$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHASECURE_LOG_LEVEL:"info"# Include GitLab managed security templatesinclude:-template:Security/SAST.gitlab-ci.yml-template:Security/Secret-Detection.gitlab-ci.yml-template:Security/Dependency-Scanning.gitlab-ci.yml-template:Security/Container-Scanning.gitlab-ci.yml-template:DAST.gitlab-ci.yml-template:Security/License-Scanning.gitlab-ci.ymlbuild:stage:buildimage:docker:24.0services:-docker:24.0-dindvariables:DOCKER_TLS_CERTDIR:"/certs"script:-dockerlogin-u$CI_REGISTRY_USER-p$CI_REGISTRY_PASSWORD$CI_REGISTRY-dockerbuild-t$DOCKER_IMAGE.-dockerpush$DOCKER_IMAGErules:-if:$CI_COMMIT_BRANCHunit-tests:stage:testimage:$DOCKER_IMAGEscript:-npmci-npmruntest:coveragecoverage:'/Lines\s*:\s*(\d+\.?\d*)%/'artifacts:reports:junit:junit-report.xmlcoverage_report:coverage_format:coberturapath:coverage/cobertura-coverage.xml# Override SAST to run in security stagesast:stage:securityvariables:SAST_EXCLUDED_PATHS:"spec,test,tests,tmp,node_modules"SEARCH_MAX_DEPTH:10# Override container scanningcontainer_scanning:stage:securityvariables:CS_IMAGE:$DOCKER_IMAGECS_SEVERITY_THRESHOLD:"HIGH"# Override dependency scanningdependency_scanning:stage:security# Override secret detectionsecret_detection:stage:security# License compliance scanninglicense_scanning:stage:securitydeploy-staging:stage:deploy-stagingimage:bitnami/kubectl:latestscript:-kubectlsetimagedeployment/appapp=$DOCKER_IMAGE-nstaging-kubectlrolloutstatusdeployment/app-nstaging--timeout=300senvironment:name:stagingurl:https://staging.example.comrules:-if:$CI_COMMIT_BRANCH==$CI_DEFAULT_BRANCH# DAST runs against deployed stagingdast:stage:dastvariables:DAST_WEBSITE:https://staging.example.comDAST_FULL_SCAN_ENABLED:"true"DAST_BROWSER_SCAN:"true"needs:-deploy-stagingrules:-if:$CI_COMMIT_BRANCH==$CI_DEFAULT_BRANCHdeploy-production:stage:deploy-productionimage:bitnami/kubectl:latestscript:-kubectlsetimagedeployment/appapp=$DOCKER_IMAGE-nproduction-kubectlrolloutstatusdeployment/app-nproduction--timeout=300senvironment:name:productionurl:https://app.example.comwhen:manualrules:-if:$CI_COMMIT_BRANCH==$CI_DEFAULT_BRANCH
Security Approval Policies
Configure scan execution policies to enforce mandatory security scans:
Navigate to Security & Compliance > Policies
Create a "Scan Execution Policy" requiring SAST and secret detection on all branches
Create a "Merge Request Approval Policy" requiring security team approval when critical vulnerabilities are detected
Custom SAST Ruleset Configuration
Create .gitlab/sast-ruleset.toml to customize analyzer behavior:
GitLab consolidates all scanner findings into a single Vulnerability Report accessible at Security & Compliance > Vulnerability Report. Each vulnerability includes:
