glab-security

name	glab-security
description	Configure GitLab project security scan profiles with glab. Use when enabling, disabling, or checking GitLab security scan profiles such as SAST, dependency scanning, secret detection, container scanning, or dependency-scanning auto-remediation. Triggers on GitLab security config, security scan profile, enable SAST, dependency scanning, secret detection, glab security.

glab security

Configure GitLab security features for a project.

Experimental upstream command surface: verify live glab security --help before relying on it in production automation.

Common commands

# Show security command help
glab security --help

# Enable a scan profile on the current project
glab security config enable dependency_scanning

# Enable SAST on a specific project
glab security config enable sast -R gitlab-org/cli

# Check profile status
glab security config status dependency_scanning

# Disable a scan profile
glab security config disable dependency_scanning

# Disable dependency scanning auto-remediation
glab security config disable dependency_scanning_post_processing

Supported profile examples

Upstream help currently shows these profile names in examples:

• dependency_scanning
• sast
• dependency_scanning_post_processing for vulnerable dependency auto-remediation

GitLab may support additional profile names depending on instance version and project features. If a profile fails, use the error output and GitLab project security settings to confirm availability.

Operational guidance

• You must be a Maintainer or Owner of the target project.
• Use -R/--repo for explicit targeting in agents and scripts; otherwise glab resolves the project from the current git remote.
• Treat enable and disable as project-configuration writes. Confirm the target project and requested profile before changing state.
• Prefer status before and after a change so the user can see the current scan/profile state.

Safe workflow

PROFILE=sast
PROJECT=group/project

# 1. Inspect current state
glab security config status "$PROFILE" -R "$PROJECT"

# 2. Confirm requested change with the user, then apply
glab security config enable "$PROFILE" -R "$PROJECT"

# 3. Verify
glab security config status "$PROFILE" -R "$PROJECT"

Subcommands

See references/commands.md for the current captured --help output.