GitLab Application Security Testing

GitLab Application Security Testing (AST) is a comprehensive, built-in application security testing suite embedded directly into GitLab continuous integration and delivery (CI/CD) pipelines to identify, triage, and remediate vulnerabilities across code, open-source dependencies, containers, and cloud infrastructure. By integrating security into the native developer workflow, GitLab eliminates the friction between security teams and software engineers.

The suite unifies multiple testing methodologies within GitLab Ultimate—including Static Application Security Testing (SAST), Dynamic Analysis (DAST), Software Composition Analysis (Dependency Scanning), Container Scanning, Secret Detection, Infrastructure as Code (IaC) Scanning, and Coverage-Guided Fuzzing. Key capabilities include automated pipeline security scans, merge request security widgets showing new vulnerabilities introduced by specific commits, automated policy enforcement that blocks merges on critical flaws, and a centralized Security Dashboard for security executives.

Global enterprises, cloud-native engineering squads, and regulated software vendors deploy GitLab Application Security Testing to achieve true shift-left DevSecOps without purchasing disconnected point tools. It integrates natively with GitLab repositories, issue boards, and Kubernetes clusters. Common operational use cases include catching OWASP Top 10 vulnerabilities during code review, identifying vulnerable open-source dependencies before code merges, generating Software Bills of Materials (SBOMs), and maintaining continuous audit readiness for SOC 2, HIPAA, and ISO 27001 compliance.