Understanding GitLab’s security scanning strategy
There are a few fundamental principles underlying GitLab’s security scanners that will be useful for you to know before you learn about what each scanner does. Let’s look at those now.
GitLab uses open-source scanners
It might surprise you to learn that all the security scanners discussed in this chapter are third-party, open-source tools; none of them are developed in-house by GitLab. For example, IaC scanning is performed by the open-source tool Keeping Infrastructure as Code Secure (KICS), and Dependency Scanning is handled by the open-source tool Gemnasium.
That doesn’t mean that these third-party scanners are inferior to GitLab-developed software in any way. They are all rigorously researched and vetted by GitLab before they are adopted as official GitLab scanners. Furthermore, GitLab frequently reviews new open-source security scanners to see whether they should replace or supplement any of...
