Securing Your Code

Now that you know how to configure your GitLab CI/CD pipeline to verify that your project’s code is meeting its requirements, the next step in constructing a pipeline is to add jobs that look for security vulnerabilities. This is an optional step, but since GitLab makes it easy to add security scanning to your pipelines, and since there’s virtually no downside other than adding a few minutes to your pipeline’s runtime, we recommend that you enable all security scanners that are relevant to your projects.

We’ll start this chapter by providing an overview of GitLab’s general strategy around using security scanners; several aspects of security scanning are helpful to understand before you start learning about individual scanners. Then, we’ll explain the purpose of each of the seven types of security testing that GitLab offers: Static Application Security Testing (SAST), Secret Detection, Dynamic Application Security Testing...