GitLab’s Native SAST & DAST Analyzers

Why Use GitLab’s Built‑in Scanners?

Reason What it gives you When it’s the right choice
No extra cost All scans are included with GitLab Ultimate When you want to avoid purchasing third‑party tools such as SonarQube or ZAP
Seamless CI/CD integration Pre‑written CI templates, single‑file change When your repo is already on GitLab and you want instant coverage
Supported languages 30+ languages & frameworks (Java, Python, .NET, Node, etc.) When your application stack is on the supported list
Uniform reporting JSON artifacts that integrate with Merge Request widgets When you want to surface findings in the same UI you already use
One‑tool‑only option Either native scanner or external tool, not both When you choose a single vendor‑less approach

Tip – If you’re already using SonarCloud or ZAP, you do not need to add GitLab’s scanners. Pick the one that best fits your process.

Adding GitLab SAST & DAST to a Pipeline

The following steps show the minimal changes required to your .gitlab-ci.yml to activate the native scanners.

  1. Add the include templates

    `include:

    - template: Security/DAST.gitlab-ci.yml *# Native DAST*

  2. Set required variables

    `variables: *# Enable experimental GitLab SAST features (recommended)*SAST_EXPERIMENTAL_FEATURES: "true"

    *# The URL of the web app to scan (required for DAST)*DAST_WEBSITE: "https://demo.example.com"

    # Run a full passive+active DAST scanDAST_FULL_SCAN_ENABLED: "true"

    *# Use a browser‑based DAST (false → in‑memory)*DAST_BROWSER: "true"`

  3. Define the stages

    GitLab already supplies sast and dast stages.

    If your pipeline previously defined custom stages, just add these names:

    `stages:

  4. The CI runner will download the scanner Docker images, execute the analyses, and upload the results as artifacts:

Stage Artifact name Format
sast gl-sast-report.json JSON
dast gl-dast-report.json JSON

Inspecting the Results

  1. Pipeline view – After the runner finishes, click the green check for the sast or dast job.
  2. Artifacts – Click Artifacts → download to get the JSON file.
  3. Merge‑Request widget – A “Security report” tab is automatically added when the job completes, showing a summary of findings.
  4. Detailed view – Open the JSON file (text or JSON viewer).

image.png

image.png