What you are evaluating
Confirm each analyzer and reporting feature against the deployed GitLab version and tier. Self-managed hosting changes operational responsibilities; it does not remove license requirements. Use review apps or staging for the dynamic-testing exercise.
A useful evaluation context
Evaluate GitLab when the team already uses its source-control and pipeline workflow and needs to map specific scanner and reporting requirements to its tier.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Standard SAST analyzer jobs available on Free, Premium, and Ultimate.
- Dependency scanning documented as Ultimate, along with Advanced SAST, merge-request security user experience, vulnerability management, and an SBOM-oriented dependency list.
- DAST profiles and continuous-integration webhooks intended for non-production applications.
Where it fits in the work
- Confirm hosting, version, and tier, then enable supported standard SAST analyzers on a lab project.
- On an Ultimate project, enable dependency scanning separately and compare its component inventory with the lab lockfile. Evaluate Advanced SAST separately if required.
- Run any entitled dynamic testing against a review app or staging only, and assign findings to maintainers.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
On a lab GitLab project, seed a weakness supported by a standard SAST analyzer. On an Ultimate project, also enable dependency scanning and add a known vulnerable lockfile dependency. Use staging for any dynamic test.
Evidence to look for
The configured SAST job reports its supported seeded issue. The Ultimate dependency-scanning job inventories and flags the selected component. Record unsupported languages and missing entitlements separately from detection results.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which standard SAST analyzers cover the repository on its current tier?
- Does the project have Ultimate for dependency scanning and any required Advanced SAST or review views?
- How are dynamic-test targets restricted to approved staging applications?
Names you may encounter: GitLab Advanced SAST · GitLab DAST. Historical names do not establish current availability or feature equivalence.