Secure your application in GitLab for VS Code

Use the GitLab for VS Code extension to check your application for security vulnerabilities. Review security findings and run static application security testing (SAST) for files directly in your IDE.

View security findings

Prerequisites:

• GitLab for VS Code 3.74.0 or later.
• A project that includes Security Risk Management features, such as static application security testing (SAST), dynamic application security testing (DAST), container scanning, or dependency scanning.
• Configured security risk management features.

To view security findings:

1. In VS Code, in the left sidebar, select GitLab ( ).
2. In the current branch section, expand Security scanning.
3. Select either New findings or Fixed findings.
4. Select a severity level.
5. Select a finding to open it in a VS Code tab.

Perform SAST scanning

Static application security testing (SAST) in VS Code detects vulnerabilities in the active file. With early detection, you can remediate vulnerabilities before you merge your changes into the default branch.

When you trigger a SAST scan, the content of the active file is passed to GitLab and checked against SAST vulnerability rules. GitLab shows scan results in the GitLab ( ) extension panel.

To learn about setting up SAST scanning, see SAST scanning in VS Code on GitLab Unfiltered.

Prerequisites:

• GitLab for VS Code 5.31.0 or later.
• The extension is authenticated with GitLab.
• Real-time SAST scan is enabled.

To perform SAST scanning of a file in VS Code:

1. Open the file.
2. Trigger the SAST scan by either:
   • Saving the file (if you have enabled scanning on file save).
   • Using the Command Palette:
     1. Open the Command Palette:
        • For macOS, press Command+Shift+P.
        • For Windows or Linux, press Control+Shift+P.
     2. Search for GitLab: Run Remote Scan (SAST) and press Enter.
3. View the results of the SAST scan.
   1. In VS Code, in the left sidebar, select GitLab ( ).
   2. Expand the GitLab remote scan (SAST) section. The results of the SAST scan are listed in descending order by severity.
   3. Select a finding to review the details.