Manage security configuration profiles

Security configuration profiles are centralized settings that define how and when security scanners run across your projects. Use security configuration profiles to manage security scanners across your organization efficiently. A profile-based approach applies best practices with minimal manual setup. Legacy scanner configuration requires you to edit YAML files or individual project settings. With profiles, you can apply the same scanner settings to multiple projects at once without changing code.

For an overview, see Introducing security configuration profiles.

When you apply a profile to a group, it is applied to each individual project within that group. Profiles are not attached to the group itself, and there is no inheritance between profiles or subgroups.

You can use two kinds of profiles:

• Default profiles: Preconfigured by GitLab. Use them to enable security scanning in minutes and with minimal configuration.
• Custom profiles: Created by you, with your own scan triggers and scanner settings.

View profile details

To view the settings of a profile:

1. In the top bar, select Search or go to and find your group.
2. In the left sidebar, select Secure > Security configuration.
3. Select the Scanners tab.
4. On the row for the scanner, select Manage profiles.
5. Select the profile.

The profile details show the description, analyzer type, scan triggers, and any advanced configuration.

To see which projects each scanner covers, view the scanner coverage in the security inventory.

Apply profiles

You can apply any default or custom profile to subgroups and projects. When you apply a profile to a subgroup, it applies to every project or subgroup.

Prerequisites:

• The Security Manager, Maintainer, or Owner role for the project or group.

Apply profiles in the UI

Use the security inventory to apply profiles to a single project, or to multiple subgroups and projects at once.

Apply profiles with the scanner enablement wizard

Use the Scanner Enablement Wizard to apply profiles to projects that lack scanner coverage. The wizard configures dependency scanning, SAST, and secret detection, and updates the coverage shown in the security inventory.

Apply profiles with the GitLab CLI

The GitLab CLI (glab) is a command-line tool for working with GitLab. Use it to apply, remove, or check the status of a profile for a single project.

Apply profiles with the GraphQL API

Use the GraphQL API to apply profiles to subgroups and projects. When you apply a profile to a group, GitLab applies it to every project in the group and its subgroups.

To apply a profile:

1. Get the profile ID from the Group.availableSecurityScanProfiles field.

2. Apply the profile with the securityScanProfileAttach mutation. For example:

   graphql

   mutation {
     securityScanProfileAttach(input: {
       securityScanProfileId: "gid://gitlab/Security::ScanProfile/sast",
       projectIds: ["gid://gitlab/Project/123"],
       groupIds: ["gid://gitlab/Group/456"]
     }) {
       errors
     }
   }

All projects and groups in one mutation must belong to the same top-level group. Each mutation accepts up to 100 project and group IDs combined.

To remove a profile, use the securityScanProfileDetach mutation.

Default profiles

GitLab provides default profiles that are preconfigured so you can enable security scanning, triage, and remediation with minimal configuration.

Secret detection profile

The secret detection profile scans for secrets with the recommended configuration. The profile turns on the following scan triggers:

• Push protection: Scans all Git push events and blocks pushes where secrets are detected, preventing secrets from ever entering your codebase.
• Merge request pipelines: Runs a scan each time new commits are pushed to a branch with an open merge request. Results include only new vulnerabilities introduced by the merge request. Targets all branches.
• Default branch pipelines: Runs when changes are merged or pushed to the default branch, providing a complete picture of your default branch’s security posture. Targets the default branch.

SAST profile

The SAST profile scans source code with the recommended configuration. The profile turns on the following scan triggers:

• Merge request pipelines: Runs a scan each time new commits are pushed to a branch with an open merge request. Results include only new vulnerabilities introduced by the merge request. Targets all branches.
• Default branch pipelines: Runs when changes are merged or pushed to the default branch, providing a complete picture of your default branch’s security posture. Targets the default branch.

Dependency scanning profile

The dependency scanning profile scans dependencies with the recommended configuration. The profile turns on the following scan triggers:

• Merge request pipelines: Runs a scan each time new commits are pushed to a branch with an open merge request. Results include only new vulnerabilities introduced by the merge request. Targets all branches.
• Default branch pipelines: Runs when changes are merged or pushed to the default branch, providing a complete picture of your default branch’s security posture. Targets the default branch.

Dependency scanning auto-remediation profile

The dependency scanning auto-remediation profile opens merge requests that bump vulnerable dependencies to non-vulnerable versions. For more information, see dependency scanning auto-remediation.

Automated triage and remediation profile

The automated triage and remediation profile turns on GitLab Duo triage flows and dependency scanning auto-remediation for your projects. The GitLab Duo flows use AI to assess and resolve findings. A profile can enable a flow on its own, or replace the equivalent per-project setting where one exists.

GitLab provides three presets: Conservative, Standard, and Proactive. Each one applies a different configuration to every flow, so you can choose how broadly and how often the flows trigger and run. You can also create a profile and configure it yourself.

Prerequisites:

• Meet the prerequisites for the GitLab Duo Agent Platform.
• Turn on Allow foundational flows and each flow you want to use for the top-level group. You turn flows on once for the top-level group, not for each project.

Each preset configures the flows as follows:

Business logic profile

The business logic profile uses an AI agent to find business logic vulnerabilities, like missing authorization, broken object-level access, and mass assignment. When you apply the profile to a project, the scan turns on for that project.

When a merge request’s head pipeline succeeds, the scan runs on the files the merge request adds or modifies. It does not run on default branch pipelines. To cover the default branch, start a scan from GitLab Duo Chat. If the project has no CI/CD pipelines, no merge request scans run. For more information, see business logic scanning.

Prerequisites:

• Turn on Allow flow execution, Allow foundational flows, and the Business Logic Security Scan flow for the top-level group.

SkillGuard profile

The SkillGuard profile uses an AI agent to find security risks in the AI agent skill files in your repository, such as SKILL.md, CLAUDE.md, and AGENTS.md. It reports risks like prompt injection, credential exfiltration, and unsafe command execution. When you apply the profile to a project, the scan turns on for that project.

The scan runs when a merge request’s head pipeline succeeds. It does not run on default branch pipelines. If the project has no CI/CD pipelines, no merge request scans run.

SkillGuard publishes its findings as a SAST report, so they appear in the vulnerability report alongside other scanners’ findings.

Custom profiles

Custom profiles override the configuration a scanner uses when it runs. Each setting maps to an existing CI/CD variable for that scanner.

Create a custom profile when the default configuration does not fit your projects. For example, use a custom profile to:

• Exclude paths, like test fixtures or vendored code, from scans.
• Pull analyzer images from your own container registry, like in an offline environment.
• Use FIPS-compliant analyzer images.
• Skip SAST analyzers that do not apply to your project.
• Scan the full Git history for secrets.

You can apply a custom profile to many projects at once. You do not have to set the same CI/CD variables in each project’s .gitlab-ci.yml file.

You can create secret detection and SAST profiles in the UI or with the GraphQL API. You can create dependency scanning profiles with the GraphQL API only.

Create a custom profile in the UI

Prerequisites:

• The Maintainer or Security Manager role for the top-level group.

To create a custom profile in the UI:

1. In the top bar, select Search or go to and find your group.
2. In the left sidebar, select Secure > Security configuration.
3. Select the Scanners tab.
4. On the Secret detection or Static application security testing (SAST) row, select Manage profiles.
5. Select Create new profile.
6. Enter a Name and a Description.
7. Under Scan triggers, turn on the triggers you want.
8. Optional. Under Advanced configuration, add the settings to override.
9. Select Create profile.

To change a profile later, select it, then select the vertical ellipsis ( ) > Edit, then Save changes. Changes apply to every project that uses the profile.

Create a custom profile with the GraphQL API

Prerequisites:

• The Security Manager, Maintainer, or Owner role for the top-level group.

To create a custom profile with the GraphQL API, use the securityScanProfileCreate or securityScanProfileUpdate mutation. On each trigger you want to customize, set the configuration object for the profile’s scan type:

• configuration.secretDetection for a secret detection profile.
• configuration.sast for a SAST profile.
• configuration.dependencyScanning for a dependency scanning profile.

You can set only one configuration member per trigger, and it must match the profile’s scan type.

By default, the stripDefaults argument removes trigger configuration values that match the defaults before storing the profile, so only your overrides persist.

For the full list of arguments, see the securityScanProfileCreate mutation.

Secret detection configuration fields

For more information about each setting, see secret detection.

For example, to create a secret detection profile with a customized merge request pipeline trigger:

mutation {
  securityScanProfileCreate(input: {
    namespaceId: "gid://gitlab/Group/123",
    scanType: SECRET_DETECTION,
    name: "Custom secret detection profile",
    description: "Secret detection profile with a historic scan and path exclusions",
    triggers: [
      {
        triggerType: MERGE_REQUEST_PIPELINE,
        configuration: {
          secretDetection: {
            historicScan: true,
            excludedPaths: ["spec/**/*", "test/**/*"]
          }
        }
      }
    ]
  }) {
    scanProfile {
      id
      name
    }
    errors
  }
}

SAST configuration fields

For more information about each setting, see SAST.

For example, to create a SAST profile with a customized merge request pipeline trigger:

mutation {
  securityScanProfileCreate(input: {
    namespaceId: "gid://gitlab/Group/123",
    scanType: SAST,
    name: "Custom SAST profile",
    description: "SAST profile with custom analyzer exclusions and Advanced SAST settings",
    triggers: [
      {
        triggerType: MERGE_REQUEST_PIPELINE,
        configuration: {
          sast: {
            excludedAnalyzers: ["eslint"],
            excludedPaths: ["spec/**/*", "test/**/*"],
            advancedSastPartialScan: DIFFERENTIAL,
            gitlabAdvSastIncrScan: true
          }
        }
      }
    ]
  }) {
    scanProfile {
      id
      name
    }
    errors
  }
}

Dependency scanning configuration fields

These fields are available through the GraphQL API only. For more information about each setting, see dependency scanning.

For example, to create a dependency scanning profile with a customized merge request pipeline trigger:

mutation {
  securityScanProfileCreate(input: {
    namespaceId: "gid://gitlab/Group/123",
    scanType: DEPENDENCY_SCANNING,
    name: "Custom dependency scanning profile",
    description: "Dependency scanning profile that excludes development dependencies and scans all directories",
    triggers: [
      {
        triggerType: MERGE_REQUEST_PIPELINE,
        configuration: {
          dependencyScanning: {
            includeDevDependencies: false,
            excludedPaths: ["spec/**/*", "test/**/*"],
            maxDepth: -1,
            staticReachabilityEnabled: true
          }
        }
      }
    ]
  }) {
    scanProfile {
      id
      name
    }
    errors
  }
}

Troubleshooting

When working with security configuration profiles, you might encounter the following issues.

Scanner status is active in the dashboard but not enabled in inventory tooltip

This can occur when a project uses legacy settings while also being assigned a new profile.

To resolve this issue:

1. Check the Security Configuration page for the most accurate current profile state.
2. If needed, remove legacy scanner configurations from your .gitlab-ci.yml file to rely solely on the profile-based configuration.