Agentic SAST Vulnerability Resolution

GitLab Duo automatically analyzes SAST vulnerabilities and generates merge requests with context-aware code fixes. This agentic approach uses multi-shot reasoning to resolve vulnerabilities with minimal human intervention, reducing remediation time and improving security outcomes.

Unlike the non-agentic vulnerability resolution, agentic vulnerability resolution uses iterative reasoning to:

• Analyze vulnerability context across the codebase.
• Generate high-quality fixes that address root causes.
• Provide confidence scoring for proposed solutions.

Agentic SAST vulnerability resolution can run automatically, or you can run it manually.

For a click-through demo, see Agentic SAST Vulnerability Resolution.

Prerequisites

• Meet the prerequisites for the GitLab Duo Agent Platform.
• Turn on Allow foundational flows and the following flows:
  • Resolve SAST Vulnerability
  • SAST False Positive Detection
• Configure push rules to allow a service account.
• Configure your own runners or turn on GitLab hosted runners for your project.
• A default GitLab Duo namespace.

Automatic resolution

When a SAST security scan completes on the main branch, the Agentic SAST Vulnerability Resolution flow automatically completes the following actions:

1. Analyzes each High and Critical severity SAST vulnerability.
2. Checks if false positive detection has run.
3. If the vulnerability is not a likely or possible false positive, GitLab Duo creates a merge request with the proposed fix.
4. Runs the pipeline to validate that the fix resolves the vulnerability.

The process runs in the background with no manual triggering required. Results appear in the vulnerability report after processing is complete.

You can manually trigger agentic vulnerability resolution for any SAST vulnerability at any time, regardless of severity.

Conditions for automatic resolution

Automatic agentic vulnerability resolution runs when all of the following conditions are met:

• A SAST security scan completes successfully on the main branch.
• The scan detects high or critical severity vulnerabilities.
• The vulnerability is from a supported SAST analyzer.
• False positive detection has run and determined the vulnerability is not a false positive.

Manually run the flow

To manually run agentic vulnerability resolution for a SAST vulnerability:

1. In the top bar, select Search or go to and find your project.
2. In the left sidebar, select Secure > Vulnerability report.
3. Select the vulnerability you want to resolve.
4. In the upper-right corner, select Resolve with Agentic AI.

The flow analyzes the vulnerability and generates a merge request if a fix can be produced. Manual resolution works on any SAST vulnerability regardless of severity.

Resolve multiple vulnerabilities

You can trigger the flow on multiple vulnerabilities to create merge requests to resolve each vulnerability.

Vulnerabilities are processed in the following severity order: Critical, High, Medium, Low, Unknown, then Info.

Prerequisites:

• To start or cancel a flow for multiple vulnerabilities, you must have either:
  • The Security Manager, Maintainer, or Owner role for the project.
  • Custom role with admin_vulnerability permission
• To view the flow’s progress, you must have the Developer role.

1. In the left sidebar, select Search or go to and find your project.
2. Select Secure > Vulnerability report.
3. Select the checkbox beside each vulnerability you want to resolve. To select all vulnerabilities on the page, select the checkbox in the table header.
4. From the Select action dropdown list, select Create an MR with Vulnerability Resolution.
5. Select Resolve with AI.
6. To cancel the flow’s progress:
   1. Select Cancel resolution.
   2. On the confirmation dialog, select Cancel resolution.

The header checkbox selects only the vulnerabilities on the current page. To run a flow on more vulnerabilities, repeat the steps on each page.

While the flow runs, a progress indicator above the vulnerability list shows how many of the selected vulnerabilities have been processed.

Known limitations

• The progress report only shows the amount of vulnerabilities that are eligable for resolution. If you select 10 vulnerabilities and three are eligible, the progress report only reports three.
• If a vulnerability resolution run includes vulnerabilities that have not been analyzed for false positives, the progress indicator can stop before it reaches 100%. Cancel the run, then start a new one with vulnerabilities that have been analyzed.
• Only one run of each flow can be active in a project at a time. The run belongs to the project, so a run started by another user also blocks a new run. Wait for the active run to finish before you start another run of the same flow.
• You can only run a bulk flow execution for a maximum of 1,000 vulnerabilities. This limit applies to the vulnerabilities you select in the vulnerability report. To resolve more than 1,000 vulnerabilities, use the GraphQL.

Generated merge requests

The following occurs when GitLab Duo generates a merge request for a vulnerability:

1. The merge request is created with the proposed fix.
2. The description includes the following:
   • The vulnerability details and severity
   • Explanation of the fix approach
   • Links to relevant security resources
   • Confidence score for the proposed solution
3. The pipeline runs automatically to validate the fix.
4. Reviewers review the changes and pipeline results.
5. Users with the ability to merge the merge request do so according to your workflow.

Troubleshooting

Agentic vulnerability resolution sometimes cannot generate a suggested fix. Common causes include:

• Insufficient context: The vulnerability occurs in complex code patterns that require additional context or manual intervention.
• False positive detected: The AI model assesses whether the vulnerability is valid. The model may decide that the vulnerability is not a true vulnerability, or isn’t worth fixing.
  • If you agree that the vulnerability is a false positive or is not worth fixing, you should dismiss the vulnerability and select a matching reason.
• Temporary or unexpected error: The error message may state that an unexpected error has occurred, the upstream AI provider request timed out, something went wrong, or a similar cause.
  • These errors may be caused by temporary problems with the AI provider or with GitLab Duo.
  • A new request may succeed, so you can try to resolve the vulnerability again.
  • If you continue to see these errors, contact GitLab for assistance.

Providing feedback

We welcome your feedback on agentic vulnerability resolution. If you encounter issues or have suggestions for improvement, please provide feedback in issue 585626.

Related topics

• Vulnerability Resolution
• SAST False Positive Detection
• Vulnerability details
• Vulnerability report
• SAST