Help us learn about your current experience with the documentation. Take the survey.

Detect false positives automatically

  • Tier: Ultimate
  • Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

When a static application security testing (SAST) scan runs, the SAST False Positive Detection Flow automatically analyzes each Critical and High severity SAST vulnerability to determine the likelihood that it’s a false positive. Detection is available for vulnerabilities from GitLab-supported SAST analyzers.

The flow assessment includes:

  • Confidence score: A numerical score indicating the likelihood that the finding is a false positive.
  • Explanation: Contextual reasoning about why the finding may or may not be a true positive, based on code context and vulnerability characteristics.
  • Visual indicator: A badge in the vulnerability report showing the false positive assessment.

The detection runs automatically after each security scan with no manual triggering required.

Results are based on AI analysis and should be reviewed by security professionals.

For an overview, see GitLab AI-Powered SAST False Positive Detection and Remediation.

For a click-through demo, see SAST False Positive Detection Flow.

Prerequisites

Allow foundational flow for a group

You can allow all projects in a group to use the foundational flow. Individual projects must still enable the feature in their project settings. To allow false positive detection for all projects in a group:

  1. In the left sidebar, select Search or go to and find your group.
  2. Select Settings > GitLab Duo.
  3. Under Allow foundational flows, select the SAST False Positive Detection checkbox.
  4. Select Save changes.

Turn on for a project

Prerequisites:

  • The Security Manager, Maintainer, or Owner role for the project.

To turn on false positive detection for a specific project:

  1. In the left sidebar, select Search or go to and find your project.
  2. Select Settings > General.
  3. Expand GitLab Duo.
  4. Turn on the Turn on SAST false positive detection toggle.
  5. Select Save changes.

When you allow false positive detection for the group and turn it on for the project, the feature works automatically with your existing SAST scanners.

Automatic detection

The false positive detection flow runs automatically when:

  • A SAST security scan completes successfully on the default branch.
  • The scan detects Critical or High severity vulnerabilities.
  • GitLab Duo features are enabled for the project.

The analysis happens in the background and results appear in the vulnerability report after processing is complete.

Run the SAST False Positive Detection Flow

You can manually trigger analysis for existing vulnerabilities:

  1. In the top bar, select Search or go to and find your project.
  2. In the left sidebar, select Secure > Vulnerability report.
  3. Select the vulnerability you want to analyze.
  4. In the upper-right corner, select AI actions, then select Check for false positive.

The GitLab Duo analysis runs and results are displayed on the vulnerability details page.

Analyze multiple vulnerabilities

  • Offering: GitLab.com, GitLab Self-Managed
  • Status: Beta

The availability of this feature is controlled by a feature flag. For more information, see the history.

You can trigger the flow to analyze multiple vulnerabilities for false positives.

The following severity levels are analyzed:

  • Critical
  • High
  • Medium
  • Low
  • Unknown
  • Info

Prerequisites:

  • To analyze multiple vulnerabilities, you must have either:
    • The Security Manager, Maintainer, or Owner role for the project
    • Custom role with admin_vulnerability permission
  • To view the flow’s progress, you must have the Developer role.
  1. In the left sidebar, select Search or go to and find your project.
  2. Select Secure > Vulnerability report.
  3. Select the checkbox beside each vulnerability you want to analyze. To select all vulnerabilities on the page, select the checkbox in the table header.
  4. From the Select action dropdown list, select Run SAST False Positive Detection.
  5. Select Run SAST False Positive Detection.

Known limitations

  • The progress report only shows the amount of vulnerabilities that are eligable for resolution. If you select 10 vulnerabilities and three are eligible, the progress report only reports three.
  • Only one run of each flow can be active in a project at a time. The run belongs to the project, so a run started by another user also blocks a new run. Wait for the active run to finish before you start another run of the same flow.
  • You can only run a bulk flow execution for a maximum of 1,000 vulnerabilities. This limit applies to the vulnerabilities you select in the vulnerability report. To resolve more than 1,000 vulnerabilities, use the GraphQL.

Confidence scores

The confidence score estimates how likely the GitLab Duo assessment is to be correct:

  • Likely false positive (80-100%): GitLab Duo is highly confident that the finding is a false positive.
  • Possible false positive (60-79%): GitLab Duo has reasonable confidence that the finding may be a false positive but recommends manual review.
  • Likely not a false positive (<60%): GitLab Duo is not confident that the finding is a false positive. Manual review is strongly recommended before you dismiss the vulnerability.

Dismissing false positives

When the GitLab Duo analysis identifies a vulnerability as a false positive, you have the following options:

  • Dismiss the vulnerability
  • Remove the false positive flag

Dismiss the vulnerability

  1. In the top bar, select Search or go to and find your project.
  2. In the left sidebar, select Secure > Vulnerability report.
  3. Select the vulnerability you want to dismiss.
  4. In the right sidebar, in the Status section, select Edit.
  5. From the Status dropdown list, under Dismiss as…, select False positive.
  6. In the Comment text box, provide context about why you’re dismissing it as a false positive. A comment is required.
  7. Select Change status.

The vulnerability is marked as dismissed and does not appear in future scans unless it is reintroduced.

Remove the false positive flag

If you want to remove the false positive assessment and keep the vulnerability:

  1. In the top bar, select Search or go to and find your project.
  2. In the left sidebar, select Secure > Vulnerability report.
  3. Locate the vulnerability with the false positive flag.
  4. Hover over the false positive badge on the vulnerability.
  5. Select Remove False Positive Flag.

The false positive flag is removed and the FP confidence score reverts to 0. The vulnerability remains in the report and can be re-evaluated in future scans.

Providing feedback

Share your feedback in issue 583697.