Vulnerability Context Analysis

  • Tier: Ultimate
  • Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
  • Status: Experiment

Use the Vulnerability Context Analysis Agent to read your codebase and to generate context across three security categories:

  • Authentication model
  • Authorization model
  • Sensitive data classification

After you turn on the agent, it runs automatically when changes are pushed to the default branch. When the agent is triggered, it completes the following processes:

  1. Reads the project’s codebase to understand its architecture and security posture.
  2. Produces structured output for each of the three security context categories.
  3. Stores the context so that downstream security features can use it.

The analysis runs in the background you do not manually trigger this agent.

When this feature is turned on, your project’s source code is sent to large language models (LLMs) for analysis to generate security context. Review your organization’s data policies before you turn on this feature.

Prerequisites

To use the Vulnerability Context Analysis Agent, you must have the following requirements:

Turn on the Vulnerability Context Analysis Flow

To use this feature, you must turn on the foundational flow for the root group and turn on the feature for the project:

Allow foundational flow for a group

You can allow all projects in a group to use the foundational flow. Individual projects must still enable the feature in their project settings.

To allow Vulnerability Context Analysis for a group:

  1. In the left sidebar, select Search or go to and find your group.
  2. Select Settings > GitLab Duo.
  3. Under Allow foundational flows, select the Vulnerability Context Analysis checkbox.
  4. Select Save changes

Turn on for a project

Prerequisites:

  • The Security Manager, Maintainer, or Owner role for the project.
  • The GitLab Duo Business Context Security Guidelines service account must have at least the Maintainer role on the project.

To allow Vulnerability Context Analysis for a project:

  1. In the left sidebar, select Search or go to and find your project.
  2. Select Settings > General.
  3. Expand GitLab Duo.
  4. Turn on the Turn on Vulnerability Context Analysis toggle.
  5. Select Save changes.
  6. In the left sidebar, select Manage > Members.
  7. Find the Duo Business Context Security Guidelines service account and ensure it has at least the Maintainer role.

Security context the agent scans

The agent produces context in three categories. Each category provides structured information that helps assess the impact of a vulnerability.

  • Authentication: Yes or No. Indicates whether the component requires authentication.
  • Authorization: Elevated or Standard. Indicates whether exploiting the component requires elevated privileges.
  • Sensitive data: Yes or No. Indicates whether the component handles sensitive data, such as personal information, credentials, tokens, payment data, or health data.

These values appear in the Risk table on the vulnerability details page.

Supported scanners

The security context produced by the Vulnerability Context Analysis Agent is used by the following scanners and features:

Known issues

  • The agent analyzes source code only. Runtime telemetry, dynamic analysis results, and function-level reachability data are not used as input.
  • Context generation depends on the information available in the repository. Projects with minimal documentation or non-standard structures may produce less detailed context.
  • A 24-hour debounce applies after each analysis. Pushes within that window do not trigger a new analysis.