SAST Vulnerability Resolution Flow
- Tier: Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
Agentic SAST vulnerability resolution automatically analyzes SAST vulnerabilities and generates merge requests with context-aware code fixes. This agentic approach uses multi-shot reasoning to resolve vulnerabilities with minimal human intervention.
When a SAST security scan runs on the main branch, GitLab Duo automatically analyzes high and critical severity vulnerabilities to determine if a fix can be generated with high confidence. The analysis happens in the background and results appear in the vulnerability report once processing is complete.
Results are based on AI analysis and should be reviewed by security professionals.
You can’t trigger this flow by mentioning, assigning, or requesting a review from its service account. The flow runs automatically after security scans complete. To run it manually, on a vulnerability page, select Resolve with Agentic AI.
Prerequisites
- Meet the prerequisites for the GitLab Duo Agent Platform.
- Turn on Allow foundational flows and Resolve SAST Vulnerability for the top-level group.
- Configure push rules to allow a service account.
- Configure your own runners or turn on GitLab hosted runners for your project.
Running agentic SAST vulnerability resolution
The flow runs automatically when specific conditions are met. For details on automatic and manual execution, see Agentic SAST Vulnerability Resolution.