Implement security scanners

The first step in securing your software supply chain is to implement security scanners into your CI/CD pipeline. These scanners should be set up in a way, where they run on each code commit. When a vulnerability is detected, approval by a security team member should be required.

GitLab offers many different security scanners to get you started:

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Infrastructure as Code (IaC) Scanning
• Container Scanning
• Dependency Scanning
• Coverage-Guided Fuzzing
• Web-API Fuzzing
• Secret Detection

With the scanners running in a pipeline, static application source code is scanned, as well as dependencies and the running application itself.

These scanners can be implemented by simply adding templates to your GitLab CI YAML. You can also use the Configuration UI to set up and configure these security scanners. You can check out the set up instructions for each scanner in the GitLab appsec configuration documentation.