Skip to main content

Source Code

When you connect a Git repository or upload source code, you analyze everything from code to dependencies, secrets, infrastructure code, and components together in a single service. This is the type that lets you turn on the most analyses with one registration, so most teams start here.

Analyses available in this type​

AnalysisWhat it finds
SASTCode-level vulnerabilities (static analysis)
SCAKnown CVEs in open source dependencies
SecretHardcoded keys / tokens / passwords
IaCMisconfigurations in infrastructure code within the repository (Terraform / K8s / Dockerfile)
SBOM · LicenseComponent inventory and license risk

You can turn on only the analyses you want, and change them at any time after registration.

What you need​

Bring in your source code in one of two ways.

  • Connect a Git repository : the repository URL (for example, https://gitlab.example.com/team/app.git). Private repositories need a read-only personal access token (PAT), while public repositories can be registered without a token.
  • Upload source code : if connecting a repository is difficult, upload your source code as a ZIP file. Handy for air-gapped networks or one-off checks.
Use least-privilege tokens

Read-only (read repository) permission is enough. Do not use tokens with broader permissions than needed. Stored tokens are kept encrypted and are shown masked on screen.

Registration steps​

  1. On the [Services] page, click Register Service and select Source Code.
  2. Enter the repository URL and access token, or upload a source code ZIP file.
  3. Choose the analyses to run.
    • SAST : code-level vulnerabilities
    • SCA : dependency CVEs
    • Secret : hardcoded secrets
    • IaC : infrastructure code within the repository
    • SBOM · License : components and licenses
  4. Once registered, the first scan starts automatically.

Register Service: select Source Code

Branches and rescans​

  • Analysis is based on the default branch.
  • When code changes, it is scanned again and compared against previous results. If an unresolved item is found again, it is marked as regression.
  • To run automatically on a regular basis, you can configure a scan schedule (cron).

CI integration​

To run SAST, SCA, Secret, IaC, and SBOM automatically on push or pull request, issue a token in the service's [CI Trigger] menu and add a scan trigger step to your pipeline. Inject the token only as a CI secret variable and never put it in commits in plaintext. The setup steps and GitLab / GitHub / Jenkins snippets are covered in CI Integration.

Next steps​

Turn on analysisSASTStatic analysis for code-level vulnerabilitiesTurn on analysisSCAKnown CVEs in dependenciesTurn on analysisSecretDetect hardcoded secretsTurn on analysisIaCInfrastructure code misconfigurationsTurn on analysisSBOM · LicenseComponents and license riskUse resultsVulnerability ManagementReview and handle findings