Uncover the business logic vulnerabilities SAST scanners miss

Broken object-level authorization ranks first on the OWASP API Security Top 10, and OWASP says that traditional static application security testing (SAST) tools struggle to find access control flaws. A missing authorization check is an absence of code, so a scanner that matches patterns has nothing to match. You can find the gap only if you already know what the endpoint is meant to enforce.

We're building Business Logic Security Analyzer in GitLab Duo Agent Platform to catch business logic vulnerabilities that pattern-based scanners miss. It is now in early access for GitLab Ultimate customers on GitLab.com.

Valid code, wrong intent

Any application security team will recognize these three findings:

1. An endpoint takes an order ID from the request and returns the order without checking who owns it.
2. A role field on a user profile accepts whatever JSON the client sends.
3. A user ID is a sequential integer.

Each one is valid code that slips past most taint and pattern rules in a conventional SAST engine, because no untrusted data reaches a dangerous sink, and no known-bad signature appears. Chained together, they hand an attacker every customer's order and an administrator role.

Across GitLab's customer base, codebase size has grown as much as 500% as agents write code. CVE disclosures through April ran 46% above the February forecast from the Forum of Incident Response and Security Teams. The same AI models that generate code also make existing weaknesses less expensive to discover and chain. Authorization logic is where that pressure lands: Developers and agents write a check in a line or two, but when one is missing, the gap often goes unnoticed. As Omer Azaria, vice president of Product Management at GitLab, put it at GitLab Transcend, "We're caught in the middle: more code, faster attacks, same teams."

Why whole-repository scanning starts here

GitLab Duo Security Review looks for authorization flaws in merge requests, but many business logic flaws aren't visible in a diff. Whether an endpoint should check ownership depends on the data model, the roles the application defines, and how other endpoints treat the same records. Judging one handler means reading the application around it.

That is why Business Logic Security Analyzer scans the whole repository, and why GitLab is the platform to do it on. The source code, the pipelines that build it, the security findings attached to it, and the policies that gate it all live in one system. An agent that scans here sees the full application and writes its findings where the security team already works.

At Transcend, we introduced the GitLab Security Standard: five stages each agent must clear to earn more autonomy, built on the premise that code is now abundant and trust is scarce. Its Verify stage requires every change, whether written by a person or agent, to pass controls the author cannot touch. Business Logic Security Analyzer runs outside the author's hands, and its findings persist in the same report and dashboards that govern the rest of the codebase.

How the analyzer works

Business Logic Security Analyzer is a foundational flow on GitLab Duo Agent Platform that targets business logic flaws, starting with broken object-level authorization, missing or improper authorization, and mass assignment. A practitioner can run a whole-repository scan, and scan each merge request automatically after its pipeline passes.

Detecting any of these flaws requires a model of what the application is meant to do. Pattern scanners have none, but an agent that reads the repository can build one. The analyzer starts by enumerating the application’s entry points and mapping who should be allowed to do what: which records belong to which user, and which actions are administrative. It then reads each handler in scope and checks whether the handler enforces that rule before touching the record. Findings land in the Vulnerability Report and the merge request security widget as first-class SAST results, to support triage, remediation, and auditing.

In the demo application below, refund_order accepts an order_id from the request and sets refunded=1 without checking that the caller owns the order or is an administrator. Taint rules stay silent because the query is parameterized. The analyzer reports it as CWE-639, Critical, at app/orders.py:17, and its explanation names the missing ownership check.

The models behind the analyzer

Business Logic Security Analyzer is the first GitLab capability supporting Anthropic's Claude Mythos 5.1, and is available in early access to customers in approved environments. The model sees only GitLab's prompts and the customer's repository, which holds the context the analyzer needs: the data model, roles, and rules each endpoint enforces. As Rajat Pandit, Head of Applied AI, Anthropic India, said at Transcend, "When defenders have more context than attackers, advanced models change the math in their favor."

Alongside Mythos, the analyzer supports Anthropic’s Claude Opus 5.5, Sonnet 5.5, Sonnet 5, and Sonnet 4.6, with more models planned for future releases. All of them run as GitLab-managed models through GitLab’s AI gateway, under the same data handling terms as the rest of GitLab Duo Agent Platform.

Request early access

Business Logic Security Analyzer is in early access for a small group of GitLab Ultimate customers on GitLab.com. Participants run the analyzer on their codebases to find true positives their security teams didn’t already know about. We will work with each team to learn where the analyzer is correct, wrong, or silent. Each scan consumes GitLab Credits, and cost scales with the size of the application's attack surface.

To be considered, contact your account team, or, if you are not yet a GitLab customer, contact our sales team. Once your group is enabled, start a whole-repository scan from GitLab Duo Chat or through the API, and attach the Business Logic scan profile to a project to scan its merge requests. The Business Logic Security Analyzer documentation covers prerequisites and setup.