The following page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features or functionality remain at the sole discretion of GitLab Inc.
This direction page describes GitLab's plans for the SAST category, which checks source code to find possible security vulnerabilities.
GitLab SAST runs on merge requests and the default branch of your software projects so you can continuously monitor and improve the security of the code you write. SAST jobs run in your CI/CD pipelines alongside existing builds, tests, and deployments, so it's easy for developers to interact with.
While SAST uses sophisticated techniques, we want it to be simple to understand and use day-to-day, especially by developers who may not have specific security expertise. So, when you enable GitLab SAST, it automatically detects the programming languages used in your project and runs the right security analyzers.
While basic SAST scans are available in every GitLab tier, organizations that use GitLab SAST in their security programs should use Ultimate. Only GitLab Ultimate includes:
Our strategy depends on understanding our customers and the broader market.
This section summarizes our plans for specific parts of GitLab SAST.
We are currently working to upgrade more languages to Advanced SAST. We will continue until we have enabled Advanced SAST for all languages that GitLab SAST currently scans using Semgrep-based scanning. See documentation for the current languages Advanced SAST supports.
Status of new languages is tracked in epic 14312. As of 2025-06-19, the status is:
| Language | Expected release | Notes |
|---|---|---|
| C/C++ | During 2025 | In progress. We plan to release iteratively over the course of 2025. |
| Kotlin | Pending | |
| Scala | Pending | |
| iOS (Swift and Objective-C) | Pending |
When you enable Advanced SAST, it takes over coverage for the languages it supports.
We plan to enable Advanced SAST by default for SAST users in 19.0.
When we complete this initiative, we will then evaluate the future plans for the Semgrep-based analyzer, because it will serve fewer Ultimate customers over time.
For details on what is not included in this initiative, see What is not planned right now.
GitLab Vulnerability Research analyzes and improves coverage for already-supported languages as part of a continuous program of assessment and improvement. This program includes:
GitLab SAST is designed to run in merge requests and on the default branch of your repository, so we know how important it is to get results quickly.
In most cases, Advanced SAST returns results within a few minutes. However, because Advanced SAST scans your program in detail, large repositories can sometimes take longer to scan.
As part of our ongoing maintenance of the Advanced SAST engine, we have already:
Looking forward, we plan to:
Many of these work items are tracked in the epic for Advanced SAST performance and scalability. Note that we use confidential issues for some tasks, so you won't see every issue that we've implemented or that we have planned.
If you have concerns about Advanced SAST scan times in your repositories, see the troubleshooting guide for slow scans.
GitLab Static Analysis and Vulnerability Research teams are collaborating to improve the customer experience with SAST.
Our plans align with the themes for the Security use case:
In the next 3 months, we are planning to work on:
| Name | Overall status | One-month plan | Three-month plan |
|---|---|---|---|
| Faster Advanced SAST: Diff-based scanning in MRs | In progress | Complete backend changes | Complete frontend changes and fully ship the feature |
| Implement Advanced SAST for C/C++ | Full delivery expected by FY26Q4, with Experiment and Beta releases earlier | Release Experiment and update plan for Beta |
After the next 3 months, we plan to work on:
| Name | Overall status |
|---|---|
| Reduce false negatives in C# Advanced SAST | Expected FY26Q2. (Primarily Vulnerabilty Research.) |
| Customizable detection logic for Advanced SAST | Expected FY26Q3 |
| Real-time IDE SAST scanning: Beta release | Expected FY26Q4 |
| Incremental scanning for Advanced SAST (skip unchanged code) | Assessing technical plan and delivery estimate. |
| Real-time IDE SAST scanning: GA release | Expected FY27Q1 |
Our recent work includes:
Check older release posts for our previous work in this area.
We understand the value of many potential improvements to GitLab SAST, but aren't currently planning to work on the following initiatives:
You can contribute to where GitLab SAST goes next by:
gitlab-org/gitlab issue tracker.@gitlab-bot label ~"group::static analysis" ~"Category:SAST" so your issue lands in our triage workflow.| Stage | Application Security Testing |
| Content Last Reviewed | 2025-06-19 |