Centralized security governance and configuration

Centralized security governance and configuration

Manage and visualize security scanner coverage across your organization. This release introduces security configuration profiles, starting with the secret detection profile. Security teams now have a more powerful command center to secure your organization at scale.

Profile-based security configuration

Instead of manually editing YAML files for each project, you can now use preconfigured security configuration profiles that provide several advantages:

• Standardized governance: Preconfigured profiles apply appropriate boundaries without interrupting productivity. You can apply standardized security best practices, without requiring custom role configurations.
• Scalable management: Apply the same profile across hundreds or thousands of projects with a single action.

The secret detection profile is the first security configuration profile available. It provides the following advantages:

• Actively identifies and blocks secrets from being committed to your repositories.
• One profile manages secret detection across your entire development workflow. No need to manage separate configurations for different trigger types.

Enhanced security inventory

The security inventory has been upgraded to act as your primary dashboard to assess each group’s security posture:

• Group and project hierarchies: Easily distinguish between subgroups and projects in the inventory with clear iconography.
• Bulk actions: A new Bulk Action menu allows you to apply or disable security scanner profiles across all selected projects and subgroups simultaneously.
• Visual coverage status: Quickly identify gaps with color-coded status bars (Enabled, Not Enabled, or Failed) with tooltips for details.
• Profile status indicators: See which trigger types are available in the profile details.

Security attributes

Security attributes

Security attributes, introduced as a beta in GitLab 18.6, are now generally available.

Security attributes allow security teams to apply business context to their projects, including business impact, application, business unit, internet exposure, and location. You can also create custom attribute categories to match your organization’s taxonomy. By applying these attributes, you can filter and prioritize the items in your security inventory based on risk posture and organizational context.