Video summary
GitLab 19.3 introduces powerful capabilities within its GitLab Duo AI platform designed to accelerate development by automatically resolving SAST vulnerabilities and filtering out false positives in bulk. This update allows teams to significantly reduce their security risk backlog while freeing up engineering time for feature delivery. To utilize these advanced features, users must first enable specific settings in their project's general configuration, such as turning on SAST false positive detection and the SAST vulnerability resolution workflow. Additionally, ensuring that the default GitLab Duo namespace is correctly set to the appropriate group, like "developer advocacy," is essential for the AI agent platform to function seamlessly across the organization.
Once these prerequisites are met, developers can efficiently manage their list of active vulnerabilities by first running a bulk detection flow to identify and remove false positives. This step ensures that subsequent remediation efforts focus exclusively on genuine security issues. The transcript demonstrates how the system processes each vulnerability, marking those confirmed as false positives with a specific label while automatically initiating resolution workflows for true positives. For high-severity issues where the confidence level indicates they are real threats, the AI agent immediately begins the automated fix process without waiting for manual intervention, thereby speeding up the overall remediation cycle.
The automated resolution workflow is comprehensive, handling every stage of the patching process from start to finish. The AI agent fetches the affected source files, edits them to apply necessary fixes, and generates unit tests to validate that the changes do not break existing functionality. After confirming the fixes work correctly, the system commits the changes and creates merge requests directly linked to the original vulnerability reports. Users can inspect these newly generated merge requests to review the specific file modifications made by the AI, ensuring transparency and control over the automated security improvements before they are merged into the main codebase.
Ultimately, this integration of bulk false positive detection and automated remediation empowers teams to tackle their existing security debt much more effectively. By leveraging the GitLab Duo agent platform, organizations can systematically clear their vulnerability backlogs with high confidence, eliminating noise from false alarms and automating the tedious task of patching code. This streamlined approach not only enhances the security posture of applications but also restores developer productivity, allowing teams to focus on shipping new features rather than getting bogged down in manual security maintenance.
Read the full video transcript
AI is speeding up the volume of code
that developers ship and the
exploitation of vulnerabilities in
production by attackers.
With GitLab, teams can now resolve SAS
false positive alerts and remediate
vulnerabilities in bulk to drive down
your risk and free your team's time to
ship features.
Let's see how these features can help
clear your vulnerability backlog.
We start at a project called front end,
which is part of an application called
Tanuki Bank.
First, we need to enable two features.
We head to our project's GitLab Duo
general settings and enable
turn on SAS false positive detection
and
turn on SAS vulnerability resolution
workflow. By enabling these two
capabilities, not only are we asking Duo
Agent platform to automatically detect
false positives for us, but also to
resolve any true positives as soon as
they are detected. We will see how these
two capabilities work in conjunction
later in this demo. Also, we need to
check one more thing. This project sits
under the top group called developer
advocacy at GitLab. So, we head to our
user's preferences and scroll down to
the behavior section
and ensure that our default GitLab Duo
namespace is set to developer advocacy
at GitLab.
You will need to adjust the default
namespace for your team or organization.
This project has existing
vulnerabilities, so let's open its
vulnerability report.
Let's filter the list by active SAS
vulnerabilities.
We have three of them. Next, we select
all the vulnerabilities in the list.
At this point, we could choose to run a
vulnerability resolution in bulk for all
of the selected vulnerabilities, all of
which, by the way, have a vulnerability
resolution available. But, why don't we
first
any false positives?
This way, we could run a bulk
vulnerability resolution flow just for
the true positives.
Let's select run SAST false positive
detection from the select action list. A
button with the same name appears on the
right side of the screen. Clicking on
this button starts the bulk SAST false
positive detection flow. A detecting
false positives progress bar temporarily
appears on the screen as these agent
flows run. Also, a label saying "Do a
verifying" appears for each
vulnerability being checked for false
positives. As we refresh the screen, we
see that one false positive detection
flow has finished and it has marked one
vulnerability with a "Not a false
positive" label. Once all the flows
complete, we notice that two
vulnerabilities have been determined to
be true positives and one has been
marked as a possible false positive.
Also, notice the two view session labels
next to the two true positives. This
indicates that Duo agent platform has
already kicked off vulnerability
resolution flows in bulk for these two
on our behalf. Let's open these two
running AI sessions to watch their
progress. We can see the flows check
that the vulnerabilities are true
positives.
They then fetch the corresponding source
files that are affected by their
respective vulnerabilities.
They proceed to edit the files and patch
them.
They create and run unit tests to
validate that the fixes work.
They proceed to commit the fixes and
finally, they create merge requests
which they link to their respective
vulnerabilities. Let's head back to the
vulnerability report and drill into one
of the high severity vulnerabilities to
confirm that it's now related to a merge
request that fixes it. We confirm that
the SAST false positive detection flow
has only a 5% confidence that this
vulnerability is a false positive. The
fact that this vulnerability is a true
positive and that its severity is high
caused the automatic run of the bulk
vulnerability resolution flow. Scrolling
down the vulnerability detail page, we
now see that there is a merge request
associated with this vulnerability. This
is the merge request that contains the
vulnerability fix, which was generated
in its entirety by the vulnerability
resolution flow. Let's open the newly
generated merge request. In it, we can
navigate to the changes tab to see all
the files and modifications made by the
AI flow to fix this vulnerability.
We head back to the vulnerability report
and drill into the second high
vulnerability detail page.
Scrolling down its page, we verify that
a newly created merge request has also
been associated with it by the
vulnerability resolution flow.
And there you have it. Teams can now use
Dual Agent platform to drive down their
existing backlog by eliminating false
positives and automating remediation, so
you can get back to shipping.