Lessons#
Seven end-to-end lessons that walk you through the entire GitLab DevSecOps workflow against this intentionally vulnerable application. Lessons build on each other — work through them in order.
| # | Title | Description |
|---|---|---|
| 1 | Configuring the Demo Application | Import the project and optionally deploy the application to a Kubernetes cluster |
| 2 | Setting up Security Scanners and Policies | Configure built-in scanners, apply security configuration profiles, integrate a third-party scanner via SARIF, enable Secret Push Protection, and add policy guardrails |
| 3 | Developer Security Workflows | Walk through the developer experience: MR widgets, code flow, license compliance, injected jobs, and fixing in the Web IDE with Duo |
| 4 | Overseeing Security Posture | Triage with CVSS / EPSS / KEV / reachability, and view the vulnerability report, security inventory, SBOM, audit events, and continuous scanning |
| 5 | GitLab Duo AI Security Features | Use Duo’s Security Analyst and Security Review agents, false positive detection, and agentic vulnerability resolution |
| 6 | Custom Compliance Frameworks | Bundle scanners, policies, and audit evidence into named compliance frameworks (and templates) and apply them across projects |
| 7 | Roles and Permissions | Enforce least privilege and separation of duties with default roles, the Security Manager role, and custom roles |