Lesson 5: GitLab Duo AI Security Features#

GitLab Duo is GitLab’s suite of AI features integrated directly into the DevSecOps workflow. For security teams, Duo helps you understand, triage, and resolve vulnerabilities faster — without leaving GitLab.

Many of Duo’s newest security capabilities are delivered through the GitLab Duo Agent Platform as agents (conversational assistants you direct, like the Security Analyst) and flows (autonomous, multi-step workflows, like the Security Review and agentic vulnerability resolution). This lesson uses both.

GitLab Duo AI features require a GitLab Duo add-on or are included with certain GitLab Ultimate plans. The agentic features in this lesson require GitLab Ultimate with the GitLab Duo Agent Platform enabled. See the GitLab Duo documentation for availability and seat assignment.

This lesson covers:

  1. Triaging and explaining vulnerabilities with the Security Analyst Agent
  2. Reviewing merge requests with the Security Review flow
  3. Root Cause Analysis
  4. Duo Chat for security questions
  5. SAST false positive detection
  6. Secret detection false positive detection
  7. Auto Vulnerability Resolution

Triaging and explaining vulnerabilities with the Security Analyst Agent#

The Security Analyst Agent is a conversational AI assistant on the GitLab Duo Agent Platform that pairs security expertise with deep knowledge of GitLab’s security features. Instead of opening one vulnerability page at a time, you ask it questions in plain language and it reasons across your project’s findings — interpreting severity, EPSS scores, CVE data, and reachability the same way an experienced AppSec engineer would.

It is purpose-built for the work AppSec teams do every day:

  • Vulnerability triage — surface and rank what matters right now
  • Risk assessment — combine severity, exploit probability, and reachability into a verdict
  • False-positive identification — flag findings unlikely to be real
  • Remediation planning — outline how to fix a finding (and explain what it is and why it matters)
  • Security reporting and workflow automation

How to use the Security Analyst Agent#

  1. On the top bar, select Search or go to and find your project

  2. In the GitLab Duo sidebar, select Add new chat (the pencil-square icon)

  3. From the dropdown, select Security Analyst

  4. Ask a question. The agent has your project’s security context, so you can be specific:

  • “Show me all critical vulnerabilities in my project”
  • “List vulnerabilities with EPSS scores above 0.7 that are reachable”
  • “Confirm all container scanning vulnerabilities with a known exploit”
  • “Explain the SQL injection in routes/basketItems.ts — how would an attacker exploit it, and how should I fix it?”

The agent both triages (builds and prioritizes the work queue) and explains (gives a context-aware, plain-language breakdown of any individual finding, the attack scenario, and a remediation approach that fits your code).

Reference findings by their specific vulnerability ID or URL when you want the agent to focus on one issue. The Security Analyst Agent requires GitLab Ultimate with foundational agents turned on; it is also available in the GitLab for VS Code and JetBrains IDE extensions through the GitLab Duo Agent Platform panel.

Reviewing merge requests with the Security Review flow#

Static scanners excel at known vulnerability patterns, but they miss flaws that depend on intent — broken authorization, access-control gaps, race conditions, information disclosure, and mass-assignment bugs. The Security Review flow (introduced in GitLab 19.1) is an agentic reviewer on the GitLab Duo Agent Platform that reasons about what your code is trying to do and flags business-logic vulnerabilities directly in the merge request. Unlike the conversational Security Analyst agent above, this is a flow — an autonomous, multi-step workflow that runs to completion on its own once triggered.

It targets vulnerability classes that pattern-based tools routinely miss, including:

  • CWE-639 / CWE-862 / CWE-284 — broken object-level authorization (BOLA/IDOR), missing authorization, and access-control flaws
  • CWE-200 — sensitive information disclosure
  • CWE-840 — business-logic errors
  • CWE-915 — mass assignment
  • CWE-362 — race conditions

Adding the Security Review flow to a merge request#

You invoke the flow by adding its auto-created service account — named duo-security-review-<group> (for example, duo-security-review-gitlab-org) and displayed as Duo Security Review — as a reviewer:

  1. Open the merge request you want reviewed (for example, the add-vulnerabilities MR from Lesson 3)

  2. In the right sidebar, find the Reviewers section and select Edit

  3. Search for and select Duo Security Review

  4. The flow reviews the diff and posts its findings as merge request comments, each explaining the suspected business-logic flaw and where it occurs

  5. To dig into a finding, reply in the comment thread and mention the service account (for example @duo-security-review-gitlab-org) with your question or feedback — the flow responds in the thread

The Security Review flow is in Beta and requires GitLab Ultimate with the GitLab Duo Agent Platform and foundational flows enabled for your group. Adding the reviewer to a project requires the Developer, Maintainer, or Owner role. Because it runs as a flow, it is triggered by assigning Duo Security Review as a reviewer — you cannot, for example, start it from a vulnerability page.

Root Cause Analysis#

When a pipeline job fails — including a security job — GitLab Duo can analyze the job log and tell you why it failed and how to fix it.

  1. Open a failed job log (for example, a Container Scanning job that fails because the image cannot be pulled)

  2. Click Troubleshoot with AI (or Root cause analysis)

  3. Duo reads the log, identifies the most likely cause, and proposes a fix

This is especially useful for security jobs because their failures often look like generic CI failures (a missing env var, an unreachable scanner endpoint, a malformed configuration) but actually have specific, scanner-aware causes.

Duo Chat for security questions#

GitLab Duo Chat is available throughout GitLab. For security work, it shines on questions like:

  • “What does this CVE mean for this project?” (on a vulnerability page — Chat already has the context)
  • “Summarize the open Critical-severity findings on this project” (on the vulnerability report)
  • “How would I exploit this code path?” (on a code file)
  • “What’s the difference between EPSS and KEV, and how should I use both?”

Open Chat with Ctrl/Cmd+L or the GitLab Duo Chat button in the bottom-right corner.

SAST false positive detection#

Not every finding from a scanner is a real vulnerability. False positives — findings flagged as vulnerable but not actually exploitable — waste developer and security time.

GitLab Duo includes AI-powered false positive detection for SAST findings. When a SAST scan completes, the AI evaluates each finding and labels those it determines are likely false positives.

How it works#

  1. SAST scan completes

  2. Duo evaluates the findings

  3. Likely false positives are labeled in the vulnerability report and in the merge request security widget

  4. Security teams use this signal to prioritize triage — focus on real vulnerabilities first, audit flagged false positives in a single pass

False positive detection does not auto-dismiss vulnerabilities. It’s an AI-generated assessment that helps teams triage faster. The final call still belongs to the security team.

Secret detection false positive detection#

The same approach applies to Secret Detection findings. Secret scanners can flag values that look like secrets but are actually test data, example placeholders, or hashed values that aren’t actual secrets.

How it works#

  1. Secret detection scan completes

  2. Duo evaluates each finding

  3. Findings determined to be likely false positives (example API keys in documentation, test fixtures, hashed values, etc.) are flagged

  4. Reviewers can focus on the findings most likely to represent real exposures

Even when a secret detection finding is flagged as a likely false positive, scan it manually. If a real secret was committed to the repository, rotate it immediately — even after removing it from the code, it remains in the Git history (and any clones).

Auto Vulnerability Resolution#

False-positive detection tells you which findings to ignore. Agentic Vulnerability Resolution closes the loop on the rest: GitLab Duo analyzes SAST findings with iterative, multi-step reasoning and opens merge requests with context-aware fixes — building directly on the false-positive signal so it spends effort only on findings that are real.

It runs in two modes:

  • Automatic — after a SAST scan completes on the default branch, Duo evaluates High and Critical SAST vulnerabilities, runs a false-positive check, and opens a fix merge request with no manual trigger — but only when it can generate a fix with high confidence. This is the “auto” in Auto Vulnerability Resolution: real, high-severity findings get a proposed fix waiting for review before anyone opens the report.
  • Manual — for any SAST vulnerability regardless of severity, open Secure > Vulnerability report, select the vulnerability, and choose AI vulnerability management > Resolve with Agentic AI in the upper-right.

Enabling Auto Vulnerability Resolution#

The automatic flow depends on the SAST False Positive Detection flow being on, plus a few one-time settings:

  1. At the group level, go to Settings > GitLab Duo, enable Allow flow execution, and under Allow foundational flows select Resolve SAST Vulnerability

  2. On the project, go to Settings > General, expand GitLab Duo, and turn on Turn on SAST vulnerability resolution workflow

  3. Ensure your push rules allow the GitLab Duo service account to create merge requests, and that runners are available to execute the flow

Reviewing the result#

  1. Open the merge request Duo created (you are notified, or find it under Code > Merge requests)

  2. Read the diff, then watch the pipeline — the same SAST scanner that found the issue runs against the fix and should now report it as resolved

  3. Run the application’s tests, then approve and merge, or push commits to refine the fix

Always review AI-generated fixes before merging. Agentic resolution produces high-quality, scanner-validated suggestions, but you are responsible for confirming the fix is correct for your application context and introduces no regressions. Treat it like a draft from a capable junior contributor — a strong starting point, not a final answer.

Agentic SAST Vulnerability Resolution is generally available and requires GitLab Ultimate with the GitLab Duo Agent Platform. It works best on vulnerabilities with clear, well-scoped fixes (injection, insecure crypto usage, unsafe deserialization) and will not attempt issues that need architectural changes or business context.

You have now used GitLab Duo’s AI security features to:

  1. Triage and explain vulnerabilities conversationally with the Security Analyst Agent
  2. Review merge requests for business-logic flaws with the Security Review flow
  3. Troubleshoot failing security jobs with Root Cause Analysis
  4. Cut noise with SAST and Secret Detection false positive detection
  5. Resolve real findings automatically with Agentic Vulnerability Resolution

Next we’ll assemble the scanners and policies from the previous lessons into named, applied-to-many-projects Custom Compliance Frameworks.

Previous Lesson Next Lesson