13.5 Planning - Static Analysis

Secure, Static Analysis - Kickoff Videos

Assess your applications and services by scanning your source code for vulnerabilities and weaknesses.
devopssecure groupstatic analysis @gitlab-org/secure/static-analysis-be
Category | Direction | Maturity | Priority |
---|---|---|---|
Category:SAST | Epic / Strategy | maturityviable | ~P1 |
Category:Secret Detection | Epic / Strategy | maturityviable | ~P2 |
Category:Malware Scanning | Epic / Strategy TBD | maturityplanned | ~P4 |

- How we work
- Slack channel: #g_secure-static-analysis
- Static Group UX issues
-
Planning Workflow Board - overview of all workflow stages
- Delivery Workflow Board - focused on development
- Planning Board - focused on pre-development
- Static Analysis Metrics
Themes

Custom Ruleset Support - Theme: [AST Leadership]

There is a lot that goes into the accuracy of secure analyzers. One major way to refine scan accuracy is to customize the detection rulesets the scanners use. Custom Rulesets will allow users to extend the rules for each analyzer on a project-by-project bases, to reduce false positives or provide coverage beyond the default rules shipped by GitLab.

Improve the Non-Ultimate Secure Experience - Theme: [Usability] & [Security for Everyone]

With our move to Core with SAST & Secret detection, we need to improve the experience to best show value of SAST.
- Improve MR Experience for Secure Scans on Non-Ultimate Plans - Epic
- Security & Compliance page for core users - Issue

Analyzer Additions & Updates - Theme: [AST Leadership]

We have a few major analyzer updates

Easy to Configure SAST - Configuration UI - Theme: [AST Leadership]

With nearly 15 SAST scanners, there are a lot of configuration options for SAST. These can be hard to understand for the first time and to ensure your security scans remain functional over time. A configuration UI will help manage and setup SAST configuration options.

Community MR Coach

New in %13.1 we created a new community MR Coach to have a dedicated resource to focus on:
- community contributions to static scanners
- handle customer escalations/bugs
- contributions to upstream OSS projects we depend on
Community MR Coach for 13.5: @theoretick
Release Post Candidates
- Custom Rulesets for SAST & Secret Detectoin
- Improved MR experience for Non-Ulitmate Users
- NodeJS V4
- MobSF Integration - iOS & Android SAST support
- Configuration UI Improvements - Existing Configs & Analyzer Support