Feedback issue: Manage SAST False Positives with AI (Beta)
Welcome to the Beta for Manage SAST False Positives with AI!
The purpose of this feedback issue is to collect your experiences with the AI-powered false positive detection feature for SAST vulnerabilities. Our goal is to understand how this feature is helping (or hindering) your security workflows, identify bugs and improvement areas, and prioritize enhancements based on real usage. Your feedback will directly influence how we evolve this feature from Beta to GA.
Limited Beta Availability
- Available in SaaS, Self-managed and Dedicated in 18.7
- Accessible via Vulnerability Report and Security Configuration Page
- Requires Ultimate tier with GitLab Duo add-on subscription
What is the SAST False Positive Detection Feature?
The SAST False Positive Detection feature is an GitLab Duo-powered capability that helps security teams identify and manage false positives in SAST (Static Application Security Testing) vulnerabilities. It analyzes vulnerabilities and provides intelligent recommendations on which ones might be false positives, enabling faster triage and more efficient vulnerability management.
Current Beta capabilities (18.7)
Current Beta capabilities
False Positive Analysis
- Analyze SAST vulnerabilities for potential false positives
- Provide AI-powered recommendations on false positive likelihood
- Display false positive information on vulnerability details
- Show false positive badges in the vulnerability report
Reporting & Visibility
- Export false positive information in vulnerability report exports
- View false positive metrics and trends
- Monitor false positive detection workflow
- Limited to Ultimate tier with Duo add-on subscription
- False positive detection focuses on High and Critical severity SAST vulnerabilities
Feedback we're especially interested in
- Accuracy: Does the AI correctly identify false positives?
- Usefulness: Does the feature save you time in vulnerability triage?
- User Experience: How intuitive is the interface for managing false positives?
- Integration: How well does this fit into your existing security workflows?
- Missing capabilities: What false positive management tasks can't you accomplish?
- Performance: Are there any performance issues with the feature?
- Recommendations Quality: Are the AI recommendations helpful and trustworthy?
How to give feedback
-
Check existing feedback: Review threads below to see if your issue is already reported. Add a
👍 or comment to show support. - Start a new thread: Use a descriptive title like "False positive detection misses SQL injection" or "UI is confusing for dismissing multiple vulnerabilities"
-
Include context:
- What you were trying to do
- The response or behavior you received
- What you expected vs. what happened
- URLs or screenshots (sanitized as needed)
- Vulnerability IDs or project information
- Rate the response: On a scale of 1-5, how useful was it?
Example feedback format
- Title: AI incorrectly identifies SQL injection as false positive
- Context: Analyzed SAST vulnerabilities in my project
- What happened: Feature marked a genuine SQL injection vulnerability as likely false positive
- Expected: Should correctly identify actual vulnerabilities vs. false positives
- Usefulness: 2/5 - Had to manually review and override the recommendation
- Screenshots: [If applicable]
What you can expect from us
- We will read all feedback during the Beta period
- We will prioritize fixes for GA based on feedback patterns
- We will create issues for reproducible problems
- We may reach out for clarification on complex security issues