# Promoted to Epic This issue has been converted to an [Epic](https://gitlab.com/groups/gitlab-org/-/epics/2098) instead of a single issue. Please review that epic for the latest requirements and current status of moving SAST scanners to Core ## Original issue text <details> ### Intended users <!-- Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later. * [Parker (Product Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#parker-product-manager) * [Delaney (Development Team Lead)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#delaney-development-team-lead) * [Presley (Product Designer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#presley-product-designer) * [Devon (DevOps Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#devon-devops-engineer) * [Sidney (Systems Administrator)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sidney-systems-administrator) * [Dana (Data Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#dana-data-analyst) Personas are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/ --> * [Sasha (Software Developer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sasha-software-developer) * [Sam (Security Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sam-security-analyst) ## Overview GitLab Enterprise Edition includes [SAST scanning](https://docs.gitlab.com/ee/user/application_security/sast/). We are will move it to Core to fulfill [our stewardship promise](https://about.gitlab.com/company/stewardship/#promises). ## Proposal Make the first three SAST capabilities listed below available in all tiers, including Core. Note that the bottom three capabilities should remain in ~"GitLab Ultimate" only |Capability| In Core | In Ultimate | | --- | ------ | ------ | | [Configure SAST Scanners](https://docs.gitlab.com/ee/user/application_security/sast/#configuration) | **Yes** | Yes | | [Customize SAST Settings](https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings) (Overrides, Available Variables, Filters, Timeouts, Settings ) | **Yes** | Yes | | View [JSON Report](https://docs.gitlab.com/ee/user/application_security/sast/#reports-json-format) | **Yes** | Yes | | [Presentation of JSON Report in Merge Request](https://docs.gitlab.com/ee/user/application_security/sast/#overview) | No | Yes | | [Interaction with Vulnerabilities](https://docs.gitlab.com/ee/user/application_security/sast/#interacting-with-the-vulnerabilities) | No | Yes | | [Access to Security Dashboard](https://docs.gitlab.com/ee/user/application_security/sast/#security-dashboard) | No | Yes | ## Non-Engineering Tasks * [ ] Create a dedicated blog post explaining the move - some additional rationale can be found in the [private deliberation issue](https://gitlab.com/gitlab-com/Product/issues/315). ### Documentation <!-- See the Feature Change Documentation Workflow https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements If this feature requires changing permissions, this document https://docs.gitlab.com/ee/user/permissions.html must be updated accordingly. --> Update documentation to make the distinction between product tiers clear and what is and is not included in each. ### Testing <!-- What risks does this change pose? How might it affect the quality of the product? What additional test coverage or changes to tests will be needed? Will it require cross-browser testing? See the test engineering process for further help: https://about.gitlab.com/handbook/engineering/quality/test-engineering/ --> Perform end-to-end tests with both a Core and a ~"GitLab Ultimate" license to ensure that the correct functionality is exposed in each license tier. ### What does success look like, and how can we measure that? <!-- Define both the success metrics and acceptance criteria. Note that success metrics indicate the desired business outcomes, while acceptance criteria indicate when the solution is working correctly. If there is no way to measure success, link to an issue that will implement a way to measure this. --> Number of SAST scans done in the first 30 days after moving this to Core. Target => 300% of scans done in previous 30 days. * This will demonstrate that more users are able to successfully use the SAST scanning in Core. ### What is the type of buyer? <!-- Which leads to: in which enterprise tier should this feature go? See https://about.gitlab.com/handbook/product/pricing/#four-tiers --> GitLab Core ### Open Questions - [x] Do we start with all languages? If not, which languages specifically do we start with? ### Links / references /label ~feature </details>