## Problem to solve Currently, users often don't know what permissions and other prererequisites they need before attempting a task. Lack of preparation leads to failed attempts, wasted time troubleshooting, and potential security gaps if they grant overly broad permissions as a workaround. ## Proposal Reduce friction and confusion for users trying to implement application security testing features. Ensure prerequisites are complete and standardized, thereby: * Enabling self-service: Users can quickly verify they have the right access before starting, rather than discovering permission issues mid-task * Promoting least-privilege access: By pointing to custom roles, you help users grant only the specific permissions needed for each task, improving their security posture * Reducing support burden: Clear prerequisites prevent permission-related questions and support tickets * Improving documentation completeness: The docs become a true SSOT (single source of truth) for "how do I do X securely?" rather than just "here's how to do X" The secondary benefit is **consistency and discoverability** - users learn to expect prerequisites on every task, making the docs more predictable and trustworthy. ### Scope - Ensure all tasks under the [Secure your application](https://docs.gitlab.com/user/application_security/) chunk of the docs clearly state their prerequisites. - Ensure custom role information is included in each prerequisites section. Some content has been excluded because it falls outside scope of the "Application security testing" group. See [Exclusions](https://gitlab.com/gitlab-org/gitlab/-/work_items/536451#note_3184949226). ## Progress - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/_index.md) - [ ] analyze - :x: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/analyze/_index.md) - :white_check_mark: [duo.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/analyze/duo.md) - [ ] api_fuzzing - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/_index.md) - [ ] configuration - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/configuration/_index.md) - [ ] [customizing_analyzer_settings.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/configuration/customizing_analyzer_settings.md) - [ ] [enabling_the_analyzer.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/configuration/enabling_the_analyzer.md) - [ ] [offline_configuration.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/configuration/offline_configuration.md) - [ ] [overriding_analyzer_jobs.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/configuration/overriding_analyzer_jobs.md) - [ ] [variables.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/configuration/variables.md) - [ ] [create_har_files.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/create_har_files.md) - [ ] [performance.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/performance.md) - [ ] [troubleshooting.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_fuzzing/troubleshooting.md) - [ ] api_security - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security/_index.md) - [ ] api_discovery - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security/api_discovery/_index.md) - [ ] api_security_testing - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/_index.md) - [ ] configuration - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/configuration/_index.md) - [ ] [customizing_analyzer_settings.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/configuration/customizing_analyzer_settings.md) - [ ] [enabling_the_analyzer.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/configuration/enabling_the_analyzer.md) - [ ] [offline_configuration.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/configuration/offline_configuration.md) - [ ] [overriding_analyzer_jobs.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/configuration/overriding_analyzer_jobs.md) - [ ] [variables.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/configuration/variables.md) - [ ] [performance.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/performance.md) - [ ] [troubleshooting.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/api_security_testing/troubleshooting.md) - [ ] [comparison_dependency_and_container_scanning.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/comparison_dependency_and_container_scanning.md) - [ ] configuration - [ ] [security_configuration_profiles.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/configuration/security_configuration_profiles.md) - [ ] :construction: (Roshni) container_scanning - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/container_scanning/_index.md) - [ ] [container_scanning_troubleshooting.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/container_scanning/container_scanning_troubleshooting.md) - [ ] [multi_container_scanning.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/container_scanning/multi_container_scanning.md) - :x: continuous_vulnerability_scanning - :x: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/continuous_vulnerability_scanning/_index.md) - [ ] coverage_fuzzing - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/coverage_fuzzing/_index.md) - :white_check_mark: [cve_id_request.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/cve_id_request.md) - [ ] dast - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/_index.md) - [ ] browser - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/_index.md) - [ ] [application_deployment_options.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/application_deployment_options.md) - [ ] configuration - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/_index.md) - [ ] [authentication_scripts.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/authentication_scripts.md) - [ ] [authentication.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/authentication.md) - [ ] [customize_settings.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/customize_settings.md) - [ ] [enabling_the_analyzer.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/enabling_the_analyzer.md) - [ ] [offline_configuration.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/offline_configuration.md) - [ ] [overriding_analyzer_jobs.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/overriding_analyzer_jobs.md) - [ ] [variables.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/configuration/variables.md) - [ ] [troubleshooting.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser/troubleshooting.md) - [ ] [browser_based_4_to_5_migration_guide.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/browser_based_4_to_5_migration_guide.md) - [ ] [on-demand_scan.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/on-demand_scan.md) - [ ] [profiles.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/profiles.md) - [ ] [proxy_based_to_browser_based_migration_guide.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dast/proxy_based_to_browser_based_migration_guide.md) - :white_check_mark: [dependency_list](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_list/) - :white_check_mark: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_list/_index.md) - :white_check_mark: [dependency_scanning](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_scanning/) - :white_check_mark: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_scanning/_index.md) - :white_check_mark: dependency_scanning_sbom - :white_check_mark: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_scanning/dependency_scanning_sbom/_index.md) - :white_check_mark: [experiment_libbehave_dependency.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_scanning/experiment_libbehave_dependency.md) - :white_check_mark: [migration_guide_to_sbom_based_scans.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_scanning/migration_guide_to_sbom_based_scans.md) - :white_check_mark: [static_reachability.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_scanning/static_reachability.md) - :white_check_mark: [troubleshooting_dependency_scanning.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/dependency_scanning/troubleshooting_dependency_scanning.md) - [ ] detect - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/detect/_index.md) - :white_check_mark: [roll_out_security_scanning.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/detect/roll_out_security_scanning.md) - [ ] [security_configuration.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/detect/security_configuration.md) - [ ] [security_report_validation.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/detect/security_report_validation.md) - :white_check_mark: [security_scanning_results.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/detect/security_scanning_results.md) - [ ] [vulnerability_deduplication.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/detect/vulnerability_deduplication.md) - [ ] [vulnerability_scanner_maintenance.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/detect/vulnerability_scanner_maintenance.md) - [ ] [get-started-security.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/get-started-security.md) - [ ] gitlab_advisory_database - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/gitlab_advisory_database/_index.md) - :white_check_mark: [iac_scanning](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/iac_scanning/) - :white_check_mark: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/iac_scanning/_index.md) - [ ] offline_deployments - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/offline_deployments/_index.md) - [ ] :construction: (Russell) remediate - :white_check_mark: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/remediate/_index.md) - :construction: (Russell) [duo.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/remediate/duo.md) - :white_check_mark: [sast](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/) - :white_check_mark: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/_index.md) - :x: [advanced_sast_coverage.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/advanced_sast_coverage.md) - :white_check_mark: [advanced_sast_cpp.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/advanced_sast_cpp.md) - :white_check_mark: [analyzers.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/analyzers.md) - :white_check_mark: [customize_rulesets.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/customize_rulesets.md) - :white_check_mark: [evaluation_guide.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/evaluation_guide.md) - :white_check_mark: [gitlab_advanced_sast.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/gitlab_advanced_sast.md) - :x: [rules.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/rules.md) - :white_check_mark: [troubleshooting.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/sast/troubleshooting.md) - [ ] secret_detection - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/_index.md) - [ ] [automatic_response.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/automatic_response.md) - [ ] client - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/client/_index.md) - [ ] [detected_secrets.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/detected_secrets.md) - [ ] [exclusions.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/exclusions.md) - [ ] pipeline - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/pipeline/_index.md) - [ ] [configure.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/pipeline/configure.md) - [ ] [custom_rulesets_schema.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/pipeline/custom_rulesets_schema.md) - [ ] [tutorial.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/pipeline/tutorial.md) - [ ] [push_protection_tutorial.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/push_protection_tutorial.md) - [ ] [remove_secrets_tutorial.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/remove_secrets_tutorial.md) - [ ] secret_push_protection - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secret_detection/secret_push_protection/_index.md) - [ ] [secure_your_application.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/secure_your_application.md) - :white_check_mark: terminology - :white_check_mark: [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/terminology/_index.md) - [ ] triage - [ ] [_index.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/triage/_index.md) - [ ] [troubleshooting_application_security.md](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/user/application_security/troubleshooting_application_security.md)