# Context The results of [Continuous Vulnerability Scanning](https://docs.gitlab.com/ee/user/application_security/continuous_vulnerability_scanning/) (CVS) are only available in the [Vulnerability Report](https://docs.gitlab.com/ee/user/application_security/vulnerability_report/). This is because CVS only scans SBOMs reported in pipelines that ran on the default branch. One of the consequences of relying only on SBOM for scans is that "[Security scan results are no longer available in the form of CI Job artifacts](https://gitlab.com/groups/gitlab-org/-/epics/11617#note_1584984786)". This means that features that currently depend on these artifacts do not work with CVS. # Problem to solve In order to show security findings in the [MR security widget](https://docs.gitlab.com/ee/user/application_security/#merge-request), we need to have [Vulnerabilities in a pipeline](https://docs.gitlab.com/ee/user/application_security/vulnerability_report/pipeline.html). This is also required to perform certain validations in the [Merge request approval policies](https://docs.gitlab.com/ee/user/application_security/policies/scan-result-policies.html#security-policy-scopes) feature. To complete https://gitlab.com/groups/gitlab-org/-/epics/14627+, the MR widget, pipeline security tab, and approval policies features must work with the new SBOM based dependency scanning. Upon doing so, the feature will move into **Beta**. # Proposal In https://gitlab.com/groups/gitlab-org/-/epics/8341+, we fully replaced the use of security report artifacts with records in the `security_findings` table. If we can use CVS to insert security finding records in this table, all the features that currently depend on the CI reports will continue to work as before, and require minimal changes. ## Proposed issues - https://gitlab.com/gitlab-org/gitlab/-/issues/490332+s - https://gitlab.com/gitlab-org/gitlab/-/issues/490333+s - https://gitlab.com/gitlab-org/gitlab/-/issues/490334+s - https://gitlab.com/gitlab-org/gitlab/-/issues/490347+s - https://gitlab.com/gitlab-org/gitlab/-/issues/490348+s ## FAQ **Will there be a replacement for the security report?** Related to https://gitlab.com/groups/gitlab-org/-/epics/14636#note_2026706118 Yes, you can download the [security scan results](https://docs.gitlab.com/ee/user/application_security/vulnerability_report/pipeline.html#downloading-security-scan-results) for each tool. ## Status _The following comments contain the latest status updates in order of most recent to least recent._ * https://gitlab.com/groups/gitlab-org/-/epics/14636#note_2199458855 * https://gitlab.com/groups/gitlab-org/-/epics/14636#note_2188465786 * https://gitlab.com/groups/gitlab-org/-/epics/14636#note_2179673186 * https://gitlab.com/groups/gitlab-org/-/epics/14636#note_2166897820 <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION -->