glab-security

glab security

Configure GitLab security features for a project.

Experimental upstream command surface: verify live glab security --help before relying on it in production automation.

Common commands

# Show security command help
glab security --help

# Enable a scan profile on the current project
glab security config enable dependency_scanning

# Enable SAST on a specific project
glab security config enable sast -R gitlab-org/cli

# Check profile status
glab security config status dependency_scanning

# Disable a scan profile
glab security config disable dependency_scanning

# Disable dependency scanning auto-remediation
glab security config disable dependency_scanning_post_processing

Supported profile examples

Upstream help currently shows these profile names in examples:

• dependency_scanning
• sast
• dependency_scanning_post_processing for vulnerable dependency auto-remediation

GitLab may support additional profile names depending on instance version and project features. If a profile fails, use the error output and GitLab project security settings to confirm availability.

Operational guidance

• You must be a Maintainer or Owner of the target project.
• Use -R/--repo for explicit targeting in agents and scripts; otherwise glab resolves the project from the current git remote.
• Treat enable and disable as project-configuration writes. Confirm the target project and requested profile before changing state.
• Prefer status before and after a change so the user can see the current scan/profile state.

Safe workflow

PROFILE=sast
PROJECT=group/project

# 1. Inspect current state
glab security config status "$PROFILE" -R "$PROJECT"

# 2. Confirm requested change with the user, then apply
glab security config enable "$PROFILE" -R "$PROJECT"

# 3. Verify
glab security config status "$PROFILE" -R "$PROJECT"

Subcommands

See references/commands.md for the current captured --help output.