Bulk SAST Triage & Auto-Remediation in GitLab 19.3

Name: Bulk SAST Triage & Auto-Remediation in GitLab 19.3
Uploaded: 2026-10-13T07:22:12-04:00
Duration: 5 min 2 s
Description: Eliminate security debt and clear your vulnerability backlogs faster with automated bulk triage and remediation in GitLab 19.3. In this walkthrough, Staff Developer Advocate Cesar Saavedra demonstrates how the GitLab Duo Agent Platform empowers securit...

Gitlab

10/13/2026

0 (0%)

Report Like Favorite

Transcript

in production by attackers. With GitLab, teams can now resolve SAS false positive alerts and remediate vulnerabilities in bulk to drive down your risk and free your team's time to ship features. Let's see how these features can help clear your vulnerability backlog. We start at a project called Frontend, which is part of an application called Tanuki Bank. First, we need to enable two features. We head to our project's GitLab Duo General Settings and enable Turn on SAS False Positive Detection and Turn on SAS Vulnerability Resolution Workflow. By enabling these two capabilities, not only are we asking Duo Agent Platform to automatically detect false positives for us, but also to resolve any true positives as soon as they are detected. We will see how these two capabilities work in conjunction later in this demo. Also, we need to check one more thing. This project sits under the top group called Developer Advocacy at GitLab. So, we head to our Users Preferences and scroll down to the Behavior section and ensure that our default GitLab Duo namespace is set to Developer Advocacy at GitLab. You will need to adjust the default namespace for your team or organization. This project has existing vulnerabilities, so let's open its vulnerability report. Let's filter the list by active SAS vulnerabilities. We have three of them. Next, we select all the vulnerabilities in the list. At this point, we could choose to run a vulnerability resolution in bulk for all of the selected vulnerabilities, all of which, by the way, have a vulnerability resolution available. But why don't we first identify any false positives? This way, we could run a bulk vulnerability resolution flow just for the true positives. Let's select Run SAS False Positive Detection from the Select Action list. A button with the same name appears on the right side of the screen. Clicking on this button starts the bulk SAS False Positive Detection flow. A Detecting False Positives progress bar temporarily appears on the screen as these agent flows run. Also, a label saying Duo Verifying appears for each vulnerability being checked for false positives. As we refresh the screen, we see that one false positive detection flow has finished, and it has marked one vulnerability with a Not a False Positive label. Once all the flows complete, we notice that two vulnerabilities have been determined to be true positives, and one has been marked as a Possible False Positive. Also, notice the two View Session labels next to the two true positives. This indicates that Duo Agent Platform has already kicked off vulnerability resolution flows in bulk for these two on our behalf. Let's open these two running AI sessions to watch their progress. We can see the flows check that the vulnerabilities are true positives. They then fetch the corresponding source files that are affected by their respective vulnerabilities. They proceed to edit the files and patch them. They create and run unit tests to validate that the fixes work. They proceed to commit the fixes, and finally, they create merge requests, which they link to their respective vulnerabilities. Let's head back to the Vulnerability Report and drill into one of the high severity vulnerabilities to confirm that it's now related to a merge request that fixes it. We confirm that the SAS False Positive detection flow has only a 5% confidence that this vulnerability is a false positive. The fact that this vulnerability is a true positive and that its severity is high caused the automatic run of the bulk vulnerability resolution flow. Scrolling down the Vulnerability Detail page, we now see that there is a merge request associated with this vulnerability. This is the merge request that contains a vulnerability fix, which was generated in its entirety by the vulnerability resolution flow. Let's open the newly generated merge request. In it, we can navigate to the Changes tab to see all the files and modifications made by the AI flow to fix this vulnerability. We head back to the Vulnerability Report and drill into the second High Vulnerability Detail page. Scrolling down its page, we verify that a newly created merge request has also been associated with it by the vulnerability resolution flow. And there you have it. Teams can now use Duo Agent Platform to drive down their existing backlog by eliminating false positives and automating remediation so you can get back to shipping.

TL;DR

GitLab 19.3 introduces bulk SAST false positive detection powered by the Duo Agent Platform, allowing teams to triage entire vulnerability backlogs in a single action rather than reviewing findings one by one.
When a finding is confirmed as a true positive, GitLab Duo automatically launches a background remediation session that patches source code, runs unit tests, and opens a linked merge request — all without manual developer intervention.
The two new capabilities — SAST False Positive Detection and Vulnerability Resolution Workflow — are enabled together in project settings and are designed to work in conjunction for end-to-end automated triage and fix.

Summary

This GitLab 19.3 product walkthrough demonstrates how the GitLab Duo Agent Platform automates two of the most time-consuming tasks in application security: SAST false positive triage and vulnerability remediation. Staff Developer Advocate Cesar Saavedra guides viewers through enabling two new project-level settings — SAST False Positive Detection and SAST Vulnerability Resolution Workflow — and then shows how they work together in the Vulnerability Report. Once activated, teams can select all active SAST findings in bulk and trigger an AI-driven false positive detection flow. GitLab Duo evaluates each finding against its source context, labeling results as confirmed true positives or possible false positives. For any finding confirmed as a true positive, the platform automatically launches a background agentic session that fetches the affected source files, generates a code patch, writes and executes unit tests to validate the fix, commits the changes, and opens a merge request linked directly to the vulnerability record. The demo shows three active SAST vulnerabilities being processed: two are confirmed true positives with auto-generated merge requests ready for review, and one is flagged as a possible false positive — sparing the team from unnecessary remediation effort. The end result is a dramatically reduced vulnerability backlog with minimal manual intervention, allowing engineering teams to stay focused on feature delivery rather than security debt.

Chapters

0:00 - Introduction & Problem Context
0:26 - Enabling Duo SAST Settings
1:27 - Filtering the Vulnerability Report
2:12 - Bulk False Positive Detection
3:06 - Autonomous Remediation Sessions
3:40 - Reviewing Auto-Generated Merge Requests

Key Quotes

0:00 "AI is speeding up the volume of code that developers ship and the exploitation of vulnerabilities in production by attackers."
0:11 "With GitLab, teams can now resolve SaaS false positive alerts and remediate vulnerabilities in bulk to drive down your risk and free your team's time to ship features."
0:47 "By enabling these two capabilities, not only are we asking Duo Agent Platform to automatically detect false positives for us, but also to resolve any true positives as soon as they are detected."
3:23 "They create and run unit tests to validate that the fixes work. They proceed to commit the fixes, and finally, they create merge requests, which they link to their respective vulnerabilities."
4:48 "Teams can now use Duo Agent Platform to drive down their existing backlog by eliminating false positives and automating remediation so you can get back to shipping."

FAQ

Do developers need to manually trigger remediation for each vulnerability, or does it happen automatically?

Remediation is triggered automatically. Once the false positive detection flow confirms a finding as a true positive, GitLab Duo immediately launches a background vulnerability resolution session for that finding without requiring additional user action. Developers only need to review and merge the auto-generated merge request.

What does the auto-generated merge request include?

Each auto-generated merge request includes the full code patch addressing the vulnerability, unit tests created and executed by the AI to validate the fix, and a direct link back to the vulnerability record in the Vulnerability Report — giving reviewers full context before merging.

Categories:

» Cybersecurity » Application Security
» Data Protection

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

10/13/2026

01:00 PM

10/13/2026

Ensuring Compliance: Audit Evidence from CJIS to FERPA

https://www.truthinit.com/index.php/channel/2159/ensuring-compliance-audit-evidence-from-cjis-to-ferpa/
10/15/2026

11:00 AM

10/15/2026

Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

https://www.truthinit.com/index.php/channel/1372/risk-in-real-time-demo-series-the-autonomous-era-orchestrating-a-resilient-enterprise/
10/20/2026

11:00 AM

10/20/2026

Harnessing Data Governance for AI with Cyera and Snowflake

https://www.truthinit.com/index.php/channel/2137/harnessing-data-governance-for-ai-with-cyera-and-snowflake/
10/27/2026

11:00 AM

10/27/2026

Maximize Your Microsoft Investment for Security and Growth

https://www.truthinit.com/index.php/channel/2178/maximize-your-microsoft-investment-for-security-and-growth/
10/27/2026

01:00 PM

10/27/2026

The HUMAN Experience: Real-Time Insights into Page Intelligence

https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
10/28/2026

01:00 AM

10/28/2026

[APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2125/apac-ensuring-comprehensive-security-for-ai-applications/
10/28/2026

06:00 AM

10/28/2026

[EMEA:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2127/emea-ensuring-ai-security-across-all-platforms/
10/28/2026

01:00 PM

10/28/2026

[AMERICAS:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2126/securing-ai-across-the-americas-strategies-and-insights/
10/28/2026

01:00 PM

10/28/2026

EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
11/04/2026

11:00 AM

11/04/2026

Leveraging CISA’s Zero Trust Maturity Model in an AI-Driven Landscape

https://www.truthinit.com/index.php/channel/2149/leveraging-cisas-zero-trust-maturity-model-in-an-ai-driven-landscape/
11/04/2026

11:00 AM

11/04/2026

Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions

https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
11/05/2026

02:00 PM

11/05/2026

HUMAN Dialogue: Embracing the Rise of the Agentic Consumer in AI

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-agentic-consumer-in-ai/
11/05/2026

02:00 PM

11/05/2026

Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
11/19/2026

01:00 PM

11/19/2026

360View: Govern, Secure & Recover Your Microsoft 365 Environment

https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/
11/19/2026

01:00 PM

11/19/2026

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/