Two AI-powered security milestones in GitLab 18.10. 🚀
First: SAST False Positive Detection is now generally available, powered by GitLab Duo Agent Platform (DAP). This feature first launched as a beta in 18.7, and after months of iteration, customer feedback, and real-world validation, it's now GA and ready for use in DAP.
When a SAST scan runs, GitLab Duo automatically analyzes each Critical and High severity finding to determine the likelihood that it's a false positive:
📋 Automatic analysis after every SAST scan, with no manual intervention required;
✅ Confidence scoring indicating the likelihood a finding is a false positive;
🔍 Contextual AI reasoning explaining why a finding may or may not be a true positive;
🎯 Manual trigger option per vuln for on-demand analysis; and
🔄 Seamless integration directly in the vulnerability report
Second: we're extending this same capability to a new scanner type. Secret False Positive Detection launches in beta in 18.10, bringing AI-powered triage to secret detection findings. This new DAP flow now analyzes flagged secrets, providing confidence scores and contextual reasoning to help teams dismiss noise quickly and focus on real exposures that need rotation or remediation.
Security teams have told us consistently that manual triage is one of their biggest time sinks. Investigating SAST findings that turn out to be false positives, reviewing flagged secrets that are placeholder values or expired tokens. That time adds up fast, and it pulls attention away from real vulnerabilities that need immediate action.
Now, DAP handles that triage automatically across both SAST and secret detection, giving teams the context and confidence they need to move faster.
Shipping both of these in the same release is a meaningful milestone for the team. It validates the pattern we set out to build: AI-powered false positive detection that scales across scanner types and helps security teams focus on what actually matters.
Special recognition to
Nate Rosandich,
Meir Benayoun,
Andrew Cummins Huzaifa Iftikhar,
Hitesh Raghuvanshi,
Illya Klymov,
Harsimar Sandhu, 🦊👨🏽💻Sam Figueroa 🌱, Jean van der Walt,
Andrew J.,
Scott Hampton for making this possible.
Thank you to
Michael Clausen,
Asaf Biton,
Christopher Widstrom, Ethan Feller, Amar Patel, Ahmed Hemdan,
isaac dawson, Vishwa B. and many others for the amazing cross-collaboration to get both of these features released in this milestone.
Finally, thank you to
Omer Azaria,
Michael Wildpaner,
Dean Agron,
Mark Mishaev and
Ron Vider for your guidance, leadership and direction as we steered these two initiatives to release
SAST FP Detection is available now for GitLab Ultimate customers with GitLab Duo Agent Platform. Secret Scanning FP Detection is available as a beta.
Read more in the release post below. 👇
#DevSecOps #AIinSecurity #GitLab #SAST #SecretDetection #VulnerabilityManagement #AgenticAI