GitLab
Connect GitLab to RAD Security for application security scanning and vulnerability management.
This guide walks you through connecting GitLab to RAD Security, enabling application security scanning and vulnerability findings across your GitLab instance or groups.
Prerequisites
Before you begin, ensure you have:
Required Token Scopes
The GitLab integration requires the following API token scope:
| Operation | Required Scope |
|---|---|
| Query Applications | read_api |
| Query Application Findings | read_api |
| Query findings across all applications | read_api |
| Get Application Finding Details | read_api |
Only the read_api scope is required. This provides read-only access to the API, including all groups and projects, the container registry, and the package registry.
Generating an API Access Token
GitLab supports three methods for creating API access tokens. The recommended method is using a service account, but service accounts are not available on GitLab Free instances. If you're using GitLab Free, use a group access token instead.
Service accounts provide the most secure option for integrations as they are not tied to individual users.
Instance-Wide Service Account
Access Admin Settings
Log into your GitLab instance and select Admin from the left sidebar.
Navigate to Service Accounts
Select Settings > Service accounts.
Create Service Account
Click Add service account and fill out the required fields to create a new instance-wide service account.
Manage Access Tokens
Click the vertical ellipsis (⋮) to the right of the new service account and select Manage access tokens.
Create the Token
Proceed to Creating the Access Token below.
Group Service Account
Navigate to Your Group
Go to the group where you want to create the service account.
Access Service Account Settings
Select Settings > Service accounts from the left sidebar.
Create Service Account
Click Add service account and fill out the required fields.
Manage Access Tokens
Click the vertical ellipsis (⋮) to the right of the new service account and select Manage access tokens.
Create the Token
Proceed to Creating the Access Token below.
For more information, see the GitLab service accounts documentation.
Group access tokens are ideal for GitLab Free users who need to scope access to a specific group.
Navigate to Your Group
Go to the group where you want to create the access token.
Access Token Settings
Select Settings > Access tokens from the left sidebar.
Add New Token
Click Add new token in the Active group access tokens section.
Create the Token
Proceed to Creating the Access Token below.
For more information, see the GitLab group access tokens documentation.
Personal access tokens are tied to your user account and inherit your permissions.
Personal access tokens are tied to individual users. If the user is removed or leaves the organization, the integration will stop working. Consider using service accounts or group access tokens for production integrations.
Access Your Profile
Click your avatar in the left sidebar and select Edit profile.
Navigate to Access Tokens
Select Access tokens from the left sidebar.
Add New Token
Click Add new token.
Create the Token
Proceed to Creating the Access Token below.
For more information, see the GitLab personal access tokens documentation.
Creating the Access Token
Once you're on the new API access token creation screen:
Configure Token Details
Fill out the following fields:
- Token name: A descriptive name (e.g., "RAD Security Integration")
- Description (optional): Purpose of the token
- Expiration date: Set according to your security policies
Select Scopes
Under the Select scopes section, check the box next to:
read_api
Create Token
Click Create token.
Save Token
Copy the token immediately — it will not be shown again.
Store your token securely. If you lose it, you'll need to generate a new one.
Also take note of your GitLab instance URL (e.g., https://gitlab.com or https://gitlab.yourcompany.com). You'll need this when configuring the integration.
Configure in RAD Security
Once you have your token, configure the integration in RAD Security:
Navigate to Integrations
Go to your RAD Security workspace and navigate to Integrations.
Add GitLab Integration
Click Add Integration and select GitLab from the available options.
Enter Configuration
Fill in the required fields:
| Parameter | Description | Example |
|---|---|---|
| Integration Name | A descriptive name for this integration | GitLab Production |
| Secret | The API access token you generated | glpat-xxxxxxxxxxxx |
| Base URL | The URL of your GitLab instance | https://gitlab.com |
Save and Test
Click Save to create the integration. RAD Security will validate the connection.
Your token is encrypted and stored securely by RAD Security.
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Integrations in your RAD Security workspace
- Locate your GitLab integration
- Check the connection status shows as Active
- Verify applications and findings are being discovered
Your GitLab integration is now configured! RAD Security will begin syncing application security data from your GitLab instance.
What Data is Synced
Use Cases
Centralized Vulnerability View Aggregate security findings from GitLab alongside other security tools for a unified view.
Security Posture Tracking Track application security trends over time across all GitLab projects.
Compliance Reporting Generate compliance reports that include GitLab security scanning results.
Risk Prioritization Correlate GitLab findings with other data sources to prioritize remediation efforts.
Troubleshooting
Security Best Practices
Use Service Accounts Create dedicated service accounts rather than using personal tokens to avoid disruption when team members leave.
Minimal Scope
Only grant the read_api scope required for the integration. Avoid granting write permissions.
Rotate Tokens Regularly Set appropriate expiration dates and rotate tokens according to your security policies.
Audit Token Usage Regularly review service account and token activity in GitLab's audit logs.
Token Rotation
To rotate your GitLab access token:
Generate New Token
Create a new token following the steps above with the same scope.
Update RAD Security
Edit your GitLab integration in RAD Security and update the Secret field.
Verify Connection
Confirm the integration status remains Active after the update.
Revoke Old Token
Delete the old token from GitLab to complete the rotation.