Madalin Development enhanced by AI

Complete Security Scanning Types: GitHub & GitLab

A merged, deduplicated list of all security scanning capabilities available across both platforms, with recommended open source tools for each scan type.

The topic security and code quality. Create a half octopus body with a dog head that works on multiple MacBooks. The environment is an aquarium with an office style interior. Modern tech style.

Core Security Scans

Static Application Security Testing (SAST)

Analyzes source code without executing it to detect potential vulnerabilities, code logic errors, and security flaws. GitHub uses CodeQL for semantic analysis; GitLab uses multiple analyzers (Semgrep, GitLab Advanced SAST, etc.) supporting broader language coverage.

Availability: GitHub (Advanced Security), GitLab (Free+)

Open Source Tools:

  • SonarQube – Community Edition provides code scanning for vulnerabilities, code smells, and technical debt across 30+ languages with comprehensive dashboards and trend analysis
  • Semgrep CE – Fast, lightweight rule-based static analysis for multiple languages with customizable rules and CI/CD integration
  • GolangCI-Lint – Meta-linter for Go that aggregates multiple linters and can be paired with gosec for security vulnerability detection
  • ShiftLeft Scan – Multi-scanner DevSecOps platform detecting security flaws in source code and dependencies with automatic build breaker
  • Bandit – Security linter for Python that detects common vulnerabilities

Dynamic Application Security Testing (DAST)

Tests running applications for vulnerabilities by performing automated penetration testing against live endpoints. Identifies runtime vulnerabilities that cannot be detected through static analysis, including web application flaws and API issues.

Availability: GitHub (via third-party integration), GitLab (Ultimate)

Open Source Tools:

  • OWASP ZAP (Zed Attack Proxy) – Industry-standard DAST tool with automated vulnerability scanning, manual pen-testing capabilities, and REST API testing with passive/active scanning modes
  • Nikto – Web server scanner testing for dangerous files, outdated software, misconfigurations, and other common issues via command-line
  • Wapiti – Black-box web vulnerability scanner that crawls applications, extracts links/forms, and injects payloads to detect abnormal behavior

Dependency Scanning

Analyzes your project’s direct and transitive dependencies to identify known vulnerabilities in third-party libraries and packages. Provides Software Bill of Materials (SBOM) and vulnerability severity ratings.

Availability: GitHub (Advanced Security), GitLab (Free+)

Open Source Tools:

  • OWASP Dependency-Check – Staple SCA tool scanning project dependencies for known CVEs, supporting multiple languages (Java, .NET, Python, Ruby, Node) with dependency graph analysis
  • Trivy – Fast, comprehensive scanner for dependencies, containers, and IaC files with multiple ecosystem support and SBOM generation
  • OSV-Scanner – Google’s vulnerability scanner for open source dependencies with support for 11+ languages and 20+ package managers
  • Grype – Accurate vulnerability scanner for container images and filesystems with strong SBOM integration
  • npm audit / yarn audit – Built-in dependency vulnerability scanning for Node.js/JavaScript projects

Container Scanning

Scans Docker images and container registries for known vulnerabilities in OS packages and dependencies. Detects CVEs in the container layers before deployment to production.

Availability: GitHub (via third-party integration), GitLab (Ultimate)

Open Source Tools:

  • Trivy – Fast, multi-purpose scanner for container images, filesystems, and Git repositories detecting OS and application vulnerabilities
  • Grype – Anchore’s accuracy-focused vulnerability scanner for container images and local filesystems with strong SBOM support
  • Clair – Open source container vulnerability scanner analyzing image layers for known CVEs
  • Anchore Engine – Container scanning engine with detailed vulnerability analysis and policy enforcement capabilities

Secret Detection

Automatically detects and prevents secrets (API keys, tokens, passwords, credentials) from being committed to repositories. Includes both pre-commit push protection and post-commit repository scanning.

Availability: GitHub (Secret Protection), GitLab (Free+)

Open Source Tools:

  • TruffleHog – Gold-standard secret scanner using entropy analysis and pattern matching, scanning git histories for high-entropy strings and known secret patterns with API validation
  • Gitleaks – Lightweight, fast CLI tool for scanning git repositories using regex-based detection rules with offline capability and easy CI/CD integration
  • Detect-secrets – Curated approach focused on minimizing false positives using baseline methodology for preventing new secret exposures
  • GitGuardian/Legit Security (partially open) – Enterprise-grade scanning across SDLC (source code, CI/CD, containers, IaC)
  • Whispers – Static code analysis tool detecting risky routines and hardcoded credentials for CI/CD pipeline integration

Copilot Secret Scanning (GitHub) / AI Secret Detection (GitLab)

AI-powered detection of unstructured secrets and passwords that traditional pattern matching might miss. Focuses on generic credentials and organization-specific secret patterns with reduced false positives.

Availability: GitHub (Advanced Security), GitLab (Ultimate)

Open Source Tools:

  • Detect-secrets – Uses baseline-based detection to identify unstructured credentials with lower false positive rates
  • TruffleHog with verification – Entropy-based detection validates if secrets are actually active and exploitable

Dependency Review

Displays the full impact of dependency changes before merging pull/merge requests. Shows vulnerable versions and suggests secure alternatives with detailed vulnerability information.

Availability: GitHub (Advanced Security), GitLab (Ultimate)

Open Source Tools:

  • OWASP Dependency-Check – Generates detailed dependency reports with CVE information and severity ratings
  • Trivy – Provides dependency vulnerability information as part of comprehensive scanning
  • Dependabot (GitHub) – Built into GitHub, automatically creates pull requests for vulnerable dependency updates

API & Web Testing

API Security Testing (DAST API)

Specialized dynamic testing for APIs using OpenAPI specifications and API endpoints. Tests for API-specific vulnerabilities like authentication bypass, injection attacks, and authorization flaws.

Availability: GitHub (via third-party), GitLab (Ultimate)

Open Source Tools:

  • OWASP ZAP – API testing capabilities through Zed Attack Proxy with OpenAPI spec support and REST API testing
  • Kiterunner – Specialized API fuzzer discovering hidden API endpoints using wordlists to detect undocumented security flaws
  • Postman (with security) – API development and testing with security scanning capabilities

API Fuzzing (Web API Fuzz Testing)

Sends unexpected or malformed payloads to API parameters to uncover vulnerabilities and unexpected behavior. Complements structured API testing by discovering edge cases and error conditions.

Availability: GitHub (via third-party), GitLab (Ultimate)

Open Source Tools:

  • Kiterunner – Advanced API fuzzing using wordlists to discover hidden endpoints and test for security issues
  • OWASP ZAP – Includes API fuzzing capabilities for finding edge cases and error handling issues
  • AFL (American Fuzzy Lop) – Genetic algorithm-based fuzzer for discovering edge cases in applications

API Discovery

Automatically analyzes running applications to generate OpenAPI documentation describing exposed APIs. Helps identify unintended API surface and API exposure risks.

Availability: GitLab (Ultimate)

Open Source Tools:

  • OpenAPI/Swagger Tools – Generate API specifications from running services and code analysis
  • Postman API discovery – Can be used to document and discover APIs in environments

Infrastructure & Configuration

Infrastructure-as-Code (IaC) Scanning

Scans Terraform, Kubernetes manifests, CloudFormation, and other infrastructure configurations for misconfigurations and security policy violations. Identifies compliance issues before infrastructure deployment.

Availability: GitHub (via third-party), GitLab (Ultimate)

Open Source Tools:

  • Checkov – Comprehensive policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Dockerfile with 3,000+ built-in policies and graph-based cross-resource analysis
  • KICS (Keeping Infrastructure as Code Secure) – Checkmarx’s scanner with 2,400+ Rego-based queries supporting 22+ IaC platforms (Terraform, K8s, Docker, CloudFormation, Ansible)
  • TFLint – Terraform-specific linter detecting errors, deprecated syntax, and enforcing best practices
  • Trivy – Multi-purpose scanner including IaC misconfigurations alongside containers and dependencies
  • Terrascan – Rego-based IaC scanner with policy-as-code approach for multiple cloud platforms

Kubernetes Security Scanning (KubeSec)

Specialized analyzer for Kubernetes manifests and deployments. Detects insecure pod configurations, RBAC issues, and container security context problems.

Availability: GitLab (Ultimate)

Open Source Tools:

  • Kubesec – Kubernetes manifest security scanner detecting risky pod configurations and insecure settings
  • Kubewarden – Policy engine for Kubernetes using WebAssembly for security policy enforcement
  • Kubescape – Runtime Kubernetes security scanner detecting MISCONFIGURATIONS and compliance issues
  • Checkov – Includes extensive Kubernetes manifest scanning alongside other IaC checks

Code Quality & Compliance

Code Quality Analysis

Automatically detects code quality issues, maintainability problems, and best practice violations. Tracks whether code quality is improving or degrading with each commit.

Availability: GitLab (Free+)

Open Source Tools:

  • SonarQube Community Edition – Comprehensive code quality scanning with technical debt measurement and trend analysis
  • CodeFactor – Open source code quality analysis for multiple languages
  • GolangCI-Lint – Go code quality and security checking with multiple linters aggregation

License Scanning / License Compliance

Identifies licenses used by dependencies and enforces organizational license policies. Prevents use of incompatible or restricted licenses in the codebase.

Availability: GitHub (via third-party), GitLab (Free+)

Open Source Tools:

  • OWASP Dependency-Check – Includes license detection and reporting alongside vulnerability scanning
  • Trivy – Includes license scanning functionality for dependencies
  • FOSSology – License scanning and analysis tool for identifying licenses in codebases
  • ScanCode – License and copyright detection across codebases

Detection Features & Add-ons

Custom Pattern Detection

Define organization-specific secrets and patterns to scan for in code. Enables detection of internal credential formats, custom API keys, and proprietary secrets.

Availability: GitHub (Advanced Security), GitLab (Ultimate)

Open Source Tools:

  • TruffleHog – Custom detector modules for proprietary secret formats
  • Gitleaks – Customizable regex patterns in configuration files for organization-specific secrets
  • Semgrep – Custom rule definitions for proprietary code patterns and secrets
  • Detect-secrets – Configurable baseline for custom secret patterns

Dependabot Alerts & Auto-Updates

Automatic notifications for vulnerable dependencies with pull/merge requests to fix them. Keeps dependencies current and reduces security debt.

Availability: GitHub (included in all plans), GitLab (Premium+)

Open Source Tools:

  • Dependabot (GitHub) – Built-in, creates automated PRs for dependency updates
  • Renovate – Open-source alternative with more flexibility and multi-platform support
  • OWASP Dependency-Check – Identifies vulnerable dependencies with manual update creation

Push Protection

Blocks code pushes containing detected secrets before they reach the repository. Prevents secrets from ever being committed, adding a real-time preventive layer.

Availability: GitHub (Secret Protection), GitLab (Ultimate)

Open Source Tools:

  • Gitleaks – Pre-commit hook support to block pushes with detected secrets
  • pre-commit framework – Generic hook framework running Gitleaks, TruffleHog before commits
  • Git hooks – Custom hooks using Gitleaks or TruffleHog for push-time blocking

Copilot Autofix (GitHub) / Vulnerability Remediation Guidance

Automatically generates or suggests fixes for detected vulnerabilities. Reduces manual remediation effort and provides developers with immediate remediation context.

Availability: GitHub (Advanced Security), GitLab (Ultimate)

Open Source Tools:

  • Semgrep – Provides detailed vulnerability explanations with fix suggestions
  • CodeQL – Generates detailed remediation guidance for detected vulnerabilities
  • SonarQube – Shows remediation guidance and best practices for code issues

Security Campaigns

Coordinates organization-wide remediation of security findings across multiple repositories. Allows teams to track and collaboratively fix security issues at scale.

Availability: GitHub (Advanced Security), GitLab (Ultimate)

Open Source Tools:

  • OWASP Dependency-Track – Central platform for tracking and managing dependency vulnerabilities across portfolio
  • DefectDojo – Aggregates security findings from multiple scanners for centralized management
  • Snyk (partially open) – Provides organizational vulnerability management and remediation workflows

Security Overview / Security Dashboard

Aggregates and visualizes security alerts across all repositories. Provides single unified view of organizational security posture, risk distribution, and vulnerability trends.

Availability: GitHub (Advanced Security), GitLab (Free+)

Open Source Tools:

  • OWASP Dependency-Track – Centralized dashboard for component vulnerabilities and compliance
  • DefectDojo – Aggregated security findings dashboard with risk visualization
  • Grafana – Can visualize security scan results from open source tools

Compliance Frameworks & Audit Trails

Enforces compliance policies and maintains complete audit trails for regulatory requirements (HIPAA, PCI DSS, GDPR, SOC 2). Tracks all security actions and approvals.

Availability: GitHub (Enterprise), GitLab (Ultimate)

Open Source Tools:

  • Chef InSpec – Open source compliance-as-code framework automating security and compliance checks
  • OpenSCAP – Security configuration and compliance testing framework
  • Compliance tools – Generic audit logging and trail management in CI/CD

Merge Request / Pull Request Security Widgets

Displays security findings inline with code changes in merge/pull requests. Shows newly introduced vulnerabilities, resolved issues, and security impact of the change.

Availability: GitHub (Advanced Security), GitLab (Free+)

Open Source Tools:

  • Semgrep – PR/MR comment integration for CI/CD tools
  • Checkov – Native GitHub/GitLab PR integration with status checks
  • SonarQube – Comments on pull requests with quality and security findings

Reporting & Analysis

Vulnerability Tracking

Tracks vulnerabilities across code changes using advanced scope and offset signatures. Prevents duplicate reporting when code is refactored while maintaining vulnerability history.

Availability: GitHub (Advanced Security), GitLab (Ultimate)

Open Source Tools:

  • OWASP Dependency-Track – Tracks component vulnerabilities and their lifecycle across projects
  • DefectDojo – Centralized vulnerability tracking with historical analysis
  • Prometheus/Grafana – Can be configured to track vulnerability trends over time

SBOM (Software Bill of Materials)

Generates machine-readable and human-readable documentation of all project dependencies. Useful for supply chain security and compliance reporting.

Availability: GitHub (Advanced Security), GitLab (Free+)

Open Source Tools:

  • Syft – Anchore’s comprehensive SBOM generation tool from container images and filesystems
  • Trivy – Generates SBOMs in SPDX and CycloneDX formats
  • Microsoft SBOM Tool – Enterprise-level SBOM generation for SPDX 2.2 compliance
  • OWASP Dependency-Check – Can export SBOMs and dependency information

CodeQL Analysis (GitHub-specific)

GitHub’s semantic code analysis engine treating code as data using QL query language. Provides deep vulnerability discovery including complex logic flaws and zero-day-style vulnerabilities.

Availability: GitHub (Advanced Security)

Open Source Tools:

  • CodeQL (open source) – GitHub’s semantic analysis engine available open source for community use
  • Semgrep – Similar semantic analysis for multiple languages using rule engine

Remediation Workflows

Structured processes for triaging, assigning, and resolving security findings. Includes priority management and automatic triage rules to streamline vulnerability management.

Availability: GitHub (Advanced Security), GitLab (Ultimate)

Open Source Tools:

  • OWASP Dependency-Track – Complete issue lifecycle management for dependencies
  • DefectDojo – Workflow management, triage, and remediation tracking
  • Jira/GitHub Issues integration – Custom workflows using open source integrations

Summary Table

Scan Type GitHub GitLab Open Source Tools
SAST Advanced Security Free+ SonarQube, Semgrep, GolangCI-Lint, ShiftLeft Scan, Bandit
DAST Third-party Ultimate OWASP ZAP, Nikto, Wapiti
Dependency Scanning Advanced Security Free+ OWASP Dependency-Check, Trivy, OSV-Scanner, Grype, npm audit
Container Scanning Third-party Ultimate Trivy, Grype, Clair, Anchore
Secret Detection Secret Protection Free+ TruffleHog, Gitleaks, Detect-secrets, Whispers
AI Secret Detection Advanced Security Ultimate TruffleHog, Detect-secrets
Dependency Review Advanced Security Ultimate OWASP Dependency-Check, Trivy
API Testing Third-party Ultimate OWASP ZAP, Kiterunner, Postman
API Fuzzing Third-party Ultimate Kiterunner, OWASP ZAP, AFL
API Discovery — Ultimate OpenAPI Tools, Postman
IaC Scanning Third-party Ultimate Checkov, KICS, TFLint, Trivy, Terrascan
KubeSec — Ultimate Kubesec, Kubewarden, Kubescape, Checkov
Code Quality Third-party Free+ SonarQube, CodeFactor, GolangCI-Lint
License Scanning Third-party Free+ OWASP Dependency-Check, Trivy, FOSSology, ScanCode
Custom Patterns Advanced Security Ultimate TruffleHog, Gitleaks, Semgrep, Detect-secrets
Dependabot All plans Premium+ Renovate, OWASP Dependency-Check
Push Protection Secret Protection Ultimate Gitleaks, pre-commit, Git hooks
Autofix Advanced Security Ultimate Semgrep, CodeQL, SonarQube
Security Campaigns Advanced Security Ultimate OWASP Dependency-Track, DefectDojo
Security Overview Advanced Security Free+ OWASP Dependency-Track, DefectDojo, Grafana
Compliance Frameworks Enterprise Ultimate Chef InSpec, OpenSCAP
MR/PR Widgets Advanced Security Free+ Semgrep, Checkov, SonarQube
Vulnerability Tracking Advanced Security Ultimate OWASP Dependency-Track, DefectDojo, Prometheus
SBOM Advanced Security Free+ Syft, Trivy, Microsoft SBOM Tool, OWASP Dependency-Check
CodeQL Advanced Security — CodeQL (open), Semgrep
Remediation Workflows Advanced Security Ultimate OWASP Dependency-Track, DefectDojo

Key Takeaways

GitHub’s Approach: Best-of-breed point solutions with optional add-ons. Emphasis on CodeQL’s semantic analysis and integration with GitHub Actions. Requires Advanced Security license for most features. Heavy reliance on third-party integrations for DAST, container, and IaC scanning.

GitLab’s Approach: Comprehensive all-in-one platform with most scanning integrated into higher tiers. Broad language and framework support through multiple analyzer approaches. More features available at lower tiers (Free+) compared to GitHub.

Open Source Advantage: A mature ecosystem of free tools provides enterprise-grade scanning across all categories:

  • SAST: SonarQube, Semgrep provide deep vulnerability detection
  • Container/Dependency: Trivy, Grype, OWASP Dependency-Check offer comprehensive coverage
  • Secret Detection: TruffleHog, Gitleaks provide fast, reliable scanning
  • IaC: Checkov, KICS deliver 1000+ to 2400+ security checks
  • Orchestration: OWASP Dependency-Track, DefectDojo centralize findings across tools

Cost Comparison:

  • GitHub + Advanced Security: $45+ per active committer/month
  • GitLab Ultimate: $99 per user/month
  • Open source stack: Free (self-hosted) or minimal cloud costs

Recommended Open Source Stack:

Code + Deps:    Semgrep + Trivy + OWASP Dependency-Check
Secrets:        Gitleaks + TruffleHog (validation)
IaC:            Checkov + KICS
Container:      Trivy + Grype
DAST:           OWASP ZAP
Orchestration:  OWASP Dependency-Track

Coverage Gaps:

  • GitHub lacks native DAST, container scanning, and IaC scanning (requires third-party or open source)
  • GitLab lacks CodeQL but compensates with multiple SAST approaches
  • Both proprietary platforms have superior integration, UI/UX, and remediation workflows
  • Open source tools excel at scanning but typically lack sophisticated reporting, triaging, and remediation workflows found in commercial platforms