← All integrations
GitLab
Developer
Check GitLab projects and groups for development security controls.
what it checks
GitLab checks in Varman
Connect GitLab to monitor repository security, branch and merge protection, group 2FA, and pipeline security scanning. Varman runs 4 checks against GitLab on a schedule and records each result as evidence.
2FA Enforcement
high severityVerify that every owned GitLab group enforces two-factor authentication
Branch Protection Enabled
high severityVerify that each project's default branch has protection rules configured
Merge Request Approvals Required
high severityVerify that each project requires at least one approval before merging
SAST / Dependency Scanning Enabled
medium severityVerify that each project configures SAST or dependency scanning in its .gitlab-ci.yml pipeline
how to connect
Connecting GitLab
An admin adds the details below in Varman under Integrations. Secret values are encrypted before they are stored.
- Personal Access Token
- GitLab > User Settings > Access Tokens. Needs scopes: read_api, read_user, read_repository.