Skip to content

GitLab configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On GitLab, Black Cat runs 10 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the GitLab connector needs.

Checks (10)

severity: medium Group No IP Restriction fix difficulty: medium #

Add IP address restrictions to the GitLab group to limit access to organization networks

  1. Navigate to Group > Settings > General > Permissions
  2. Expand IP address restriction section
  3. Add your organization's IP ranges in CIDR notation
  4. Save changes
  5. Verify access works from allowed IPs

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Project Container Scanning Disabled fix difficulty: medium #

Enable container scanning in the GitLab CI/CD pipeline for the project

  1. Add the Container-Scanning.gitlab-ci.yml template to your CI/CD pipeline
  2. Enable 'Pipelines must succeed' in merge request settings
  3. Review container scanning results in the Security Dashboard

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Project Discussions Not Required fix difficulty: easy #

Require all merge request discussions to be resolved before merging in GitLab

  1. Navigate to Project > Settings > Merge Requests
  2. Enable All discussions must be resolved
  3. Save changes
  4. Inform team about the new review requirement

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Shared Runner Not Locked fix difficulty: medium #

Disable shared runners on sensitive GitLab projects and use project-specific runners instead

  1. Navigate to GitLab Project Settings > CI/CD > Runners
  2. Disable shared runners for sensitive projects
  3. Configure group-specific or project-specific runners instead

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Active Runner Offline fix difficulty: hard #

Investigate and restore offline GitLab runners by checking connectivity and runner service status

  1. Check the runner host for connectivity issues
  2. Verify the GitLab Runner service is running
  3. Check runner logs for errors
  4. Restart the runner service if needed
  5. Contact infrastructure team if persistent

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Integration Insecure URL fix difficulty: easy #

Update GitLab integration webhook URLs to use HTTPS and enable SSL verification

  1. Navigate to the project's integration settings
  2. Update the webhook URL to use HTTPS
  3. Enable SSL verification in the integration settings
  4. Test the integration to ensure it still works

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low No Compliance Framework fix difficulty: easy #

Assign a compliance framework to the GitLab project to enforce governance pipelines

  1. Navigate to GitLab Project Settings > General > Compliance framework
  2. Assign an appropriate compliance framework to the project
  3. Ensure the framework has a compliance pipeline configured

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Project Pipeline Not Required fix difficulty: easy #

Require CI pipelines to succeed before merge requests can be merged

  1. Navigate to Project > Settings > Merge Requests
  2. Enable "Pipelines must succeed"
  3. Save changes
  4. Ensure the project has a working CI pipeline configured

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Runner Not Locked to Project fix difficulty: easy #

Lock group or project runners to prevent unauthorized use across projects

  1. Navigate to the runner's settings page
  2. Enable "Lock to current projects" to restrict usage
  3. Save changes
  4. Verify the runner only accepts jobs from intended projects

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Project Shared Runners Enabled fix difficulty: medium #

Disable shared runners on projects that should use dedicated runners

  1. Navigate to Project > Settings > CI/CD > Runners
  2. Disable "Enable shared runners for this project"
  3. Configure group-specific or project-specific runners instead
  4. Verify CI pipelines continue to function with the new runner configuration

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More GitLab checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial