GitLab Security Node – security checks on every push
Automatically check your source code, dependencies and containers for vulnerabilities on every push. The results appear directly in your GitLab: in the pipeline, in the merge request and in the security area of your projects.
Plans from Basic – on request
- Your own scan serveronly for your projects
- No changes to GitLaboutgoing connections only
- Your code stays with youservers in Germany
- Always up to datedatabases every 6 hours
How the Security Node works
The Security Node is a dedicated server just for you. It runs a GitLab Runner and the security scanners as short-lived containers. We take care of setup, updates of the scanners and their vulnerability databases, and operation.
Your own scan server
includedYour projects are never processed together with other customers' projects. The scanners run in a fresh, short-lived container for every job.
No changes to your GitLab server
includedNothing is installed on your GitLab server. The node registers as a runner and establishes all connections outbound – no inbound ports are required.
Your code stays with you
includedYour source code never leaves your GitLab and the Security Node. The Security Node is located in our data centres in Germany.
Results in GitLab
includedReports appear directly in pipelines and merge requests. Thresholds let you define the severity at which a pipeline fails.
Up-to-date vulnerability databases
includedThe scanners' databases are updated every six hours, and we keep the scanners themselves up to date with tested versions.
Easy integration
includedYou include the checks via a CI template maintained by us. A few lines in your .gitlab-ci.yml are enough, and your own pipelines remain unchanged.
What is checked?
Code analysis (SAST)
all plansYour source code is examined for typical vulnerabilities on every push, for example insecure input handling or flawed cryptography. A wide range of programming languages is supported.
Secret detection
all plansAccidentally committed passwords, API keys and tokens are detected – including in your repository's history. Secrets found are only shown masked.
Dependencies & containers
from ProfessionalDependencies, container images and infrastructure configurations are checked for known vulnerabilities and misconfigurations. On request we generate a software bill of materials (SBOM).
Dynamic testing (DAST)
EnterpriseYour running test and staging environments are examined for vulnerabilities from the outside. To protect your production systems, only approved test targets are checked.
Which plan suits you?
Basic
on requestCode analysis (SAST) and secret detection – the entry into secure development processes.
Professional
on requestIn addition dependencies, containers, infrastructure configuration and external vulnerability scanning.
Enterprise
on requestIn addition dynamic testing (DAST) of your test environments.
For GitLab servers from LCube and your own GitLab
The Security Node can be connected to our managed GitLab servers as well as to your own GitLab instance (GitLab Omnibus version 17 or later). Optionally, the results can also be passed on to our security platform SOCANIX.
Why LCube – Professional Hosting?
We run GitLab servers for teams of every size and know the requirements of secure development processes.
ISO/IEC 27001 certified
LCube itself is certified to ISO/IEC 27001. Information security is an audited standard in our own processes – not just in the data centre. More about our certification
Made in Germany
Our team works in Germany and your data is stored in German data centres. Operation is GDPR compliant.
Personal support
You talk directly to experienced specialists who know your system and personally take care of your request.
Since 1995
More than 30 years of hosting experience – and for many years specialised in source code hosting and development environments.
Custom solutions
Whether a single GitLab server, a cluster or a special setup with VPN connection to your company network: we design the environment that fits your requirements.
Our own cloud platform
With the Virtuozzo Enterprise Cloud (VEP) we run our own cloud platform made in Germany – for highly available and business-critical workloads.
Frequently asked questions about the GitLab Security Node
Is any software installed on my GitLab server?
No, no software is installed on your GitLab server. The Security Node registers as a runner with your GitLab and establishes all connections outbound – no inbound ports are needed. Your GitLab server therefore remains unchanged. The Security Node runs a GitLab Runner and the security scanners as short-lived containers. We take care of setup, updates of the scanners and their vulnerability databases, and operation for you.
Does my source code leave my environment?
No. Your source code never leaves your GitLab and your own Security Node – and both are located in Germany. The Security Node is a dedicated server just for you: your projects are never processed together with other customers' projects, and the scanners run in a fresh, short-lived container for every job. Secrets found, such as passwords or API keys, are only shown masked in the reports.
Does the Security Node work with my own GitLab?
Yes, the Security Node works with your own GitLab instance from GitLab Omnibus version 17 – as well as with our managed GitLab servers. Because the node registers as a runner and only establishes outbound connections, you do not need to change anything on your GitLab. Optionally, the results can also be passed on to our security platform SOCANIX. We are happy to check the requirements together with you.
How do I integrate the checks?
You integrate the checks via a CI template maintained by us: a few lines in your .gitlab-ci.yml are enough, and your own pipelines remain unchanged. The results then appear directly in pipelines, merge requests and the security area of your projects. Thresholds let you define the severity at which a pipeline fails. We keep the scanners themselves up to date with tested versions for you.
Can the tests affect my production systems?
No, your production systems are not tested: dynamic testing (DAST) only examines approved test targets, i.e. your test and staging environments. These running environments are tested for vulnerabilities from the outside, while your production systems are left out. This lets you detect security gaps before an application goes live – without any risk to ongoing operation. DAST is included in the Enterprise plan. Request without obligation
Interested in the GitLab Security Node?
Our specialists will be happy to advise you on which plan suits your project.