Inspiration
Engineering teams spend 30-40% of their time on manual code reviews and security triage, leading to significant bottlenecks in the CI/CD pipeline. Traditional SAST tools exacerbate this by inundating developers with false positives and unverified alerts, leading to alert fatigue. We were inspired to build GitLab Security Guardian to solve this "Security-Triage Tax"—moving from reactive human review to a proactive, mathematical consensus-driven, and autonomous remediation pipeline.
What it does
GitLab Security Guardian acts as a Senior Security Engineer integrated directly into GitLab. It monitors Merge Request (MR) events, performs deep-code analysis, and autonomously generates remediation branches if security vulnerabilities (such as hardcoded secrets, SQL injection, Command injection, or insecure library usage) are detected. Key features include: Gemini 2.5 Model Ensemble: Launches concurrent agents with diverse logical orientations (from high-precision syntax checking to creative logic path analysis). Mathematical Consensus Engine: Duplicates, aggregates, and scores findings across the ensemble. Vulnerabilities reaching a 30% consensus score trigger automatic remediation. Auto-Patching & Line-Shift Safeguards: Generates clean, AST-validated conflict-marker patches applied in descending line order to prevent code corruption. Dev Console Portal: A sleek, dark-mode developer console to track active scans, review telemetry, and approve & commit patches back to GitLab with one-click.
How we built it
Full-Stack Architecture: The visual dashboard console is built on Node.js, Express, EJS, and Tailwind CSS v4, backed by a state-synchronized SQLite database and AES-256 encrypted configuration storage. Python Security Runner: The core analysis logic is built on Python 3.10, deploying the Google Vertex AI GenAI SDK to interact with the models. Model Context Protocol (MCP): The runner exposes standard SSE/Stdio MCP interfaces, allowing the dashboard and external workflows to trigger, poll, and retrieve scans. Deployment Platform: Decoupled and containerized via optimized Dockerfiles, then deployed to Google Cloud Run with IAM-isolated Vertex AI user permissions.
Challenges we ran into
Line-Shift Corruption: When applying multiple code fixes in a single file, modifying lines from top-to-bottom shifts the target indices of lower lines, breaking subsequent patches. We solved this by sorting all file remediations in descending order (highest line number to lowest) before patching. Safe Environment Variables: Running containerized applications on Cloud Run means deployments can wipe existing variables. We built a dynamic setup in deploy_cloud_run.sh to retrieve URLs and map keys automatically. Safety Over-blocking: Ast/syntax checks and forbidden keyword validation (e.g., catching eval( or exec() would block patches for files where these patterns were already pre-existing. We built a validation bypass logic that compares the patch with the original code block to ensure we only block newly introduced insecurities.
Accomplishments that we're proud of
We built a "Zero-Touch" DevSecOps workflow that detects a vulnerability, executes a model ensemble, mathematically dedupes findings, and pushes a validated code patch back to a GitLab branch in under 60 seconds, drastically reducing MTTR (Mean Time to Remediation). Created a highly resilient frontend polling system that stores scan states inside localStorage, ensuring UI animations and polling routines survive page refreshes during active audits.
What we learned
Agentic Ensemble Design: We learned how to move from simple single-prompt responses to concurrent multi-model loops. Mixing Pro (logical/deep) and Flash (precise/creative) configurations yields far superior results than a single model ever could. Defensive Git Hooking: We discovered the importance of loop-prevention, implementing custom commit message hooks containing [skip ci] to stop recursive pipeline triggers. Structured Schema Control: Utilizing Vertex AI structured outputs with Pydantic class validation is essential for guaranteeing database schema mapping integrity.
What's next for GuardianAgent: Autonomous GitLab Security Orchestrator
Compliance-as-a-Service: Automatically mapping code findings and remediation patches to regulatory compliance frameworks like SOC2, HIPAA, or ISO 27001. Multi-Git Provider Hub: Expanding hooks and API mappings to support GitHub and Bitbucket natively under a single unified dashboard. Infrastructure-as-Code (IaC) Audits: Scanning Terraform, Ansible, and Kubernetes manifests alongside project source code to remediate cloud misconfigurations before deployment.
Log in or sign up for Devpost to join the conversation.