Security Review Pipeline

Inspiration

Security reviews are one of the biggest bottlenecks in software delivery. Teams either slow down every merge request with manual checks, or skip them entirely and hope SAST catches everything. But static analysis can't catch logic flaws, missing auth checks, or insecure patterns — that requires a human who understands both the code and the security implications. I wanted to build a digital teammate that fills that gap on every MR.

What it does

The Security Review Pipeline is a 3-agent orchestrated flow on GitLab Duo Agent Platform:

1. Triage Agent — Quickly classifies whether an MR/issue is security-relevant by checking labels, keywords, and changed file paths. Non-security work gets skipped, saving compute.
2. Analyzer Agent — Deep-dives into diffs, reads full files, and searches for patterns like hardcoded secrets, injection vulnerabilities, missing auth checks, and insecure crypto.
3. Remediation Advisor — Posts a structured Markdown comment with severity levels, specific file references, concrete fix suggestions, OWASP links, and applies labels automatically.

It also includes a standalone agent for interactive security questions in Duo Chat.

How we built it

I used GitLab Duo Agent Platform's custom flows (YAML-defined multi-agent pipelines) and custom agents. The flow chains three specialized agents via routers, each with its own toolset and system prompt. The agents use GitLab-native tools like list_merge_request_diffs, read_file, gitlab_blob_search, create_merge_request_note, and update_merge_request. Everything runs on Anthropic Claude via the GitLab AI Gateway with Sandbox Runtime (SRT) for network isolation.

Challenges I faced

• Schema validation: The AI Catalog Sync CI component has strict validation. I had to learn that agents/ and flows/ directories use different schemas, and that tool names like blob_search are actually gitlab_blob_search in the allowed enum.
• Multi-agent orchestration: Getting three agents to hand off context sequentially required careful prompt engineering so each agent produces output the next one can act on.
• Balancing depth vs. speed: The triage agent needed to be fast and lightweight while the analyzer needed to be thorough — finding the right toolset and timeout for each was key.

What we learned

• GitLab Duo Agent Platform is powerful for building autonomous workflows beyond just code generation
• Multi-agent flows are most effective when each agent has a clearly scoped role with minimal overlap
• The triage pattern (cheap classification before expensive analysis) is a practical sustainability strategy

What's next

• Conditional routing to skip analysis entirely on non-security MRs
• Integration with GitLab SAST/DAST scan results for richer context
• A feedback loop where developers can disagree with findings to improve future reviews

Built With

• anthropic-claude
• gitlab-ai-gateway
• gitlab-duo-agent-platform
• yaml