# Gitlab

ZeroThreat integrates with GitLab CI/CD to help you automatically run security scans as part of your development pipeline. This ensures that vulnerabilities are detected early—before they make it to production.

This guide walks you through setting up ZeroThreat with GitLab using a basic example. You can follow this as-is or customize it later based on your team’s workflow.

### Prerequisites

Before getting started, make sure:

* Your target is **verified** in the ZeroThreat.
* You have access to a **GitLab project** with CI/CD enabled.
* You understand the basics of GitLab pipelines and `.gitlab-ci.yml` files.

#### Step 1. Start CI/CD Integration from ZeroThreat <a href="#step-1.-start-ci-cd-integration-from-zerothreat" id="step-1.-start-ci-cd-integration-from-zerothreat"></a>

1. Navigate to the **Targets** (<img src="https://zerothreat.gitbook.io/~gitbook/image?url=https%3A%2F%2F1825008717-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fs6Y7hKb1RwZWFZo4EnUm%252Fuploads%252F0X270eeGXthdFHVzgzpx%252Fimage.png%3Falt%3Dmedia%26token%3D2e41ec6f-cebf-46d4-9bf2-4e1e8bfb8447&#x26;width=41&#x26;dpr=4&#x26;quality=100&#x26;sign=429d3bef&#x26;sv=2" alt="" data-size="line">)section in ZeroThreat.
2. Click on the **"Continuous Integration"** button (<img src="https://zerothreat.gitbook.io/~gitbook/image?url=https%3A%2F%2F1825008717-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fs6Y7hKb1RwZWFZo4EnUm%252Fuploads%252Fj1t0hnjeafeAYcexwV69%252Fimage.png%3Falt%3Dmedia%26token%3D01dea620-8bb3-4b39-b820-e57cef02c3c8&#x26;width=41&#x26;dpr=4&#x26;quality=100&#x26;sign=d90aad3f&#x26;sv=2" alt="" data-size="line">) for your desired target.

<figure><img src="https://zerothreat.gitbook.io/~gitbook/image?url=https%3A%2F%2F1825008717-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fs6Y7hKb1RwZWFZo4EnUm%252Fuploads%252Fei7GisonjwCf1mmV7dXs%252Fimage.png%3Falt%3Dmedia%26token%3Dad932968-c70e-4c06-96f0-521a8567ec8b&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=ae08851f&#x26;sv=2" alt="" width="563"><figcaption></figcaption></figure>

3. In the CI/CD settings drawer, click Add **"GitLab CI/CD integration"** and confirm.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2Fy20Sk421YThNhzOHuR9n%2Fimage.png?alt=media&#x26;token=6cad1f87-25b8-4bf6-aff1-9fa863433de5" alt="" width="563"><figcaption></figcaption></figure>

Once confirmed, a unique **ZT\_Token** will be generated. This token is used to start scans CI/CD for its associated target from the Ci/CD.

#### Step 2: Choose Scan Settings <a href="#step-2-choose-scan-settings" id="step-2-choose-scan-settings"></a>

1. Select or create a **Scan Profile** suitable for your environment.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FBhZ1M61Y3FtNe4MC1E38%2Fimage.png?alt=media&#x26;token=6620625d-a98e-4c07-8a68-31eea9beef8e" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="warning" %}
A scan profile is required for API scans in CI/CD integration. Without it, the integration pipeline cannot start the scan.
{% endhint %}

2. If you're scanning authenticated sections of your app, select the appropriate **Login Template** for authenticated scans.

{% hint style="success" %}
Make sure to select a working Login template for Authenticated Scan.
{% endhint %}

#### Step 3: Visit the GitLab CI/CD Catalog

Click the **GitLab CI/CD icon** in ZeroThreat. This will take you to the [**GitLab CI/CD Catalog**](https://gitlab.com/explore/catalog) page, where you can find the [**ZeroThreat integration**](https://gitlab.com/explore/catalog/zerothreatai/gitlab-ci-component) details and required configuratio&#x6E;**.**

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FGpPkg2fTP3NV9jg8DiJ7%2Fimage.png?alt=media&#x26;token=cfa9ba14-e99e-48de-9bd6-3d4f25d12c11" alt="" width="563"><figcaption></figcaption></figure>

#### Step 4: Open Your GitLab Project and Start Editing

1. Go to your GitLab repository.
2. In the left sidebar, click **“Build” → “Jobs”** to view previous pipeline jobs (if any).
3. Then click on **“Pipeline Editor”** to open the `.gitlab-ci.yml` configuration file.

This is the file where you’ll define how your pipeline runs, and where you’ll add ZeroThreat’s configuration.

***

#### Step 5: Configure Your Pipeline

In the `.gitlab-ci.yml` file:

1. Add a new stage named `ZeroThreat AI Security Scan` .
2. Insert the ZeroThreat job configuration provided on the GitLab CI/CD Catalog page.

Here's a simplified example:

```yaml
stages:
  - build
  - test
  - deploy
  - ZeroThreat AI Security Scan

[SNIP]

include:
    - component: $CI_SERVER_FQDN/zerothreatai/gitlab-ci-component/scanner@0.0.3
      inputs:
        ZT_TOKEN: $ZT_TOKEN
        WAIT_FOR_ANALYSIS: false
```

{% hint style="info" %}
Always use the **latest version** of the `zerothreatai/gitlab-ci-component`. \
In the example above, replace `@0.0.3` with the latest available version.
{% endhint %}

#### Step 6: Set ZT\_TOKEN as a CI/CD Variable

It is advised to not **hardcode tokens** directly in your config files. Instead, store your ZeroThreat token securely as a GitLab CI/CD variable:

1. Save your pipeline changes.
2. Go to **Settings → CI/CD → Variables** in your GitLab project.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FLGh8liioQ2LaSjl8pV1V%2Fimage.png?alt=media&#x26;token=3b77b590-d3f7-43aa-82ae-b17c8cb54238" alt="" width="563"><figcaption></figcaption></figure>

3. Click **“Add Variable”**.
4.  Set:

    * **Key:** `ZT_TOKEN`
    * **Value:** _(paste the token from ZeroThreat)_



    <figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2Fy20Sk421YThNhzOHuR9n%2Fimage.png?alt=media&#x26;token=6cad1f87-25b8-4bf6-aff1-9fa863433de5" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Use GitLab CI/CD Variables to safely store secrets like `ZT_TOKEN`. This prevents sensitive data from being exposed in your version control.
{% endhint %}

***

#### Step 7: Run the Pipeline

Once everything is saved and committed:

1. Go and start or rerun the pipeline.
2. When it reaches the `ZeroThreat AI Security Scan` stage, ZeroThreat will start the scan.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FYmFJnmSER0cktGj5AbAD%2Fimage.png?alt=media&#x26;token=6daa4b57-9a29-49c5-8d50-f6775e05a8e4" alt="" width="563"><figcaption></figcaption></figure>

The Job will begin and a scan will be triggered in ZeroThreat portal.

### Flexible Automation Options

This example uses a basic manual setup, but you can customize it further. GitLab allows you to trigger pipelines on:

* **Code pushes**
* **Merge requests**
* **Scheduled jobs (cron)**
* **Tags or custom conditions**

This gives your team full control over how and when ZeroThreat scans are triggered—making it easy to fit security testing into your existing development process.

***

Finished setting up your CI/CD integration?&#x20;

Head over to our guide on [**Reviewing Scan Reports**](https://zerothreat.gitbook.io/docs-zerothreat/manage-scans/scan-report) to learn and analyze different sections of the scan report.
