GitLab Advanced SAST is an Ultimate tier analyzer that follows untrusted input from where it enters your code to where it is used, across functions and files. Because it reports a finding only when it can verify that flow, it aims for fewer false positives than pattern matching alone.
Taint analysis in plain words
Taint analysis marks data from an untrusted place, such as a request parameter, as a source. It then tracks that data through the program until it reaches a sink, such as a database query or a shell command. If the data arrives unchecked, that is a likely injection flaw.
Pattern matching can spot a dangerous function call. Taint analysis asks a better question: does attacker controlled data actually get there? When the source and sink live in different files, a single file scanner misses the link. Cross-file and cross-function analysis closes that gap.
What GitLab documents
The GitLab page describes Advanced SAST as using cross-function and cross-file taint analysis. For SQL injection, command injection, cross-site scripting and path traversal, the vulnerability details include a code flow view that lists each step and file. That view is useful in review because a developer can see the route and not only the final line.
It became generally available in GitLab 17.3. Generally available languages listed are C#, C and C++, Go, Java including JSP, JavaScript and TypeScript, PHP, Python and Ruby. Dart, Kotlin, Objective-C, Rust, Scala and Swift are listed as beta.
How to turn it on
- Make sure you have the Maintainer or Owner role and the standard SAST analyzer is on.
- In the pipeline editor, add the variable
GITLAB_ADVANCED_SAST_ENABLEDset to'true'to your CI file. C and C++ use a separate variable. - Validate the pipeline and merge the change through a merge request.
Limits to plan for
| Limit | What it means |
|---|---|
| C and C++ | Needs extra setup, including a compilation database |
| PHP | Variable paths in include or require are not followed across files |
| Parity | Advanced SAST and the Semgrep analyzer each find things the other does not |
| Speed | Deeper analysis needs more compute and usually takes longer |
| Diff based scans | Merge request scans can miss issues or resurface fixed ones; a full scan runs after merge |
Treat the first rollout as a measurement. Compare findings against what your current scanner reports and keep notes on what each tool adds.
When it helps most
Cross-file analysis pays off in layered applications where a controller passes input to a service, which passes it to a data layer. It matters less for small single file scripts. If most of your risk sits in dependencies and not in your own code, SAST of either kind will not address it, and you will want dependency scanning alongside.
Where a dedicated scanner fits
A separate platform is useful if your code sits on more than one host, or you want reachability analysis on dependencies as well as code findings. Safeguard offers SBOM and dependency scanning with reachability analysis, plus a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a finding and look for the file and line, then ask whether you could trace the input back to its source.
Quick check
Is Advanced SAST available on the Free tier?
No. The GitLab documentation lists it as Ultimate tier only.
Does cross-file analysis remove all false positives?
No. It aims to reduce them by verifying flows, but unverified findings are in beta and can raise false positives.
Sources
Last reviewed: 19 October 2026.
