Skip to main content
Menu
On this page
ISSUE-601CriticalSecurity Source

Missing security policy source on project

Control: Project must have a security policy source· Config key: projectMustHaveSecurityPolicySource

📋 What is this?

The project does not directly link the expected GitLab security policy project: either none is linked, or the linked one differs from the configured expectation. The check looks at the project's own link only, so a security policy source inherited from a parent group is not detected.

⚠️ Impact

Without a security policy source, your project may drift from your policy and become vulnerable to risks. For example, if your project lacks a defined security policy source, critical checks might not be enforced.

🔧 How to fix

Link the expected security policy project in Settings > Security & Compliance > Policies (or set it through the API) so its required checks are enforced. If your policies are enforced on a parent group and inherited, this project-scoped check will not see them: link at the project level too, or turn the control off.

✗ BeforeNo security policy project is linked to this GitLab project.
# GitLab project settings - ❌ No security policy source
# Secure > Security configuration > Security policy project:
#   (none)
#
# The project has no linked security policy project, meaning
# no security policies are enforced on this project.
✓ AfterThe project is linked to the organization's security policy source.
my-org/security-policies
# GitLab project settings: ✅ Security policy source configured
# Secure > Security configuration > Security policy project:
#
# The project is now linked to the organization's security
# policy repository, ensuring all security policies are enforced.

💡 Tips

  • Create a dedicated security policy project in your organization to centralize all security policies.
  • A policy source inherited from a parent group does not satisfy this control: the project must carry its own link.
  • GitLab security policies require the Ultimate tier.
  • The control ships disabled: enable projectMustHaveSecurityPolicySource in .plumber.yaml and set the expected policy project.

⚙️ Configuration

This control is configured in .plumber.yaml under the gitlab section:

gitlab:
  controls:
    projectMustHaveSecurityPolicySource:
      enabled: true

See the CLI documentation for the full configuration reference. On Plumber Platform, the same key is used in your policy configuration.