Skip to main content
Menu
On this page
ISSUE-601CriticalSecurity Source

Missing security policy source on project

Control:CTRL-601Project must have a security policy source

📋 What is this?

The project does not directly link the expected GitLab security policy project: either none is linked, or the linked one differs from the configured expectation. The check looks at the project's own link only, so a security policy source inherited from a parent group is not detected.

⚠️ Impact

Without a security policy source, your project may drift from your policy and become vulnerable to risks. For example, if your project lacks a defined security policy source, critical checks might not be enforced.

🔧 How to fix

Link the expected security policy project in Settings > Security & Compliance > Policies (or set it through the API) so its required checks are enforced. If your policies are enforced on a parent group and inherited, this project-scoped check will not see them: link at the project level too, or turn the control off.

✗ BeforeNo security policy project is linked to this GitLab project.
# GitLab project settings - ❌ No security policy source
# Secure > Security configuration > Security policy project:
#   (none)
#
# The project has no linked security policy project, meaning
# no security policies are enforced on this project.
✓ AfterThe project is linked to the organization's security policy source.
my-org/security-policies
# GitLab project settings: ✅ Security policy source configured
# Secure > Security configuration > Security policy project:
#
# The project is now linked to the organization's security
# policy repository, ensuring all security policies are enforced.

💡 Tips

  • Create a dedicated security policy project in your organization to centralize all security policies.
  • A policy source inherited from a parent group does not satisfy this control: the project must carry its own link.
  • GitLab security policies require the Ultimate tier.
  • The control ships disabled: enable it and set the expected policy project in the control's configuration.

⚙️ Configure this control

On the Plumber Platform: open the Policies page and set control CTRL-601 on the policy that governs the project.

With the CLI alone: set it in your configuration file. Every field and default is in the controls configuration reference, CTRL-601.