GitLab Security Review Flow detects authorization flaws in code diffs
GitLab's AI-powered code review tool identifies broken object and function level authorization, business logic errors, and other vulnerabilities before merge, now in public beta.
Disclaimer
This article was produced by Scroll Insights News Desk using automated systems and published under our standing editorial policy. It is compiled from the primary sources linked above and is provided for general information only — it is not legal, financial, investment, tax or professional advice, and no decision should be taken on it without independent verification against those sources. Errors can be reported to corrections@scrollinsights.com and are corrected on the record.
GitLab Security Review Flow analyzes code diffs to detect broken object level authorization, function level authorization, business logic errors, race conditions in stateful workflows, missing authorization on state-changing operations, mass assignment vulnerabilities, and information disclosure.
Broken object level authorization has topped the OWASP API Security Top 10 since 2019, making detection of this class of flaw a priority for code review. Security Review Flow analyzes code diffs in context including original files, changed lines, merge request discussion, and related code to surface these flaws. Findings include a vulnerability type and CWE reference.
How Security Review Flow classifies issues
Security Review Flow assigns findings to three tiers: Tier 1 for exploitable vulnerabilities, Tier 2 for logic flaws, and Tier 3 for design issues. Each finding carries a severity level of critical, high, medium, or low. Critical or high severity findings set the reviewer state to request changes; medium or low severity findings result in comment status. An independent validation pass filters out likely false positives.
Security Review Flow never approves code, even when it finds no issues. On public projects, findings are confined to internal notes to avoid exposing security details. When available, the tool provides a suggested fix for detected vulnerabilities.
Availability and cost
Security Review Flow is available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated to GitLab Ultimate customers. GitLab Ultimate subscribers can use Security Review Flow with GitLab Credits included with their subscription. The tool is also available through a free trial of GitLab Duo Agent Platform.
Security Review Flow cost varies with the complexity of the diff and the model selected. Security Review Flow entered public beta as of July 2026.