Integration
Security scans for any GitLab, on any tier.
GitLab runs SAST and secret detection on every tier, but below Ultimate the results arrive as JSON report files. p4ndora reads gitlab.com and self-managed GitLab on any tier and turns your code into rated findings with their exact lines and fix proposals.
Facts checked 21 October 2026. By p4ndora research, Security research at p4ndora.ai. 5 min read.
The short answer
How do I security scan a GitLab repository without Ultimate?
Connect the project to p4ndora with a token that has read_api and read_repository scopes, then start a scan. It works on gitlab.com and self-managed GitLab on any tier, with unlimited scans on Continuous and full results instead of report files.
- Any tier, full results. Rated findings on Free and Premium, not only a JSON file to download.
- Unlimited scans. Every push checked on Continuous, for one price per repository, on any GitLab host.
- Fixes as merge requests. Review a fix and p4ndora opens a draft merge request through a separate token.
What one price includes
Unlimited scans. No usage limits. Any repository size.
Continuous, $499.50 a month per repository.
- Unlimited scans. Every push to your branch is checked against the last known state. No monthly quota.
- No usage limits. No test counts, no credits and no build minutes. The price stays the same however much you push.
- Any repository size. A side project and a large monorepo cost the same.
- Your whole team. No seats. Everyone who commits to the repository is covered.
- Automatic fixes. Fixes are drafted for you and opened as draft pull requests to review.
Or start with one scan for $149.50, paid once. New accounts get their first scan free.
How does p4ndora compare with GitLab's own security scans?
| p4ndora | GitLab | |
|---|---|---|
| Scans | Unlimited on Continuous, every push checked | Scanners that run as jobs in your GitLab CI |
| Who is counted | Nobody, the price is per repository | Every user, Premium $29 per user a month |
| On Free and Premium | Every finding rated and traced to its lines | SAST and secret detection with results as downloadable JSON reports |
| Findings and fixes in merge requests | Fixes drafted for you and opened as draft merge requests | Ultimate |
| Vulnerability report | Results and reports in p4ndora | Ultimate |
| Dependencies | Packages checked against published advisories, in the same report | Dependency scanning on Ultimate |
| Price | $499.50 a month per repository, or $149.50 for one scan | Ultimate on custom pricing |
| Other code hosts | GitHub too | GitLab only |
Facts about GitLab come from its public website, checked on 21 October 2026. Plans and features change, so check about.gitlab.com for the latest.
Which one should you choose?
Choose GitLab Ultimate if
- You already pay for Ultimate
- You want the vulnerability report inside GitLab
Choose p4ndora if
- You are on GitLab Free or Premium
- You want rated findings and fixes, not report files
- You want unlimited scans for one price per repository
- You do not want to pay per user
- Your GitLab runs on your own server
Does p4ndora work with self-managed GitLab?
Yes, on every plan. Enter the address of your GitLab server, connect a token and choose the projects. That is not a given with other tools. Snyk lists its GitLab integration for Enterprise plans only, and Semgrep lists self-managed repositories for its Enterprise plan.
How do I connect GitLab to p4ndora?
- Create an access token. In GitLab, create a token with the read_api and read_repository scopes and an expiry date.
- Connect it in p4ndora. Choose gitlab.com or enter the address of your own GitLab, then paste the token once.
- Choose the project and start. Pick the project and branch. The scan reads one pinned commit and changes nothing.
- Allow merge requests if you want them. To open fixes as draft merge requests, add a second token that may write. The read token never writes.
Questions
- Does GitLab include security scanning on the Free tier?
- GitLab runs SAST and secret detection on every tier. Below Ultimate the results are JSON report files. Findings in merge requests, the vulnerability report and dependency scanning are part of Ultimate.
- Does p4ndora work with self-managed GitLab?
- Yes, on every plan. Enter the address of your GitLab server and connect a token with the read_api and read_repository scopes.
- Does p4ndora limit scans or repository size?
- No. Continuous includes unlimited scans of its repository, with every push checked, and the price is the same for a small project or a large monorepo. There are no quotas, credits or seats.
- Can p4ndora open merge requests with fixes?
- Yes. After you confirm a fix, p4ndora opens a draft merge request on a new branch through a separate token that may write.
- Do I need to change my GitLab CI?
- No. The scan runs on p4ndora and reads the project through the token. Nothing is added to your CI configuration.
- Can I scan a GitLab project for free?
- Yes. New accounts can start with a free scan of one repository. Every finding is counted and rated, and the most serious one opens in full.
Audit your GitLab project today.
Connect one project with a read-only token and get every finding counted and rated. The first scan is free for new accounts.