Overview
The GitLab integration monitors your projects, branch protection rules, group membership, and security configurations. LowerPlane uses read-only API access and does not access source code contents.Authentication
GitLab uses OAuth 2.0 for authentication. When you connect, you’ll be redirected to GitLab to authorize LowerPlane.Required Permissions (OAuth Scopes)
| Scope | What It Grants | Why LowerPlane Needs It |
|---|---|---|
read_api | Read access to the API | Read project metadata, branch protection rules, merge request settings, group members, and pipeline configuration |
read_user | Read user profile | Identify the connecting user and read member profiles for access reviews |
The
read_repository scope is intentionally excluded. LowerPlane does not access code contents, commits, or file trees. The read_api scope provides all the metadata needed for compliance checks.What LowerPlane Collects
Project Metadata
Name, visibility, default branch, CI config path, open merge request count, member count
Branch Protection
Push restrictions, required merge request approvals, force push settings
Group Members
Member list with MFA/2FA status for access reviews
Vulnerability Scanning
SAST pipeline configuration status and vulnerability report presence
Security Tests
LowerPlane runs 9 automated tests against your GitLab instance:| Test | Severity | Applies To |
|---|---|---|
| Code repo should be classified | Critical | Each project |
| GitLab group level MFA should be enforced | Critical | Each group |
| GitLab user should have MFA enabled | Critical | Each member |
| GitLab vulnerability scan should be enabled | Medium | Each project |
| Code changes should be reviewed by peers before merging | High | Each project |
| Merging of code changes should require passing status-checks | High | Each project |
| Branch Protection rules should be enforced | High | Each project |
| Stale merge request approvals should be reset on new commits | Medium | Each project |
| GitLab access should be removed for offboarded user | Critical | Each member |
The MFA tests require the integration token to belong to a group owner. Maintainer-level tokens cannot read other users’ 2FA state and will report all users as MFA-disabled.
Connecting
Navigate to Integrations
Go to Settings > Integrations and find GitLab in the Developer Tools category.
Authorize
Review the requested permissions and click Authorize. Use an account with group owner access.
Self-Hosted GitLab
For self-hosted GitLab instances, provide your instance URL (e.g.,https://gitlab.yourcompany.com) during setup. LowerPlane will use your instance’s OAuth endpoints instead of gitlab.com.
Merge Request Reviews & Pipeline Status
LowerPlane collects approver names on merge requests and pipeline status results to verify that peer review and CI/CD gates are enforced before merging. This data is used by the “Code changes should be reviewed by peers” and “Merging should require passing status-checks” tests.Data Access
| Data Type | Access |
|---|---|
| Project metadata | Read |
| Branch protection rules | Read |
| Merge request reviews & approvers | Read |
| Pipeline status checks | Read |
| Group members | Read |
| Member MFA status | Read (requires owner PAT) |
| Source code / file contents | No access |
| Commit history / diffs | No access |
| Issues / discussions | No access |