Sure, if you dig into the SAST Dockerfile you'll see that it's running `bandit` if you're in a Python repo. So add this step to your .gitlab-ci.yaml: bandit-

Sure, if you dig into the SAST Dockerfile you'll see that it's running `bandit` if you're in a Python repo. So add this step to your .gitlab-ci.yaml: bandit-check: # This check runs Openstack Bandit, a Python static analysis tool that checks for security issues. stage: unit-test script: - bandit -r -x 'tests,test_,/migrations/,./src/' -c bandit-config.yaml -ll ." DAST uses ZAP, which you can also run in a Dockerfile yourself. Of course there's also some window dressing to display the errors on the main MR, instead of having to dig into a step failure, but that doesn't make a meaningful difference to me. (This feature could well have moved on since it was first implemented, that was the only time I dug into it).