[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for GitLab](../index.md) > [Concepts](index.md) > Integrating with SourceCraft Security

# Integrating Managed Service for GitLab with SourceCraft Security

Integrating with SourceCraft Security enables you to verify code security from a [Managed Service for GitLab instance](index.md#instance). Instance repositories are automatically mirrored to SourceCraft, which runs checks on them and displays the results.

Managed Service for GitLab instances support the full range of [SourceCraft Security](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview) features:

* [Secret scanning](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview#secret-scanning): Searching the commit history for API keys, tokens, passwords, and other sensitive data.
* [Software composition analysis (SCA)](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview#supply-chain): Detecting known vulnerabilities in third-party components and verifying their licenses.
* [Static application security testing (SAST)](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview#sast): Scanning code for vulnerabilities, errors, and security standard violations without running it.
* [AI-powered vulnerability analysis and prioritization](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview#ca-triage): Assessing risks and providing recommendations for fixing identified issues.
* [Scan history](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview#history) and [security dashboard](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/security-dashboard): Viewing scan runs and results for individual repositories and the entire organization.

{% note warning %}

For integration, you need the paid _SourceCraft Security_ add-on. The cost is based on the [SourceCraft pricing policy](https://sourcecraft.dev/portal/docs/en/sourcecraft/pricing#security).

Repositories are created in the same [Yandex Cloud organization](../../organization/concepts/organization.md) where the GitLab instance is located. This organization may be different from the [personal organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#org) created automatically during your sign-up to SourceCraft. Make sure the add-on is enabled exactly for the organization the instance is in.

By enabling the integration, you confirm sending the source code to SourceCraft. All repositories of the GitLab instance are mirrored, regardless of their visibility settings. In SourceCraft, mirrored repositories are created as [private](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#repo-visibility).

{% endnote %}

## How the integration works {#scanning}

After you enable the integration, SourceCraft Security creates private copies of the instance repositories in SourceCraft and keeps their code synchronized. New instance repositories are also synchronized with SourceCraft. Checks run in mirrored repositories in SourceCraft.

{% note info %}

The system runs scans when commits are pushed to the default [branch](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#repos) of the GitLab source repository. After the code is synchronized, you can view the results in the relevant SourceCraft repository and on the organization's security dashboard.

{% endnote %}

To grant developers access to mirrored repositories, [invite them to the SourceCraft organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/invite) and [assign roles](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/bind) for the relevant repositories or the organization.

## Names and addresses of mirrored repositories in SourceCraft {#repository-paths}

GitLab groups and projects differ from [SourceCraft projects](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#projects). When mirroring a repository, the GitLab repository path is converted into a SourceCraft repository name by concatenating the group name or username, subgroup name, and repository name with hyphens.

Address in GitLab:

```text
https://<instance_domain>/<group_or_user>/<subgroup>/<repository>
```

Mirrored repository address in SourceCraft:

```text
https://sourcecraft.dev/<organization_slug>/<group_or_user>-<subgroup>-<repository>
```

The subgroup is optional. If none exists, the relevant path segment is omitted. The _organization slug_ is the organization ID in SourceCraft addresses. You can find it in the [organization settings](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/org-edit).

> Here are some examples of converting GitLab instance repository addresses on the `example.gitlab.yandexcloud.net` domain in the organization with the `my-org` slug:
> 
> #|
> || GitLab | `https://example.gitlab.yandexcloud.net/test-group/test-subgroup/example-repo` ||
> || SourceCraft | `https://sourcecraft.dev/my-org/test-group-test-subgroup-example-repo` ||
> |#
> 
> #|
> || GitLab | `https://example.gitlab.yandexcloud.net/example-user/my-project` ||
> || SourceCraft | `https://sourcecraft.dev/my-org/example-user-my-project` ||
> |#
> 
> #|
> || GitLab | `https://example.gitlab.yandexcloud.net/test-group/test-project` ||
> || SourceCraft | `https://sourcecraft.dev/my-org/test-group-test-project` ||
> |#

#### Useful links {#see-also}

* [Setting up Managed Service for GitLab integration with SourceCraft Security](../operations/sourcecraft-security.md)
* [Security in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview)