[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for GitLab](../index.md) > [Step-by-step guides](index.md) > Integrating with SourceCraft Security

# Setting up Managed Service for GitLab integration with SourceCraft Security

[Integrating Managed Service for GitLab with SourceCraft Security](../concepts/sourcecraft-security.md) enables automatic scanning of code from the repositories of a [GitLab instance](../concepts/index.md#instance) for secrets and vulnerabilities in both dependencies and the code itself. Repositories are mirrored to SourceCraft. Checks are performed on mirrored repositories, and the [SourceCraft Security](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview) features are available for them in their entirety.

{% note warning %}

For integration, you need the paid _SourceCraft Security_ add-on. The cost is based on the [SourceCraft pricing policy](https://sourcecraft.dev/portal/docs/en/sourcecraft/pricing#security).

Repositories are created in the same [Yandex Cloud organization](../../organization/concepts/organization.md) where the GitLab instance is located. This organization may be different from the [personal organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#org) created automatically during your sign-up to SourceCraft. Make sure the add-on is enabled exactly for the organization the instance is in.

By enabling the integration, you confirm sending the source code to SourceCraft. All repositories of the GitLab instance are mirrored, regardless of their visibility settings. In SourceCraft, mirrored repositories are created as [private](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#repo-visibility).

{% endnote %}

## Enabling integration {#enable}

### Enable the SourceCraft Security add-on to for your organization {#enable-security}

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  1. Open the SourceCraft [home page](https://sourcecraft.dev).
  1. Navigate to the **Organizations** list and select the Yandex Cloud organization containing the GitLab instance.
  1. On the organization's page, under ![image](../../_assets/console-icons/shield-exclamation.svg) **Security**, open the ![image](../../_assets/console-icons/circles-4-square.svg) **Overview** section.
  1. Make sure the SourceCraft Security add-on is enabled. If a prompt to enable the **Security** add-on appears instead of scan results, enable it for the selected organization.

      If a trial period is available, click **Start free trial** and follow the instructions in the UI. If you do not have permission to connect the add-on, contact your organization's administrator.

{% endlist %}

### Enable integration in the GitLab instance settings {#enable-instance}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing your GitLab instance.
  1. [Navigate](https://console.yandex.cloud/link/managed-gitlab) to **Managed Service for GitLab**.
  1. Select your instance and click ![image](../../_assets/console-icons/pencil.svg) **Edit** in the top-right corner of the page.
  1. Under **SourceCraft integration**, enable **Enable SourceCraft integration**.
  1. Click **Save**.
  1. Wait for the instance update to complete: its status will switch from **Updating** to **Running**, and in the **Overview** section, the **SourceCraft integration** field will show **Enabled**.

{% endlist %}

{% note tip %}

You can also enable integration when creating the [GitLab instance](instance/instance-create.md#create). First, connect the SourceCraft Security add-on to the organization where the instance will be created.

{% endnote %}

### Wait for the repositories to be mirrored {#check-mirroring}

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  1. Open the organization for which you have enabled the SourceCraft Security add-on.
  1. Navigate to the organization's repository list and wait for the mirrored repositories of the GitLab instance to appear.

      Their names are derived from the path of the source repository, e.g., `test-group/test-subgroup/example-repo` is transformed into `test-group-test-subgroup-example-repo`. Learn more about [address transformation](../concepts/sourcecraft-security.md#repository-paths).

{% endlist %}

{% note info %}

Scans are triggered when commits are pushed to the default [branch](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#repos) of the GitLab source repository. Wait for the code to synchronize and the checks to complete, then [view the results](#results) in SourceCraft.

{% endnote %}

## Disabling integration {#disable}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing your GitLab instance.
  1. [Navigate](https://console.yandex.cloud/link/managed-gitlab) to **Managed Service for GitLab**.
  1. Select your instance and click ![image](../../_assets/console-icons/pencil.svg) **Edit** in the top-right corner of the page.
  1. Under **SourceCraft integration**, disable **Enable SourceCraft integration**.
  1. Click **Save**.
  1. Wait for the instance update to complete. Under **Overview**, the **SourceCraft integration** field will switch to **Disabled**.

{% endlist %}

## Viewing scan results {#results}

The results are available in the [SourceCraft vulnerability control center](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/security-dashboard). To grant developers access to them, [invite users to the organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/invite) and [assign roles](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/bind) for the relevant repositories or the organization.

### All repositories {#org}

Select the organization where the GitLab instance is located. Its vulnerability control center displays results for all repositories of this organization that are accessible to you.

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  To open the security dashboard for an [organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#org):
  1. Open the SourceCraft [home page](https://sourcecraft.dev).
  1. Go to the ![image](../../_assets/console-icons/briefcase.svg) **Organizations** tab and select an organization.
  1. Under ![image](../../_assets/console-icons/shield-exclamation.svg) **Security**, navigate to ![image](../../_assets/console-icons/circles-4-square.svg) **Overview**.
  
      The **Secret scanning alerts**, **Dependencies**, and **Code scanning alerts** dashboards provide the following statistics:
      * **Alert status**.
      * **Resolved alerts breakdown**.
      * **Alerts by severity level** (**Dependencies** and **Code scanning alerts** dashboards).
  
      To access detailed lists of issues of a specific type, click ![image](../../_assets/console-icons/arrow-up-right-from-square.svg) next to the dashboard header.
  
      This page also provides a full list of detected security issues with the following information:
      * Repository name.
      * Issue type.
      * Scanner that detected the problem.
      * Last scan time.
      * Warning data.

{% endlist %}

### Specific repository {#repo}

Select the mirrored SourceCraft repository matching the source GitLab repository.

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  To open the security dashboard for a [repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/#repos):
  1. Open the SourceCraft [home page](https://sourcecraft.dev).
  1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories** and select a repository.
  1. Under ![image](../../_assets/console-icons/shield-exclamation.svg) **Security** on the repository page, go to ![image](../../_assets/console-icons/circles-4-square.svg) **Overview**.
  
      The **Secret scanning alerts**, **Dependency scanning alerts**, and **Code analysis alerts** dashboards provide the following statistics:
      * **Alert status**.
      * **Resolved alerts breakdown**.
      * **Alerts by severity level** (**Dependency scanning alerts** and **Code analysis alerts** dashboards).
  
      To download SARIF (Static Analysis Results Interchange Format) or SBOM (Software Bill of Materials) files in SPDX format for audit or integration with external systems, click **Download SARIF** or **Download SBOM** on the dashboard.
  
      The security dashboard also shows the last scan time.

{% endlist %}

#### Useful links {#see-also}

* [Integrating Managed Service for GitLab with SourceCraft Security](../concepts/sourcecraft-security.md).
* [Scanning secrets](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/secret-scan).
* [Analyzing dependencies](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/supply-chain).
* [License policy as code](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/license-policy).
* [Static application security testing](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/sast).
* [AI-powered vulnerability analysis and prioritization](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/ca-triage).
* [Scan history](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/security-scan-history).
* [Setting up a custom security analyzer](https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/custom-security-analyzers).