VK has published a detailed overview of Security Gate, its internal AppSec platform that unifies static analysis, dependency checking and secret detection for developers.
The platform performs SAST using signature rules and inter-file taint analysis to detect SQL injections, XSS, RCE and missing sanitizers across supported languages such as Python, TypeScript, Go, Java, Rust and Swift.
For open-source components, SCA services evaluate reachability of vulnerable methods, distinguish dev versus prod dependencies and search for protestware and malware using proprietary feeds. A dedicated SG Malware Protector module continuously monitors new threats and updates the corporate artifact repository blacklist.
Fast Scanner automatically attaches to GitLab merge requests, performs rapid checks and posts results directly in comments, allowing teams to remediate issues before code reaches default branches.
Security Gate applies multiple layers of prioritization: statistical rule tuning, dynamic lowering of severity for test and mock code, and a custom CVE calculator that weighs exploit availability, automation potential and code reachability. Secrets receive additional VK Triage LLM processing that rejects obvious false positives with an F1 score of 0.981 on internal benchmarks.
The interface provides project dashboards, data-flow visualization, Jira integration, cross-branch verdicts and exportable XLSX, CSV and SBOM reports. Projects are discovered automatically from corporate GitLab, with scans triggered on changes or every 30 days for unchanged repositories.
