Skip to main content
The GitLab issues card sends findings to GitLab as confidential issues and updates those issues when a finding status changes. It does not read or write repository code, and it does not open merge requests. Source code access is the GitHub integration. GitLab issues belong to a project, so you pick a project during setup. The project path in the list is only the place where new issues are created.

​
Use a Guest user

GitLab has no permission that covers issues alone. The connection uses the api scope, which can also reach repositories when the GitLab user is allowed to. Connect with a separate user that has the Guest role on a private project. A Guest can create issues, comment, and close the issues it created. A Guest cannot read the code of a private project.

​
Keep the project private

  • On a public project, a Guest can still read the code. Use a private project.
  • On a self-hosted server, a Guest can also read internal projects. Use a private project there too.
  • Do not use the Planner or Reporter role. Those roles can read private code.

​
Connect GitLab.com

1

Create a bot user

Sign up for a second free GitLab.com account, for example noscope-bot. Skip creating a group or a project for that account.
2

Invite the bot as Guest

In the private project, open Manage, then Members, and invite the bot with the Guest role. Repeat this for every project that should receive issues.
3

Connect from NoScope

Open Integrations and click Connect on the GitLab issues card. Stay signed in to GitLab as the bot and approve the Noscope application. You do not create an OAuth application for GitLab.com.
4

Choose the project

In Configure GitLab issues, pick the private project. The list shows projects where the bot is a member, using the project URL path.

​
Connect a self-hosted GitLab

1

Check the server

The server must be reachable from the internet over HTTPS with a valid certificate. Private-network servers are not supported.
2

Create an OAuth application

On that server, create a confidential OAuth application with the api scope. Copy the redirect URI shown in the Self-hosted dialog in NoScope.
3

Connect the Guest user

Invite a Guest user to the private project, the same way as on GitLab.com. In NoScope, click Self-hosted and enter the GitLab URL, application ID, and secret. Approve the connection while signed in as that Guest user.

​
Create an issue and keep it in sync

  • On a finding, click Create GitLab issue. The issue is confidential.
  • To see it in GitLab, open the project and go to Plan, then Work items.
  • When you mark the finding fixed, rejected, or false positive, NoScope closes the issue and adds a note. Marking it open again reopens the issue. This usually happens within a minute.
  • The bot can close and reopen issues it created. An issue created by another GitLab user stays unchanged.
Disconnect stops new issues and pending status updates. Issues that already exist stay in GitLab, and findings keep their links.