Upwind Enables Effortless Shift-Left Security for Every Merge Request
Today, we’re excited to introduce GitLab Automated Repository Scanning, a major upgrade to Upwind’s Shift-Left security capabilities that brings automatic, real-time scanning directly into the GitLab merge request workflows. With this new capability, every merge request across all your GitLab repositories is scanned the moment it’s opened, without requiring developers to modify CI/CD pipelines or set anything up manually.
This release delivers exactly what Shift-Left security has been missing: seamless adoption, zero friction, and universal coverage. Developers get immediate feedback where they already work, and security teams get consistent, reliable visibility across their organization’s entire GitLab group. It’s the easiest and most effective way to detect vulnerabilities earlier, reduce rework, and keep insecure code from reaching production.
What Is Shift-Left Scanning and Why Is It Important?
Before diving deeper into how it works, it’s important to understand how Shift-Left scanning fits into the broader security lifecycle, and why Upwind’s approach makes it uniquely powerful.
Shift-Left scanning moves security checks earlier in the software development lifecycle, providing developers with instant feedback while code is still being written and reviewed. Identifying issues at this stage drastically reduces the cost and complexity of remediation. The later a vulnerability is discovered, whether during staging, production rollout, or incident response, the more expensive it is to fix and the more risk it introduces.
When Shift-Left scanning is integrated into the merge request process, vulnerabilities are caught at the source. Developers understand the context, can correct issues immediately, and avoid rework or regressions. It’s a win-win situation; engineering moves faster, and security becomes more proactive rather than reactive. Shift-Left works best when it’s effortless for developers, and that’s exactly the experience we’ve engineered with automated repository scanning for GitLab.
Supercharging Shift-Left With Runtime Signals
However, Shift Left alone isn’t enough. To prioritize effectively, teams need to know which vulnerabilities truly pose a threat – and that requires runtime context. Upwind connects repository findings with real-time intelligence from your cloud workloads, including network reachability, active processes, exposure paths, and identity permissions. This allows teams to separate theoretical vulnerabilities from those that are actually exploitable in production.
By combining developer-side scans with runtime insights, Upwind transforms Shift-Left into a smarter, more actionable discipline. Security teams can focus on what matters most, avoid alert fatigue, and guide developers toward the issues that have real impact on operational risk.
GitLab Automated Repository Scanning
GitLab Automated Repository Scanning brings all these capabilities directly into the developer experience. It introduces a fully automated, webhook-based scanning workflow that requires no pipeline changes and no manual onboarding of repositories. Once deployed, the service discovers all repositories in your GitLab group, provisions the necessary webhooks, and triggers scans every time a merge request is created.
Developers see results immediately as comments in the merge request, allowing them to address vulnerabilities before code is merged. Meanwhile, all activity is tracked in the Upwind Console’s “Shift left” tab for visibility, historical reporting, and centralized review. The entire process happens automatically, so teams get comprehensive coverage without operational overhead.
Why It’s Important
GitLab Automated Repository Scanning solves several long-standing challenges organizations face when trying to adopt Shift-Left security at scale. Historically, integrating scanning into GitLab required modifying pipelines, onboarding repositories manually, or relying on developers to install and enable tools themselves. These inconsistencies left gaps, slowed onboarding, and created unnecessary friction. GitLab Automated Repository Scanning changes that by making security ambient. Every merge request is scanned; every repository is covered and every result appears where developers already collaborate. Security becomes predictable, automatic, and aligned across engineering and security teams.
What’s Next
This release is the foundation for an even broader Shift-Left experience. We’re building a centralized management and configuration interface within the Upwind Console where customers will be able to see all connected repositories, track when each was last scanned, configure Scope Scanning policies, and run On-Demand scans directly from the UI. This will give security and platform engineering leaders a single command center for repository security.
In parallel, we’re bringing automated repository scanning to GitHub. Soon, GitHub organizations will enjoy the same seamless onboarding, automatic webhook provisioning, and instant pull request scanning that GitLab users are receiving today. Our goal is to make Shift-Left security effortless and universal across your entire development ecosystem.
See it in Action
GitLab Automated Repository Scanning brings effortless, real-time security to the heart of the developer workflow. By combining early detection with runtime intelligence, Upwind empowers teams to catch vulnerabilities sooner, prioritize them more effectively, and maintain a stronger security posture from the moment code is written.
If you’re ready to see just how powerful automated Shift-Left security can be, book a customized demo with us today. Upwind makes security faster, smarter, and frictionless – exactly how modern engineering teams expect it to be.
