GitLab 19.4, released September 17, 2026, introduces governance for MCP server tools alongside internal GitLab Duo Agent Platform tools, Advanced SAST support for Kotlin, Dart, and Scala languages, SPDX license expression support in dependency scanning, and a new /goal slash command in GitLab Duo CLI for delegated objective execution.
An application security program should rest on four foundational legs: security by default (guardrails, tiered SAST rules, dependency management, threat modeling), reactionary security (deep-dive threat modeling for high-risk projects), secure development practices, and metrics-driven oversight. The approach shifts from triaging individual vulnerabilities to removing entire bug classes at scale, using AI tooling to filter false positives and automate routine checks so small teams can focus on systemic risk.