GitLab keeps its security workflow in Ultimate. MopokeHQ gives Free and Premium teams dependency findings, one vulnerability roadmap, merge request gates and fix merge requests, from one CI include line. On gitlab.com or self-managed GitLab behind a firewall.
From GitLab’s own documentation, checked on 23 October 2026. GitLab ships monthly, so follow the links for the current state.
| Feature | Free and Premium | Ultimate |
|---|---|---|
| Dependency scanning | Not included | Included |
| Continuous vulnerability scanning | Not included | Included |
| Vulnerability report | Not included | Included |
| Security dashboards | Not included | Included |
| Dependency list | Not included | Included |
| Security policies | Not included | Included |
| Security findings in merge requests | Not included | Included |
| SAST, secret detection and container scanning jobs, with downloadable reports | Included | Included |
On Free and Premium the scan jobs run and you can download their reports. Seeing those findings in a merge request, tracking them as vulnerabilities and setting policies on them needs Ultimate.
The same jobs to be done, run outside GitLab and reported back into your pipelines and merge requests.
| You want to | In GitLab Ultimate | In MopokeHQ |
|---|---|---|
| Know which dependencies are vulnerable | Dependency scanning | Builds an SBOM with syft on your runner and matches it against OSV, php.net, CISA KEV and FIRST EPSS |
| Hear about a new CVE without re-running a pipeline | Continuous vulnerability scanning | Re-checks every stored SBOM when an advisory lands, including last month’s builds |
| One list of what to fix | Vulnerability report, security dashboards | The Now roadmap: work grouped by fix across every project, P1 to P3 |
| See findings where the code changes | Security findings in merge requests | Merge request comments with the new findings |
| Stop new problems at merge time | Security policies | A gate that fails on a new critical, a new secret or a new known-exploited dependency |
| Fix it, not just find it | Vulnerability resolution | mopoke act opens fix merge requests from your own runner |
| Know what is running in production | No equivalent | Deploy reports and an optional runtime check-in. Exposures close when the fix is live |
| Show an auditor or a client | No equivalent | Hash-chained evidence log and evidence packs for ISO 27001, SOC 2 and Essential Eight |
The mopoke CLI runs on your existing runners. It builds the SBOM, runs the scanners from one pinned image and uploads the results. Set the token on the GitLab group and every project in it is covered.
MOPOKE_TOKEN, a masked group variableinclude: - remote: https://app.mopokehq.com/ci/scan.ymlIf every merge request fails on old issues, people learn to ignore the gate. MopokeHQ compares each merge request with the baseline. Existing debt goes on the roadmap. The pipeline fails only on what the change introduces.
mopoke act runs on a schedule in your runner, collects the fixes queued for it and opens merge requests, much as Renovate does. Because it runs inside your CI, MopokeHQ needs no write access to GitLab.
A vulnerable package on a branch is not the same as one in production. MopokeHQ learns what is deployed from your pipelines and closes an exposure on its own only when the fixed version is seen live.
mopoke deploy --env productionOne line after your deploy jobMopokeHQ never connects into your network. Your runners push SBOMs and results out, so an instance with no inbound access works the same as gitlab.com.
Security and dataGitLab has the deep integration today. GitHub, Gitea, Forgejo and Bitbucket integrations are coming, and any CI that can run a container can upload through the same CLI now.
All platformsMopokeHQ runs alongside GitLab. It does not change your GitLab tier or switch on GitLab’s own Ultimate features.
GitLab’s documentation lists dependency scanning as an Ultimate feature. On Free and Premium, the SAST, secret detection and container scanning jobs run and produce downloadable reports, but merge request findings, the vulnerability report and the dependency list need Ultimate. MopokeHQ gives Free and Premium projects dependency findings through an SBOM built in your own pipeline.
According to GitLab’s docs (checked 23 October 2026), Free and Premium do not include dependency scanning, continuous vulnerability scanning, the vulnerability report, security dashboards, the dependency list, security policies or security findings in merge requests. SAST with open-source analyzers, pipeline secret detection and container scanning do run on all tiers.
Ultimate adds the vulnerability workflow: dependency scanning, the vulnerability report, security dashboards, the dependency list, security policies and security findings in merge requests. MopokeHQ is for teams that want that workflow without moving every seat to Ultimate.
GitLab’s pricing page lists Ultimate as custom pricing and Premium at US$29 per user per month, billed annually (checked 23 October 2026). MopokeHQ is priced by active projects, with unlimited users.
Dependabot is a GitHub product. On GitLab, Renovate is the common choice for update merge requests. MopokeHQ’s mopoke act job runs in your runner and opens fix merge requests for vulnerable dependencies, and the exposure closes once the fix is seen deployed.
GitLab deprecated Gemnasium-based dependency scanning in GitLab 17.9 and has proposed removing it in GitLab 20.0. Its replacement, dependency scanning using SBOM, is an Ultimate feature.
No. Scans and fix merge requests both run from your own runners, and nothing connects into your network.
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.