GitLab 19.3 Adds a Secrets Manager and Bulk Vulnerability Remediation
The release moves GitLab Secrets Manager into limited availability and lets teams resolve many SAST findings in one action.
GitLab released version 19.3 on August 20, 2026. The release's centerpiece is GitLab Secrets Manager, which moves into Limited Availability on GitLab.com as a Premium and Ultimate add-on. GitLab frames the feature around a specific, common failure mode: a developer needs a secret, has no sanctioned place to put it, and ends up hardcoding it somewhere it shouldn't be. Secrets Manager scopes secrets to a specific job based on environment and branch protection rules, integrates with GitLab's existing permission model, and logs access for audit purposes. A 30-day free trial is available for teams that want to evaluate it.
On the vulnerability-management side, 19.3 adds bulk remediation: teams can now select multiple SAST findings at once and run both Vulnerability Resolution and False Positive Analysis flows across all of them in a single action, rather than working through a backlog one finding at a time. A redesigned vulnerability detail page is meant to make reviewing and triaging any individual finding faster, and a new security-dashboard funnel visualizes how vulnerabilities move through triage and remediation stages over time.
The release also expands secret detection itself. A beta feature called GitLab Secret Scanning for Source Code uses a proprietary detection engine, separate from GitLab's standard rule-based scanning, aimed specifically at unstructured secrets — passwords and similar values that don't match a known pattern — using heuristics intended to reduce false positives. Separately, secret detection now scans commit history on every push to a default branch, which catches a secret that existed briefly in a repository's history even if it was removed before the pipeline finished running. Together, the two changes close a gap in the older model, where a secret committed and then quickly deleted could still slip past a scan that only checked the final state of a push.
GitLab publishes full release notes for every monthly release, including 19.3, on its own documentation site, alongside a "what's new" summary aimed at a less technical audience.
Source: GitLab — 19.3 Release Notes