Connect Oplane to GitLab projects for automated threat modeling on merge requests. No app install required, just sign in with your GitLab account.
Connect Oplane to your GitLab projects to enable automated threat modeling on merge requests. No app installation required, just sign in with your GitLab account.
1
Open Workspaces
Navigate to Workspaces in the left sidebar and click the + Workspace button in the top right corner.
Click the + Workspace button
2
Add a repository source
On the New Workspace page, enter a Name and optional Description. Then under Sources, click Continue with GitLab to connect your account. You can also set Access for the workspace on this same page, or leave Sources empty to run threat modeling locally via MCP.
3
Sign in to GitLab
Oplane redirects you to GitLab to sign in. Enter your credentials or use one of the alternative sign-in methods (Google, GitHub, Bitbucket, Salesforce, or Passkey).Once authenticated, GitLab redirects you back to Oplane with your account connected.
4
Select a project
Once your account is connected, Sources shows a GitLab group dropdown alongside a project search. Pick the group, search for the project you want, and click Select. Use Add GitLab account or Switch Git provider in the dropdown to connect a different account or provider.
Oplane lists only GitLab projects where you are Maintainer or Owner. This access level is required to create a project access token.
GitLab groups already claimed by a different Oplane organisation appear greyed out in the picker and cannot be selected. See Namespace claims for details.
5
Configure and create
Once a project is selected, an Analyse Pull Requests toggle appears. Leave it on to automatically threat model every MR. If disabled, you can still trigger reviews by mentioning @oplane in an MR comment.Under Access, add team members who should have access and set General access (Restricted, or open to the organisation). Then click Create.
6
Choose threat models
Oplane analyses your repository and suggests threat models based on the codebase. Select the ones relevant to your project, or describe your own scope in the text box. You can also click Skip and go to workspace to do this later. This step helps Oplane understand what to focus on in future MR reviews.
The steps above work for projects on GitLab.com. If your team runs its own GitLab server, an organisation Owner first adds it as an integration in Org Settings > Integrations. After that, your self-managed instance shows up next to GitLab.com when you continue with GitLab, and you connect projects the same way.
Connect a self-managed GitLab instance
Create a GitLab OAuth application and add the integration in your organisation settings.
