Merge branch 'selhorn-secure-updates-1' into 'master'

Edits for CTRT and style

See merge request gitlab-org/gitlab!56257

doc/development/integrations/secure.md

@@ -548,7 +548,7 @@ of the available SAST Analyzers and what data is currently available.
 
 The `remediations` field of the report is an array of remediation objects.
 Each remediation describes a patch that can be applied to
-[automatically fix](../../user/application_security/#automatic-remediation-for-vulnerabilities)
+[automatically fix](../../user/application_security/#apply-an-automatic-remediation-for-a-vulnerability)
 a set of vulnerabilities.
 
 Here is an example of a report that contains remediations.

doc/development/integrations/secure_partner_integration.md

@@ -101,7 +101,7 @@ and complete an integration with the Secure stage.
    - Users can interact with the findings from your artifact within their workflow. They can dismiss the findings or accept them and create a backlog issue.
    - To automatically create issues without user interaction, use the [issue API](../../api/issues.md).
 1. Optional: Provide auto-remediation steps:
-   - If you specified `remediations` in your artifact, it is proposed through our [automatic remediation](../../user/application_security/index.md#automatic-remediation-for-vulnerabilities)
+   - If you specified `remediations` in your artifact, it is proposed through our [automatic remediation](../../user/application_security/index.md#apply-an-automatic-remediation-for-a-vulnerability)
      interface.
 1. Demo the integration to GitLab:
    - After you have tested and are ready to demo your integration please

doc/user/application_security/api_fuzzing/index.md

@@ -944,7 +944,7 @@ pipelines. For more information, see the [Security Dashboard documentation](../s
 
 Fuzzing faults show up as vulnerabilities with a severity of Unknown.
 Once a fault is found, you can interact with it. Read more on how to
-[interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
+[address the vulnerabilities](../index.md#addressing-vulnerabilities).
 
 ## Handling False Positives
 

doc/user/application_security/container_scanning/index.md

@@ -455,7 +455,7 @@ For more information about the vulnerabilities database update, check the
 
 ## Interacting with the vulnerabilities
 
-After a vulnerability is found, you can [interact with it](../index.md#interacting-with-the-vulnerabilities).
+After a vulnerability is found, you can [address it](../index.md#addressing-vulnerabilities).
 
 ## Solutions for vulnerabilities (auto-remediation)
 
@@ -469,7 +469,7 @@ file, it's necessary to set [`GIT_STRATEGY: fetch`](../../../ci/runners/README.m
 your `.gitlab-ci.yml` file by following the instructions described in this document's
 [overriding the container scanning template](#overriding-the-container-scanning-template) section.
 
-Read more about the [solutions for vulnerabilities](../index.md#automatic-remediation-for-vulnerabilities).
+Read more about the [solutions for vulnerabilities](../index.md#apply-an-automatic-remediation-for-a-vulnerability).
 
 ## Troubleshooting
 

doc/user/application_security/coverage_fuzzing/index.md

@@ -237,7 +237,7 @@ The `covfuzz-ci.yml` is the same as that in the [original synchronous example](h
 
 ## Interacting with the vulnerabilities
 
-After a vulnerability is found, you can [interact with it](../index.md#interacting-with-the-vulnerabilities).
+After a vulnerability is found, you can [address it](../index.md#addressing-vulnerabilities).
 The merge request widget lists the vulnerability and contains a button for downloading the fuzzing
 artifacts. By clicking one of the detected vulnerabilities, you can see its details.
 

doc/user/application_security/dast/index.md

@@ -1170,7 +1170,7 @@ variables:
 ## Interacting with the vulnerabilities
 
 Once a vulnerability is found, you can interact with it. Read more on how to
-[interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
+[address the vulnerabilities](../index.md#addressing-vulnerabilities).
 
 ## Vulnerabilities database update
 

doc/user/application_security/dependency_scanning/index.md

@@ -226,13 +226,13 @@ Read more on [how to use private Maven repositories](../index.md#using-private-m
 ## Interacting with the vulnerabilities
 
 Once a vulnerability is found, you can interact with it. Read more on how to
-[interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
+[address the vulnerabilities](../index.md#addressing-vulnerabilities).
 
 ## Solutions for vulnerabilities (auto-remediation)
 
 Some vulnerabilities can be fixed by applying the solution that GitLab
 automatically generates. Read more about the
-[solutions for vulnerabilities](../index.md#automatic-remediation-for-vulnerabilities).
+[solutions for vulnerabilities](../index.md#apply-an-automatic-remediation-for-a-vulnerability).
 
 ## Security Dashboard
 

doc/user/application_security/index.md

@@ -5,17 +5,20 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 type: reference, howto
 ---
 
-# GitLab Secure **(ULTIMATE)**
+# Application security **(ULTIMATE)**
 
 GitLab can check your application for security vulnerabilities that may lead to unauthorized access,
 data leaks, denial of services, and more. GitLab reports vulnerabilities in the merge request so you
-can fix them before merging. The [Security Dashboard](security_dashboard/index.md) provides a
-high-level view of vulnerabilities detected in your projects, pipeline, and groups. The [Threat Monitoring](threat_monitoring/index.md)
-page provides runtime security metrics for application environments. With the information provided,
-you can immediately begin risk analysis and remediation.
+can fix them before you merge.
+
+- The [Security Dashboard](security_dashboard/index.md) provides a
+  high-level view of vulnerabilities detected in your projects, pipeline, and groups.
+- The [Threat Monitoring](threat_monitoring/index.md) page provides runtime security metrics
+  for application environments. With the information provided,
+  you can immediately begin risk analysis and remediation.
 
 <i class="fa fa-youtube-play youtube" aria-hidden="true"></i>
-For an overview of application security with GitLab, see
+For an overview of GitLab application security, see
 [Security Deep Dive](https://www.youtube.com/watch?v=k4vEJnGYy84).
 
 ## Quick start
@@ -123,7 +126,7 @@ latest versions of the scanning tools without having to do anything. There are s
 with this approach, however, and there is a
 [plan to resolve them](https://gitlab.com/gitlab-org/gitlab/-/issues/9725).
 
-## Viewing security scan information in merge requests **(FREE)**
+## View security scan information in merge requests **(FREE)**
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/4393) in GitLab Free 13.5.
 > - Made [available in all tiers](https://gitlab.com/gitlab-org/gitlab/-/issues/273205) in 13.6.
@@ -136,25 +139,7 @@ reports are available to download. To download a report, click on the
 
 ![Security widget](img/security_widget_v13_7.png)
 
-## Interacting with the vulnerabilities
-
-> Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 10.8.
-
-Each security vulnerability in the merge request report or the
-[Vulnerability Report](vulnerability_report/index.md) is actionable. Click an entry to view detailed
-information with several options:
-
-- [Dismiss vulnerability](#dismissing-a-vulnerability): Dismissing a vulnerability styles it in
-  strikethrough.
-- [Create issue](vulnerabilities/index.md#create-a-gitlab-issue-for-a-vulnerability): Create a new issue with the title and
-  description pre-populated with information from the vulnerability report. By default, such issues
-  are [confidential](../project/issues/confidential_issues.md).
-- [Automatic Remediation](#automatic-remediation-for-vulnerabilities): For some vulnerabilities,
-  a solution is provided for how to fix the vulnerability.
-
-![Interacting with security reports](img/interacting_with_vulnerability_v13_3.png)
-
-### View details of a DAST vulnerability
+## View details of a DAST vulnerability
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/36332) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.1.
 
@@ -165,11 +150,10 @@ investigate and rectify the underlying cause.
 To view details of DAST vulnerabilities:
 
 1. To see all vulnerabilities detected:
-
    - In a project, go to the project's **{shield}** **Security & Compliance** page.
    - Only in a merge request, go the merge request's **Security** tab.
 
-1. Click on the vulnerability's description. The following details are provided:
+1. Select the vulnerability's description. The following details are provided:
 
 | Field            | Description                                                        |
 |:-----------------|:------------------------------------------------------------------ |
@@ -187,14 +171,14 @@ To view details of DAST vulnerabilities:
 | Links            | Links to further details of the detected vulnerability.            |
 | Solution         | Details of a recommended solution to the vulnerability (optional). |
 
-#### Hide sensitive information in headers
+### Hide sensitive information in headers
 
 HTTP request and response headers may contain sensitive information, including cookies and
 authorization credentials. By default, content of specific headers are masked in DAST vulnerability
 reports. You can specify the list of all headers to be masked. For details, see
 [Hide sensitive information](dast/index.md#hide-sensitive-information).
 
-### View details of an API Fuzzing vulnerability
+## View details of an API Fuzzing vulnerability
 
 > Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.7.
 
@@ -231,65 +215,79 @@ Follow these steps to view details of a fuzzing fault:
 | Severity         | Severity of the finding is always Unknown.                          |
 | Scanner Type     | Scanner used to perform testing.                                   |
 
-### Dismissing a vulnerability
+## Addressing vulnerabilities
 
-To dismiss a vulnerability, you must set its status to Dismissed. This dismisses the vulnerability
-for the entire project. Follow these steps to do so:
+> Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 10.8.
 
-1. Select the vulnerability in the Security Dashboard.
-1. Select **Dismissed** from the **Status** selector menu at the top-right.
+For each security vulnerability in a merge request or [Vulnerability Report](vulnerability_report/index.md),
+you can:
+
+- [Dismiss the vulnerability](#dismiss-a-vulnerability).
+- Create a [confidential](../project/issues/confidential_issues.md)
+  [issue](vulnerabilities/index.md#create-a-gitlab-issue-for-a-vulnerability).
+- Apply an [automatically remediation](#apply-an-automatic-remediation-for-a-vulnerability).
 
-You can undo this action by selecting a different status from the same menu.
+### Dismiss a vulnerability
 
-#### Adding a dismissal reason
+> Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0, a dismissal reason.
 
-> Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0.
+You can dismiss a vulnerability for the entire project.
 
-When dismissing a vulnerability, it's often helpful to provide a reason for doing so. Upon setting a
-vulnerability's status to Dismissed, a text box appears for you to add a comment with your
-dismissal. Once added, you can edit or delete it. This allows you to add and update context for a
-vulnerability as you learn more over time.
+1. Select the vulnerability in the Security Dashboard.
+1. In the top-right, from the **Status** selector menu, select **Dismissed**.
+1. Optional. Add a reason for the dismissal and select **Save comment**.
 
-![Dismissed vulnerability comment](img/adding_a_dismissal_reason_v13_4.png)
+To undo this action, select a different status from the same menu.
 
-#### Dismissing multiple vulnerabilities
+#### Dismiss multiple vulnerabilities
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/35816) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.9.
 
-You can dismiss multiple vulnerabilities at once, providing an optional reason.
-Selecting the checkboxes on the side of each vulnerability in the list selects that individual vulnerability.
-Alternatively, you can select all the vulnerabilities in the list by selecting the checkbox in the table header.
-Deselecting the checkbox in the header deselects all the vulnerabilities in the list.
-After you have selected some vulnerabilities, a menu appears at the top of the table that allows you to select a dismissal reason.
-Pressing the "Dismiss Selected" button dismisses all the selected vulnerabilities at once, with the reason you chose.
+You can dismiss multiple vulnerabilities at once.
 
-![Multiple vulnerability dismissal](img/multi_select_v12_9.png)
+1. In the list of vulnerabilities, select the checkbox for each vulnerability you want to dismiss.
+   To select all, select the checkbox in the table header.
+1. Above the table, select a dismissal reason.
+1. Select **Dismiss Selected**.
 
 ### Create an issue for a vulnerability
 
-You can create a GitLab issue, or a Jira issue (if it's enabled) for a vulnerability. For more
-details, see [Vulnerability Pages](vulnerabilities/index.md).
+You can create a GitLab or Jira issue for a vulnerability. For details, see [Vulnerability Pages](vulnerabilities/index.md).
+
+#### Link to an existing issue
+
+If you already have an open issue, you can link to it from the vulnerability.
+
+- The vulnerability page shows related issues, but the issue page doesn't show the vulnerability it's related to.
+- An issue can only be related to one vulnerability at a time.
+- Issues can be linked across groups and projects.
+
+To link to an existing issue:
+
+1. Open the vulnerability.
+1. In the **Related Issues** section, select the plus (**{plus}**) icon.
+1. In the text box that appears, type an issue number or paste an issue link.
+   - Type `#` followed by a number to show an autocomplete menu.
+   - You can enter multiple issues at once. Press the space bar after each issue number or link to converts them to tags.
+1. Select **Add**.
 
-### Automatic remediation for vulnerabilities
+To remove an issue, to the right of the issue number, select **{close}**.
+
+![Vulnerability related issues text box tags animation](img/vulnerability_related_issues_text_box_tags_v13_2.gif)
+
+### Apply an automatic remediation for a vulnerability
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/5656) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.7.
 
 Some vulnerabilities can be fixed by applying the solution that GitLab automatically generates.
-Although the feature name is Automatic Remediation, this feature is also commonly called
-Auto-Remediation, Auto Remediation, or Suggested Solutions. The following scanners are supported:
+The following scanners are supported:
 
-- [Dependency Scanning](dependency_scanning/index.md):
+- [Dependency Scanning](dependency_scanning/index.md).
   Automatic Patch creation is only available for Node.js projects managed with
   `yarn`.
-- [Container Scanning](container_scanning/index.md)
-
-When an automatic solution is available, the button in the header shows **Resolve with merge request**:
+- [Container Scanning](container_scanning/index.md).
 
-![Resolve with Merge Request button](img/vulnerability_page_merge_request_button_v13_1.png)
-
-Selecting the button creates a merge request with the solution.
-
-#### Manually applying the suggested patch
+#### Manually apply the suggested patch
 
 To manually apply the patch that GitLab generated for a vulnerability:
 
@@ -301,49 +299,22 @@ To manually apply the patch that GitLab generated for a vulnerability:
 1. Run `git apply remediation.patch`.
 1. Verify and commit the changes to your branch.
 
-#### Creating a merge request from a vulnerability
+#### Create a merge request with the suggested patch
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/9224) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.9.
 
-In certain cases, GitLab allows you to create a merge request that automatically remediates the
+In some cases, you can create a merge request that automatically remediates the
 vulnerability. Any vulnerability that has a
-[solution](#automatic-remediation-for-vulnerabilities) can have a merge
+[solution](#apply-an-automatic-remediation-for-a-vulnerability) can have a merge
 request created to automatically solve the issue.
 
-If this action is available, the vulnerability page or modal contains a **Create merge request** button.
-Click this button to create a merge request to apply the solution onto the source branch.
-
-![Create merge request from vulnerability](img/create_mr_from_vulnerability_v13_4.png)
-
-### Managing related issues for a vulnerability
-
-Issues can be linked to a vulnerability using the related issues block on the vulnerability page.
-The relationship is uni-directional. The vulnerability page shows related issues, but the issue page
-doesn't show the vulnerability it's related to. An issue can only be related to one vulnerability at
-a time. Issues can be linked across groups and projects.
-
-#### Adding a related issue
-
-You can link an issue by clicking the **{plus}** button in the **Related Issues** block.
-
-![Vulnerability related issues add button](img/vulnerability_related_issues_add_button_v13_2.png)
-
-A text box appears that lets you type an issue number or paste an issue link. You can enter multiple
-issues at once. Pressing the space bar after each issue number or link converts them to tags that
-you can remove by clicking the **{close}** icon to the tag's right. Typing `#` followed by a number
-shows an autocomplete menu. Click an issue in the menu to add it as a tag. When you're finished
-entering issues, click the **Add** button to link the issues to the vulnerability. Alternatively,
-click **Cancel** to exit without linking any issues.
-
-![Vulnerability related issues text box tags animation](img/vulnerability_related_issues_text_box_tags_v13_2.gif)
-
-### Removing a related issue
+If this action is available:
 
-Click the **{close}** icon to right of an issue to remove it as a related issue. Note that this only
-removes it as a related issue of the vulnerability; it doesn't modify or remove the issue itself.
-You can link it to the vulnerability again if desired.
+1. Select the **Resolve with merge request** dropdown, then select **Resolve with merge request**.
+   
+   ![Create merge request from vulnerability](img/create_mr_from_vulnerability_v13_4.png)
 
-![Vulnerability related issues remove issue animation](img/vulnerability_related_issues_remove_v13_2.gif)
+A merge request is created. It that applies the solution to the source branch.
 
 ## Security approvals in merge requests
 

doc/user/application_security/offline_deployments/index.md

@@ -59,14 +59,14 @@ mirroring the packages inside your own offline network.
 ### Interacting with the vulnerabilities
 
 Once a vulnerability is found, you can interact with it. Read more on how to
-[interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
+[address the vulnerabilities](../index.md#addressing-vulnerabilities).
 
 Please note that in some cases the reported vulnerabilities provide metadata that can contain
 external links exposed in the UI. These links might not be accessible within an offline environment.
 
 ### Automatic remediation for vulnerabilities
 
-The [automatic remediation for vulnerabilities](../index.md#automatic-remediation-for-vulnerabilities) feature is available for offline Dependency Scanning and Container Scanning, but may not work
+The [automatic remediation for vulnerabilities](../index.md#apply-an-automatic-remediation-for-a-vulnerability) feature is available for offline Dependency Scanning and Container Scanning, but may not work
 depending on your instance's configuration. We can only suggest solutions, which are generally more
 current versions that have been patched, when we are able to access up-to-date registry services
 hosting the latest versions of that dependency or image.

doc/user/application_security/sast/index.md

@@ -137,7 +137,7 @@ as shown in the following table:
 | [Customize SAST Settings](#customizing-the-sast-settings)                                                    | **{check-circle}**  | **{check-circle}** |
 | View [JSON Report](#reports-json-format)                                                                     | **{check-circle}**  | **{check-circle}** |
 | Presentation of JSON Report in Merge Request                                                                 | **{dotted-circle}** | **{check-circle}** |
-| [Interaction with Vulnerabilities](../../application_security/index.md#interacting-with-the-vulnerabilities) | **{dotted-circle}** | **{check-circle}** |
+| [Address vulnerabilities](../../application_security/index.md#addressing-vulnerabilities)                    | **{dotted-circle}** | **{check-circle}** |
 | [Access to Security Dashboard](../../application_security/security_dashboard/index.md)                       | **{dotted-circle}** | **{check-circle}** |
 | [Configure SAST in the UI](#configure-sast-in-the-ui)                                                        | **{dotted-circle}** | **{check-circle}** |
 | [Customize SAST Rulesets](#customize-rulesets)                                                               | **{dotted-circle}** | **{check-circle}** |

doc/user/application_security/security_dashboard/index.md

@@ -196,4 +196,4 @@ Each scenario can be a third-level heading, e.g. `### Getting error message X`.
 If you have none to add when creating a doc, leave this section in place
 but commented out to help encourage others to add to it in the future. -->
 
-Read more on how to [interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
+Read more on how to [address the vulnerabilities](../index.md#addressing-vulnerabilities).

doc/user/application_security/vulnerabilities/index.md

@@ -123,4 +123,4 @@ Linked issues are shown in the Vulnerability Report and the vulnerability's page
 ## Automatically remediate the vulnerability
 
 You can fix some vulnerabilities by applying the solution that GitLab automatically
-generates for you. [Read more about the automatic remediation for vulnerabilities feature](../index.md#automatic-remediation-for-vulnerabilities).
+generates for you. [Read more about the automatic remediation for vulnerabilities feature](../index.md#apply-an-automatic-remediation-for-a-vulnerability).