Sure, if you dig into the SAST Dockerfile you'll see that it's running `bandit` if you're in a Python repo. So add this step to your .gitlab-ci.yaml:

  bandit-check:
    # This check runs Openstack Bandit, a Python static analysis tool that checks for 
  security issues.
    stage: unit-test
    script:
    - bandit -r -x 'tests,test_,/migrations/,./src/' -c bandit-config.yaml -ll ."

DAST uses ZAP, which you can also run in a Dockerfile yourself.

Of course there's also some window dressing to display the errors on the main MR, instead of having to dig into a step failure, but that doesn't make a meaningful difference to me.

(This feature could well have moved on since it was first implemented, that was the only time I dug into it).