[{"data":1,"prerenderedAt":1813},["ShallowReactive",2],{"/blog/a-benchmarking-framework-for-sast":3,"navigation-en-us":969,"banner-en-us":1397,"footer-en-us":1407,"blog-post-authors-en-us-Michael Henriksen|Martynas Krupskis|Mark Art|Dinesh Bolkensteyn|Isaac Dawson|Julian Thome":1652,"blog-related-posts-en-us-a-benchmarking-framework-for-sast":1724,"blog-promotions-en-us":1749,"next-steps-en-us":1803},{"id":4,"title":5,"authors":6,"body":13,"category":949,"date":950,"description":951,"extension":952,"externalUrl":953,"faq":953,"featured":954,"heroImage":955,"meta":956,"navigation":201,"path":957,"seo":958,"slug":326,"stem":962,"tags":963,"template":967,"updatedDate":953,"__hash__":968},"blogPosts/en-us/blog/a-benchmarking-framework-for-sast.md","A Google Summer of Code project: creating a benchmarking framework for SAST",[7,8,9,10,11,12],"Michael Henriksen","Martynas Krupskis","Mark Art","Dinesh Bolkensteyn","Isaac Dawson","Julian Thome",{"type":14,"value":15,"toc":934},"minimark",[16,26,35,43,46,51,56,64,67,70,84,87,91,96,99,103,106,182,185,245,249,258,268,275,282,289,296,299,302,324,328,331,335,338,357,365,368,371,375,378,385,398,415,588,591,594,598,605,639,649,703,712,723,730,793,796,803,808,811,815,821,824,844,847,850,880,884,887,890,916,930],[17,18,19,20],"p",{},"In summer 2022, the ",[21,22,25],"a",{"href":23,"rel":24},"https://handbook.gitlab.com/handbook/engineering/development/sec/secure/vulnerability-research/",[],"Vulnerability Research team at\nGitLab",[17,27,28,29,34],{},"launched the ",[21,30,33],{"href":31,"rel":32},"https://summerofcode.withgoogle.com/",[],"Google Summer of Code (GSoC)"," project:",[17,36,37,42],{},[21,38,41],{"href":39,"rel":40},"https://gitlab.com/gitlab-com/marketing/community-relations/contributor-program/gsoc-2022/-/issues/1",[],"A benchmarking framework for\nSAST",".",[17,44,45],{},"The goal of the project was to create a benchmarking framework, which would assess the impact and quality of a security analyzer or configuration change before it reaches the production environment.",[47,48,50],"h2",{"id":49},"preliminaries","Preliminaries",[52,53,55],"h3",{"id":54},"gitlab-sast","GitLab SAST",[17,57,58,59],{},"As a complete DevOps Platform, GitLab has a variety of integrated ",[21,60,63],{"href":61,"rel":62},"https://docs.gitlab.com/user/application_security/sast/",[],"static analysis (SAST) tools",[17,65,66],{},"for different languages and frameworks. These tools help developers find vulnerabilities as early as possible in the software development lifecycle.",[17,68,69],{},"These tools are constantly being updated, either by upgrading the underlying security analyzers or by applying configuration changes.",[17,71,72,73,78,79,83],{},"Since all the integrated SAST tools are very different in terms of implementation, and depend on different tech stacks, they are all wrapped in Docker images. The wrappers translate tool-native vulnerability reports to a ",[21,74,77],{"href":75,"rel":76},"https://docs.gitlab.com/user/application_security/sast/#reports-json-format",[],"generic, common report format","\nwhich is made available by means of the ",[80,81,82],"code",{},"gl-sast-report.json"," artifact. This generic report is GitLab's common interface between analyzers and the GitLab Rails backend.",[17,85,86],{},"Benchmarking is important to assess the efficacy of analyzers and helps to make data-driven decisions. For example, benchmarking is useful for QA testing (spotting regressions), for data-driven decision making, and for research by assessing the progression of the GitLab security feature performance over time.",[52,88,90],{"id":89},"google-summer-of-code-gsoc","Google Summer Of Code (GSoC)",[17,92,93],{},[21,94,33],{"href":31,"rel":95},[],[17,97,98],{},"is a 10-week program that enlists contributors to work on open source projects in collaboration with open source organizations. For GSoC 2022, GitLab offered four projects to GSoC contributors. The contributors completed each of the projects with the guidance from GitLab team members who mentored them and provided regular feedback and assistance when needed.",[52,100,102],{"id":101},"terms-notation","Terms & Notation",[17,104,105],{},"In this blog post, we use the terms/acronyms below to classify findings reported by security analyzers.",[107,108,109,125],"table",{},[110,111,112],"thead",{},[113,114,115,119,122],"tr",{},[116,117,118],"th",{},"Acronym",[116,120,121],{},"Meaning",[116,123,124],{},"Description",[126,127,128,143,156,169],"tbody",{},[113,129,130,137,140],{},[131,132,133],"td",{},[134,135,136],"em",{},"TP",[131,138,139],{},"True Positive",[131,141,142],{},"Analyzer correctly identifies a vulnerability.",[113,144,145,150,153],{},[131,146,147],{},[134,148,149],{},"FP",[131,151,152],{},"False Positive",[131,154,155],{},"Analyzer misidentifies a vulnerability or reported a vulnerability where none exist.",[113,157,158,163,166],{},[131,159,160],{},[134,161,162],{},"TN",[131,164,165],{},"True Negative",[131,167,168],{},"Analyzer correctly ignores a potential false positive.",[113,170,171,176,179],{},[131,172,173],{},[134,174,175],{},"FN",[131,177,178],{},"False Negative",[131,180,181],{},"Analyzer does not report a known vulnerability.",[17,183,184],{},"For the figures in the blog post we use the following notation: processes are depicted as rounded boxes, whereas artifacts (e.g., files) are depicted as boxes; arrows denote an input/output (IO) relationship between the connected nodes.",[186,187,192],"pre",{"className":188,"code":189,"language":190,"meta":191,"style":191},"language-mermaid shiki shiki-themes github-light","\nflowchart TB;\n\nsubgraph legend[ Legend ]\n    proc(Process);\n    art[Artifact];\n    proc -->|IO relation|art;\nend\n\n","mermaid","",[80,193,194,203,210,215,221,227,233,239],{"__ignoreMap":191},[195,196,199],"span",{"class":197,"line":198},"line",1,[195,200,202],{"emptyLinePlaceholder":201},true,"\n",[195,204,206],{"class":197,"line":205},2,[195,207,209],{"class":208},"sgsFI","flowchart TB;\n",[195,211,213],{"class":197,"line":212},3,[195,214,202],{"emptyLinePlaceholder":201},[195,216,218],{"class":197,"line":217},4,[195,219,220],{"class":208},"subgraph legend[ Legend ]\n",[195,222,224],{"class":197,"line":223},5,[195,225,226],{"class":208},"    proc(Process);\n",[195,228,230],{"class":197,"line":229},6,[195,231,232],{"class":208},"    art[Artifact];\n",[195,234,236],{"class":197,"line":235},7,[195,237,238],{"class":208},"    proc -->|IO relation|art;\n",[195,240,242],{"class":197,"line":241},8,[195,243,244],{"class":208},"end\n",[47,246,248],{"id":247},"motivation","Motivation",[17,250,251,252,257],{},"The authors of the paper ",[21,253,256],{"href":254,"rel":255},"https://dl.acm.org/doi/10.1145/2668930.2688819",[],"How to Build a\nBenchmark"," distilled the desirable characteristics of a benchmark below:",[259,260,261],"blockquote",{},[262,263,264],"ol",{},[265,266,267],"li",{},"Relevance: How closely the benchmark behavior correlates to behaviors\nthat are of interest to consumers of the results.",[259,269,270],{},[262,271,272],{"start":205},[265,273,274],{},"Reproducibility: The ability to consistently produce similar results\nwhen the benchmark is run with the same test configuration.",[259,276,277],{},[262,278,279],{"start":212},[265,280,281],{},"Fairness: Allowing different test configurations to compete on their\nmerits without artificial limitations.",[259,283,284],{},[262,285,286],{"start":217},[265,287,288],{},"Verifiability: Providing confidence that a benchmark result is\naccurate.",[259,290,291],{},[262,292,293],{"start":223},[265,294,295],{},"Usability: Avoiding roadblocks for users to run the benchmark in their\ntest environments.",[17,297,298],{},"There currently is no standard nor de facto language-agnostic SAST benchmark satisfying all the criteria mentioned above. Many benchmark suites focus on specific languages, are shipped with incomplete or missing ground-truths, or are based on outdated technologies and/or frameworks. A ground-truth or baseline is the set of findings a SAST tool is expected to detect.",[17,300,301],{},"The main objective of the GSoC project was to close this gap and start to create a benchmarking framework that addresses all the desirable charateristics mentioned above in the following manner:",[262,303,304,307,310,318,321],{},[265,305,306],{},"Relevance: Include realistic applications (in terms of size, framework\nusage and customer demand).",[265,308,309],{},"Reproducibility: Automate the whole benchmarking process in CI.",[265,311,312,313,317],{},"Fairness: Make it easy to integrate new SAST tools by just tweaking the\nCI configuration and use the ",[21,314,316],{"href":75,"rel":315},[],"GitLab security report schema"," as a common standard.",[265,319,320],{},"Verifiability: Assemble baseline that includes all the relevant\nvulnerabilities and make it publicly available. The baseline is the north star that defines what vulnerabilities are actually included in a test application.",[265,322,323],{},"Usability: Benchmark users can just integrate the benchmark as a\ndownstream pipeline to their CI configuration.",[47,325,327],{"id":326},"a-benchmarking-framework-for-sast","A benchmarking framework for SAST",[17,329,330],{},"The benchmarking framework compares the efficacy of an analyzer against a known baseline. This is very useful for monitoring the efficacy of the analyzer that participates in the benchmarking. The baseline is the gold standard that serves as a compass to guide analyzer improvements.",[52,332,334],{"id":333},"usage","Usage",[17,336,337],{},"For using the framework, the following requirements have to be met:",[262,339,340,343,350],{},[265,341,342],{},"The analyzer has to be dockerized.",[265,344,345,346,349],{},"The analyzer has to produce a vulnerability report that adheres to the\n",[21,347,316],{"href":75,"rel":348},[],"\nformat, which serves as our generic intermediate representation to compare analyzer efficacy.",[265,351,352,353,356],{},"The baseline expectations have to be provided as\n",[21,354,316],{"href":75,"rel":355},[],"\nso that we can compare the analyzer output against it.",[17,358,359,360,42],{},"The framework is designed in such a way that it can be easily integrated into the CI configuration of existing GitLab projects by means of a ",[21,361,364],{"href":362,"rel":363},"https://docs.gitlab.com/ci/pipelines/downstream_pipelines/",[],"downstream pipeline",[17,366,367],{},"There are many possible ways in which a downstream pipeline can be triggered:",[17,369,370],{},"source code changes applied to an analyzer, configuration changes applied to an analyzer, or scheduled pipeline invocation. By using the pipeline, we can run the benchmarking frameworks continuously and instantaneously on the GitLab projects that host the source code of the integrated analyzers whenever code or configuration changes are applied.",[52,372,374],{"id":373},"architecture","Architecture",[17,376,377],{},"The figure below depicts the benchmarking framework when comparing an analyzer against a baseline.",[17,379,380,381,42],{},"We assume that we have a baseline configuration available; a baseline consists of an application that is an actual test application that includes vulnerabilities. These vulnerabilities are documented in an expectation file that adheres to the ",[21,382,384],{"href":75,"rel":383},[],"security report schema",[17,386,387,388,390,391,394,395,42],{},"Note that we use the terms baseline and expectation interchangeably. As mentioned earlier, the benchmarking framework is essentially a GitLab pipeline that can be triggered downstream. The configured analyzer then takes the baseline app as input and generates a ",[80,389,82],{}," file. The heart of the benchmarking framework is the ",[80,392,393],{},"compare"," step, which compares the baseline against the report generated by the analyzer, both of which adhere to the ",[21,396,384],{"href":75,"rel":397},[],[17,399,400,401,403,404,406,407,409,410,42],{},"The compare step also computes the ",[134,402,136],{},", ",[134,405,175],{}," and ",[134,408,149],{}," that have been reported by the analyzer and computes different metrics based on this information. The compare step is implemented in the ",[21,411,414],{"href":412,"rel":413},"https://gitlab.com/gitlab-org/secure/gsoc-sast-benchmark/evaluator",[],"evaluator tool",[186,416,418],{"className":188,"code":417,"language":190,"meta":191,"style":191},"\nflowchart LR;\n\nsbx[gl-sast-report.json];\n\nbreport[Report];\n\nconfig[Configuration];\n\n\nconfig --> bf;\n\n\nsubgraph Baseline\n  bcollection[app];\n  baseline[expectation];\nend\n\n\nsubgraph bf [ Benchmarking Framework ]\n    orig(Analyzer);\n    compare(Compare);\n    orig --> sbx;\n    sbx --> compare;\nend\n\n\nbaseline --> compare;\n\ncompare --> breport\n\nbcollection --> orig\n\n",[80,419,420,424,429,433,438,442,447,451,456,461,466,472,477,482,488,494,500,505,510,515,521,527,533,539,545,550,555,560,566,571,577,582],{"__ignoreMap":191},[195,421,422],{"class":197,"line":198},[195,423,202],{"emptyLinePlaceholder":201},[195,425,426],{"class":197,"line":205},[195,427,428],{"class":208},"flowchart LR;\n",[195,430,431],{"class":197,"line":212},[195,432,202],{"emptyLinePlaceholder":201},[195,434,435],{"class":197,"line":217},[195,436,437],{"class":208},"sbx[gl-sast-report.json];\n",[195,439,440],{"class":197,"line":223},[195,441,202],{"emptyLinePlaceholder":201},[195,443,444],{"class":197,"line":229},[195,445,446],{"class":208},"breport[Report];\n",[195,448,449],{"class":197,"line":235},[195,450,202],{"emptyLinePlaceholder":201},[195,452,453],{"class":197,"line":241},[195,454,455],{"class":208},"config[Configuration];\n",[195,457,459],{"class":197,"line":458},9,[195,460,202],{"emptyLinePlaceholder":201},[195,462,464],{"class":197,"line":463},10,[195,465,202],{"emptyLinePlaceholder":201},[195,467,469],{"class":197,"line":468},11,[195,470,471],{"class":208},"config --> bf;\n",[195,473,475],{"class":197,"line":474},12,[195,476,202],{"emptyLinePlaceholder":201},[195,478,480],{"class":197,"line":479},13,[195,481,202],{"emptyLinePlaceholder":201},[195,483,485],{"class":197,"line":484},14,[195,486,487],{"class":208},"subgraph Baseline\n",[195,489,491],{"class":197,"line":490},15,[195,492,493],{"class":208},"  bcollection[app];\n",[195,495,497],{"class":197,"line":496},16,[195,498,499],{"class":208},"  baseline[expectation];\n",[195,501,503],{"class":197,"line":502},17,[195,504,244],{"class":208},[195,506,508],{"class":197,"line":507},18,[195,509,202],{"emptyLinePlaceholder":201},[195,511,513],{"class":197,"line":512},19,[195,514,202],{"emptyLinePlaceholder":201},[195,516,518],{"class":197,"line":517},20,[195,519,520],{"class":208},"subgraph bf [ Benchmarking Framework ]\n",[195,522,524],{"class":197,"line":523},21,[195,525,526],{"class":208},"    orig(Analyzer);\n",[195,528,530],{"class":197,"line":529},22,[195,531,532],{"class":208},"    compare(Compare);\n",[195,534,536],{"class":197,"line":535},23,[195,537,538],{"class":208},"    orig --> sbx;\n",[195,540,542],{"class":197,"line":541},24,[195,543,544],{"class":208},"    sbx --> compare;\n",[195,546,548],{"class":197,"line":547},25,[195,549,244],{"class":208},[195,551,553],{"class":197,"line":552},26,[195,554,202],{"emptyLinePlaceholder":201},[195,556,558],{"class":197,"line":557},27,[195,559,202],{"emptyLinePlaceholder":201},[195,561,563],{"class":197,"line":562},28,[195,564,565],{"class":208},"baseline --> compare;\n",[195,567,569],{"class":197,"line":568},29,[195,570,202],{"emptyLinePlaceholder":201},[195,572,574],{"class":197,"line":573},30,[195,575,576],{"class":208},"compare --> breport\n",[195,578,580],{"class":197,"line":579},31,[195,581,202],{"emptyLinePlaceholder":201},[195,583,585],{"class":197,"line":584},32,[195,586,587],{"class":208},"bcollection --> orig\n",[17,589,590],{},"Using the security report format as a common standard makes the benchmarking framework very versatile: the baseline could be provided by an automated process, by another analyzer, or manually, which happened to be the case in this",[17,592,593],{},"GSoC project.",[52,595,597],{"id":596},"scoring","Scoring",[17,599,600,601,604],{},"The main functionality of the ",[21,602,414],{"href":412,"rel":603},[],"\nis to compute the overlap/intersection, and difference between a baseline and generated report in order to uncover true positives, false positives, and false negatives.",[17,606,607,608,403,610,403,612,403,614,616,617,403,620,406,623,626,627,629,630,632,633,635,636],{},"The relationship between ",[134,609,136],{},[134,611,149],{},[134,613,175],{},[134,615,162],{},", baseline, and generated report can be seen in the table below; it includes three columns ",[80,618,619],{},"analyzer",[80,621,622],{},"baseline",[80,624,625],{},"classification",". The column ",[80,628,619],{}," represents the findings included in the report generated by the analyzer; column ",[80,631,622],{}," represents the findings included in the baseline; column ",[80,634,625],{}," denotes the verdict/classification that the ",[21,637,414],{"href":412,"rel":638},[],[17,640,641,642,406,645,648],{},"attaches to the analyzer finding when performing the comparison. The ",[80,643,644],{},"X",[80,646,647],{},"-"," denote reported and non-reported findings, respectively.",[107,650,651,661],{},[110,652,653],{},[113,654,655,657,659],{},[116,656,619],{},[116,658,622],{},[116,660,625],{},[126,662,663,673,683,693],{},[113,664,665,667,669],{},[131,666,647],{},[131,668,647],{},[131,670,671],{},[134,672,162],{},[113,674,675,677,679],{},[131,676,647],{},[131,678,644],{},[131,680,681],{},[134,682,175],{},[113,684,685,687,689],{},[131,686,644],{},[131,688,647],{},[131,690,691],{},[134,692,149],{},[113,694,695,697,699],{},[131,696,644],{},[131,698,644],{},[131,700,701],{},[134,702,136],{},[17,704,705,706,708,709,711],{},"The ",[80,707,625],{}," column in the table above shows that a ",[134,710,136],{}," is a vulnerability existing in both baseline and generated report; similarly, an",[17,713,714,716,717,719,720,722],{},[134,715,149],{}," is a vulnerability detected by an analyzer without a corresponding baseline entry, while an ",[134,718,175],{}," is a vulnerability present in the baseline but not detected by an analyzer. Note, that ",[134,721,162],{}," is practically not relevant for our use-case since the analyzers we are looking at only report unsafe, vulnerable cases instead of safe, non-vulnerable cases.",[17,724,725,726,729],{},"At the moment, the ",[80,727,728],{},"evaluator"," tool computes the metrics below:",[731,732,733,749,762,779],"ul",{},[265,734,735,736,739,740,742,743,745,746,748],{},"Precision: ",[134,737,738],{},"P"," = ",[134,741,136],{}," /( ",[134,744,136],{}," + ",[134,747,149],{}," )",[265,750,751,752,739,755,757,758,745,760,748],{},"Recall: ",[134,753,754],{},"R",[134,756,136],{}," / ( ",[134,759,136],{},[134,761,175],{},[265,763,764,765,768,769,771,772,774,775,745,777,748],{},"F-Score: ",[134,766,767],{},"F"," = 2 * ( ",[134,770,738],{}," * ",[134,773,754],{}," ) / ( ",[134,776,738],{},[134,778,754],{},[265,780,781,782,739,785,757,787,745,789,745,791,748],{},"Jaccard-Index: ",[134,783,784],{},"J",[134,786,136],{},[134,788,136],{},[134,790,149],{},[134,792,175],{},[17,794,795],{},"A higher precision indicates that an analyzer is less noisy due to the low(er)",[17,797,798,799,802],{},"number of ",[134,800,801],{},"FPs",". Hence, a high precision leads to a reduction of auditing effort of irrelevant findings. A high recall represents an analyzer's detection capacity. F-Score is a combined measure so that precision and recall can be condensed to a single number. The Jaccard-Index is a single value to capture the similarity between analyzer and baseline.",[17,804,705,805],{},[21,806,414],{"href":412,"rel":807},[],[17,809,810],{},"supports the addition of custom metrics via a simple call-back mechanism; this enables us to add support more metrics in the future that help us to gain additional or new insights with regards to the efficacy of our analyzers.",[52,812,814],{"id":813},"framework-properties","Framework Properties",[17,816,817,818,42],{},"In principle, the implemented benchmarking framework is language-agnostic:\nnew analyzers and baselines can be plugged-in as long as they adhere to the ",[21,819,384],{"href":75,"rel":820},[],[17,822,823],{},"Establishing baselines is laborious since it requires (cross-)validation, trying out attacks on the running baseline application and code auditing.",[17,825,826,827,832,833,838,839,42],{},"For the GSoC project, we established baselines for the applications below covering Java (",[21,828,831],{"href":829,"rel":830},"https://spring.io/",[],"Spring",") and Python (",[21,834,837],{"href":835,"rel":836},"https://flask.palletsprojects.com/",[],"Flask",") as they are ",[21,840,843],{"href":841,"rel":842},"https://survey.stackoverflow.co/2022/#technology-most-popular-technologies",[],"ranking high in the most used languages and frameworks",[17,845,846],{},"For a benchmark application to have practical utility, it is important that the application itself is based on technology, including programming languages and frameworks, that are used in the industry.",[17,848,849],{},"For both of these applications, the baseline/expectations have been collected, verified and are publicly availabe:",[731,851,852,864],{},[265,853,854,859,860,863],{},[21,855,858],{"href":856,"rel":857},"https://gitlab.com/gitlab-org/secure/gsoc-sast-benchmark/baselines/WebGoat/-/tree/baselines",[],"WebGoat",".\nWebGoat is a deliberately insecure Web application used to teach security vulnerabilities.\nWe chose this as baseline application because it is often used as a benchmark app in the Java world and it is based on ",[21,861,831],{"href":829,"rel":862},[]," which is one of the most popular frameworks in the Java world.",[265,865,866,871,872,874,875,879],{},[21,867,870],{"href":868,"rel":869},"https://gitlab.com/gitlab-org/secure/gsoc-sast-benchmark/baselines/vuln-flask-web-app/-/tree/report",[],"vuln-flask-web-app","\nLike WebGoat, this application is deliberately insecure.\n",[80,873,870],{}," covers both Python and ",[21,876,837],{"href":877,"rel":878},"https://flask.palletsprojects.com/en/2.2.x/",[],", one of the most popular web frameworks in the Python world.",[47,881,883],{"id":882},"conclusion","Conclusion",[17,885,886],{},"This GSoC project was a first step towards building a FOSS benchmarking framework that helps the community to test their own tools and to build up a relevant suite of baselines covering various languages and frameworks. With the help of the community, we will continue adding more baselines to the benchmarking framework in the future to cover more languages and frameworks.",[17,888,889],{},"If you found the project interesting, you might want to check out the following repositories:",[731,891,892,897,903,909],{},[265,893,894],{},[21,895,728],{"href":412,"rel":896},[],[265,898,899],{},[21,900,902],{"href":856,"rel":901},[],"WebGoat\nbaseline",[265,904,905],{},[21,906,908],{"href":868,"rel":907},[],"Vulnerable Flask Web App\nbaseline",[265,910,911],{},[21,912,915],{"href":913,"rel":914},"https://gitlab.com/gitlab-org/secure/gsoc-sast-benchmark/evaluator-downstream",[],"Example of downstream pipeline triggering\nevaluator",[17,917,918,919,924,925],{},"Cover image by ",[21,920,923],{"href":921,"rel":922},"https://unsplash.com/@nampoh",[],"Maxim Hopman"," on ",[21,926,929],{"href":927,"rel":928},"https://unsplash.com/photos/fiXLQXAhCfk",[],"Unsplash",[931,932,933],"style",{},"html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":191,"searchDepth":205,"depth":205,"links":935},[936,941,942,948],{"id":49,"depth":205,"text":50,"children":937},[938,939,940],{"id":54,"depth":212,"text":55},{"id":89,"depth":212,"text":90},{"id":101,"depth":212,"text":102},{"id":247,"depth":205,"text":248},{"id":326,"depth":205,"text":327,"children":943},[944,945,946,947],{"id":333,"depth":212,"text":334},{"id":373,"depth":212,"text":374},{"id":596,"depth":212,"text":597},{"id":813,"depth":212,"text":814},{"id":882,"depth":205,"text":883},"open-source","2022-09-27","Our 2022 Google Summer of Code project helped to create a benchmarking framework for SAST.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749677267/Blog/Hero%20Images/benchmarking.png",{},"/en-us/blog/a-benchmarking-framework-for-sast",{"ogTitle":5,"ogImage":955,"ogDescription":951,"ogSiteName":959,"noIndex":954,"ogType":960,"ogUrl":961,"title":5,"canonicalUrls":961,"description":951},"https://about.gitlab.com","article","https://about.gitlab.com/blog/a-benchmarking-framework-for-sast","en-us/blog/a-benchmarking-framework-for-sast",[964,965,966],"collaboration","google","open source","BlogPost","MpbsF20yXGU52ag4_W6Ju03aBGYpqXRPJaOddDGU-gU",{"logo":970,"freeTrial":975,"sales":980,"login":985,"items":990,"search":1317,"minimal":1348,"duo":1367,"switchNav":1376,"pricingDeployment":1387},{"config":971},{"href":972,"dataGaName":973,"dataGaLocation":974},"/","gitlab logo","header",{"text":976,"config":977},"Get free trial",{"href":978,"dataGaName":979,"dataGaLocation":974},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":981,"config":982},"Request a demo",{"href":983,"dataGaName":984,"dataGaLocation":974},"/sales/?contact-topic=request-demo","sales",{"text":986,"config":987},"Sign in",{"href":988,"dataGaName":989,"dataGaLocation":974},"https://gitlab.com/users/sign_in/","sign in",[991,1020,1120,1125,1239,1295],{"text":992,"config":993,"menu":995},"Platform",{"dataNavLevelOne":994},"platform",{"type":996,"columns":997},"cards",[998,1004,1012],{"title":992,"description":999,"link":1000},"The intelligent orchestration platform for DevSecOps",{"text":1001,"config":1002},"Explore our Platform",{"href":1003,"dataGaName":994,"dataGaLocation":974},"/platform/",{"title":1005,"description":1006,"link":1007},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1008,"config":1009},"Meet GitLab Duo",{"href":1010,"dataGaName":1011,"dataGaLocation":974},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1013,"description":1014,"link":1015},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1016,"config":1017},"Learn more",{"href":1018,"dataGaName":1019,"dataGaLocation":974},"/why-gitlab/","why gitlab",{"text":1021,"left":201,"config":1022,"menu":1024},"Product",{"dataNavLevelOne":1023},"solutions",{"type":1025,"link":1026,"columns":1030,"feature":1099},"lists",{"text":1027,"config":1028},"View all Solutions",{"href":1029,"dataGaName":1023,"dataGaLocation":974},"/solutions/",[1031,1055,1078],{"title":1032,"description":1033,"link":1034,"items":1039},"Automation","CI/CD and automation to accelerate deployment",{"config":1035},{"icon":1036,"href":1037,"dataGaName":1038,"dataGaLocation":974},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1040,1044,1047,1051],{"text":1041,"config":1042},"CI/CD",{"href":1043,"dataGaLocation":974,"dataGaName":1041},"/solutions/continuous-integration/",{"text":1005,"config":1045},{"href":1010,"dataGaLocation":974,"dataGaName":1046},"gitlab duo agent platform - product menu",{"text":1048,"config":1049},"Source Code Management",{"href":1050,"dataGaLocation":974,"dataGaName":1048},"/solutions/source-code-management/",{"text":1052,"config":1053},"Automated Software Delivery",{"href":1037,"dataGaLocation":974,"dataGaName":1054},"Automated software delivery",{"title":1056,"description":1057,"link":1058,"items":1063},"Security","Deliver code faster without compromising security",{"config":1059},{"href":1060,"dataGaName":1061,"dataGaLocation":974,"icon":1062},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1064,1068,1073],{"text":1065,"config":1066},"Application Security Testing",{"href":1060,"dataGaName":1067,"dataGaLocation":974},"Application security testing",{"text":1069,"config":1070},"Software Supply Chain Security",{"href":1071,"dataGaLocation":974,"dataGaName":1072},"/solutions/supply-chain/","Software supply chain security",{"text":1074,"config":1075},"Software Compliance",{"href":1076,"dataGaName":1077,"dataGaLocation":974},"/solutions/software-compliance/","software compliance",{"title":1079,"link":1080,"items":1085},"Measurement",{"config":1081},{"icon":1082,"href":1083,"dataGaName":1084,"dataGaLocation":974},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1086,1090,1094],{"text":1087,"config":1088},"Visibility & Measurement",{"href":1083,"dataGaLocation":974,"dataGaName":1089},"Visibility and Measurement",{"text":1091,"config":1092},"Value Stream Management",{"href":1093,"dataGaLocation":974,"dataGaName":1091},"/solutions/value-stream-management/",{"text":1095,"config":1096},"Analytics & Insights",{"href":1097,"dataGaLocation":974,"dataGaName":1098},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1100,"type":1025,"items":1101},"GitLab for",[1102,1108,1114],{"text":1103,"config":1104},"Enterprise",{"icon":1105,"href":1106,"dataGaLocation":974,"dataGaName":1107},"Building","/enterprise/","enterprise",{"text":1109,"config":1110},"Small Business",{"icon":1111,"href":1112,"dataGaLocation":974,"dataGaName":1113},"Work","/small-business/","small business",{"text":1115,"config":1116},"Public Sector",{"icon":1117,"href":1118,"dataGaLocation":974,"dataGaName":1119},"Organization","/solutions/public-sector/","public sector",{"text":1121,"config":1122},"Pricing",{"href":1123,"dataGaName":1124,"dataGaLocation":974,"dataNavLevelOne":1124},"/pricing/","pricing",{"text":1126,"config":1127,"menu":1129},"Resources",{"dataNavLevelOne":1128},"resources",{"type":1025,"link":1130,"columns":1134,"feature":1228},{"text":1131,"config":1132},"View all resources",{"href":1133,"dataGaName":1128,"dataGaLocation":974},"/resources/",[1135,1168,1195],{"title":1136,"items":1137},"Getting started",[1138,1143,1148,1153,1158,1163],{"text":1139,"config":1140},"Install",{"href":1141,"dataGaName":1142,"dataGaLocation":974},"/install/","install",{"text":1144,"config":1145},"Quick start guides",{"href":1146,"dataGaName":1147,"dataGaLocation":974},"/get-started/","quick setup checklists",{"text":1149,"config":1150},"Learn",{"href":1151,"dataGaLocation":974,"dataGaName":1152},"https://university.gitlab.com/","learn",{"text":1154,"config":1155},"Product documentation",{"href":1156,"dataGaName":1157,"dataGaLocation":974},"https://docs.gitlab.com/","product documentation",{"text":1159,"config":1160},"Best practice videos",{"href":1161,"dataGaName":1162,"dataGaLocation":974},"/getting-started-videos/","best practice videos",{"text":1164,"config":1165},"Integrations",{"href":1166,"dataGaName":1167,"dataGaLocation":974},"/integrations/","integrations",{"title":1169,"items":1170},"Discover",[1171,1176,1181,1186,1190],{"text":1172,"config":1173},"Customer success stories",{"href":1174,"dataGaName":1175,"dataGaLocation":974},"/customers/","customer success stories",{"text":1177,"config":1178},"Blog",{"href":1179,"dataGaName":1180,"dataGaLocation":974},"/blog/","blog",{"text":1182,"config":1183},"Demo Hub",{"href":1184,"dataGaName":1185,"dataGaLocation":974},"/demo-hub/","demo hub",{"text":1187,"config":1188},"The Source",{"href":1189,"dataGaName":1180,"dataGaLocation":974},"/the-source/",{"text":1191,"config":1192},"Remote",{"href":1193,"dataGaName":1194,"dataGaLocation":974},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1196,"items":1197},"Connect",[1198,1203,1208,1213,1218,1223],{"text":1199,"config":1200},"GitLab Services",{"href":1201,"dataGaName":1202,"dataGaLocation":974},"/services/","services",{"text":1204,"config":1205},"Contribute",{"href":1206,"dataGaName":1207,"dataGaLocation":974},"https://contributors.gitlab.com","contribute",{"text":1209,"config":1210},"Community",{"href":1211,"dataGaName":1212,"dataGaLocation":974},"/community/","community",{"text":1214,"config":1215},"Forum",{"href":1216,"dataGaName":1217,"dataGaLocation":974},"https://forum.gitlab.com/","forum",{"text":1219,"config":1220},"Events",{"href":1221,"dataGaName":1222,"dataGaLocation":974},"/events/","events",{"text":1224,"config":1225},"Partners",{"href":1226,"dataGaName":1227,"dataGaLocation":974},"/partners/","partners",{"config":1229,"title":1232,"text":1233,"link":1234},{"background":1230,"textColor":1231},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1235,"config":1236},"Read the latest",{"href":1237,"dataGaName":1238,"dataGaLocation":974},"/whats-new/","whats new",{"text":1240,"config":1241,"menu":1243},"Company",{"dataNavLevelOne":1242},"company",{"type":1025,"columns":1244},[1245],{"items":1246},[1247,1252,1258,1260,1265,1270,1275,1280,1285,1290],{"text":1248,"config":1249},"About",{"href":1250,"dataGaName":1251,"dataGaLocation":974},"/company/","about",{"text":1253,"config":1254,"footerGa":1257},"Jobs",{"href":1255,"dataGaName":1256,"dataGaLocation":974},"/jobs/","jobs",{"dataGaName":1256},{"text":1219,"config":1259},{"href":1221,"dataGaName":1222,"dataGaLocation":974},{"text":1261,"config":1262},"Leadership",{"href":1263,"dataGaName":1264,"dataGaLocation":974},"/company/team/e-group/","leadership",{"text":1266,"config":1267},"Handbook",{"href":1268,"dataGaName":1269,"dataGaLocation":974},"https://handbook.gitlab.com/","handbook",{"text":1271,"config":1272},"Investor relations",{"href":1273,"dataGaName":1274,"dataGaLocation":974},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1276,"config":1277},"Trust Center",{"href":1278,"dataGaName":1279,"dataGaLocation":974},"/security/","trust center",{"text":1281,"config":1282},"AI Transparency Center",{"href":1283,"dataGaName":1284,"dataGaLocation":974},"/ai-transparency-center/","ai transparency center",{"text":1286,"config":1287},"Newsletter",{"href":1288,"dataGaName":1289,"dataGaLocation":974},"/company/contact/#contact-forms","newsletter",{"text":1291,"config":1292},"Press",{"href":1293,"dataGaName":1294,"dataGaLocation":974},"/press/","press",{"text":1296,"config":1297,"menu":1298},"Contact us",{"dataNavLevelOne":1242},{"type":1025,"columns":1299},[1300],{"items":1301},[1302,1307,1312],{"text":1303,"config":1304},"Talk to sales",{"href":1305,"dataGaName":1306,"dataGaLocation":974},"/sales/","talk to sales",{"text":1308,"config":1309},"Support portal",{"href":1310,"dataGaName":1311,"dataGaLocation":974},"https://support.gitlab.com/hc/en-us","support portal",{"text":1313,"config":1314},"Customer portal",{"href":1315,"dataGaName":1316,"dataGaLocation":974},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1318,"login":1319,"suggestions":1326},"Close",{"text":1320,"link":1321},"To search repositories and projects, login to",{"text":1322,"config":1323},"gitlab.com",{"href":988,"dataGaName":1324,"dataGaLocation":1325},"search login","search",{"text":1327,"default":1328},"Suggestions",[1329,1331,1335,1337,1341,1345],{"text":1005,"config":1330},{"href":1010,"dataGaName":1005,"dataGaLocation":1325},{"text":1332,"config":1333},"Code Suggestions (AI)",{"href":1334,"dataGaName":1332,"dataGaLocation":1325},"/solutions/code-suggestions/",{"text":1041,"config":1336},{"href":1043,"dataGaName":1041,"dataGaLocation":1325},{"text":1338,"config":1339},"GitLab on AWS",{"href":1340,"dataGaName":1338,"dataGaLocation":1325},"/partners/technology-partners/aws/",{"text":1342,"config":1343},"GitLab on Google Cloud",{"href":1344,"dataGaName":1342,"dataGaLocation":1325},"/partners/technology-partners/google-cloud-platform/",{"text":1346,"config":1347},"Why GitLab?",{"href":1018,"dataGaName":1346,"dataGaLocation":1325},{"freeTrial":1349,"mobileIcon":1354,"desktopIcon":1359,"secondaryButton":1362},{"text":1350,"config":1351},"Start free trial",{"href":1352,"dataGaName":979,"dataGaLocation":1353},"https://gitlab.com/-/trials/new/","nav",{"altText":1355,"config":1356},"Gitlab Icon",{"src":1357,"dataGaName":1358,"dataGaLocation":1353},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1355,"config":1360},{"src":1361,"dataGaName":1358,"dataGaLocation":1353},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1363,"config":1364},"Get Started",{"href":1365,"dataGaName":1366,"dataGaLocation":1353},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1368,"mobileIcon":1372,"desktopIcon":1374},{"text":1369,"config":1370},"Learn more about GitLab Duo",{"href":1010,"dataGaName":1371,"dataGaLocation":1353},"gitlab duo",{"altText":1355,"config":1373},{"src":1357,"dataGaName":1358,"dataGaLocation":1353},{"altText":1355,"config":1375},{"src":1361,"dataGaName":1358,"dataGaLocation":1353},{"button":1377,"mobileIcon":1382,"desktopIcon":1384},{"text":1378,"config":1379},"/switch",{"href":1380,"dataGaName":1381,"dataGaLocation":1353},"#contact","switch",{"altText":1355,"config":1383},{"src":1357,"dataGaName":1358,"dataGaLocation":1353},{"altText":1355,"config":1385},{"src":1386,"dataGaName":1358,"dataGaLocation":1353},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1388,"mobileIcon":1393,"desktopIcon":1395},{"text":1389,"config":1390},"Back to pricing",{"href":1123,"dataGaName":1391,"dataGaLocation":1353,"icon":1392},"back to pricing","GoBack",{"altText":1355,"config":1394},{"src":1357,"dataGaName":1358,"dataGaLocation":1353},{"altText":1355,"config":1396},{"src":1361,"dataGaName":1358,"dataGaLocation":1353},{"title":1398,"titleMobile":1399,"button":1400,"config":1405},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1016,"config":1401},{"href":1402,"dataGaName":1403,"dataGaLocation":1404},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1406,"disabled":954},"release",{"data":1408},{"text":1409,"source":1410,"edit":1416,"contribute":1421,"config":1426,"items":1431,"minimal":1641},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1411,"config":1412},"View page source",{"href":1413,"dataGaName":1414,"dataGaLocation":1415},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1417,"config":1418},"Edit this page",{"href":1419,"dataGaName":1420,"dataGaLocation":1415},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1422,"config":1423},"Please contribute",{"href":1424,"dataGaName":1425,"dataGaLocation":1415},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1427,"facebook":1428,"youtube":1429,"linkedin":1430},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1432,1479,1533,1577,1609],{"title":1121,"links":1433,"subMenu":1448},[1434,1438,1443],{"text":1435,"config":1436},"View plans",{"href":1123,"dataGaName":1437,"dataGaLocation":1415},"view plans",{"text":1439,"config":1440},"Why Premium?",{"href":1441,"dataGaName":1442,"dataGaLocation":1415},"/pricing/premium/","why premium",{"text":1444,"config":1445},"Why Ultimate?",{"href":1446,"dataGaName":1447,"dataGaLocation":1415},"/pricing/ultimate/","why ultimate",[1449],{"title":1450,"links":1451},"Contact Us",[1452,1455,1457,1459,1464,1469,1474],{"text":1453,"config":1454},"Contact sales",{"href":1305,"dataGaName":984,"dataGaLocation":1415},{"text":1308,"config":1456},{"href":1310,"dataGaName":1311,"dataGaLocation":1415},{"text":1313,"config":1458},{"href":1315,"dataGaName":1316,"dataGaLocation":1415},{"text":1460,"config":1461},"Status",{"href":1462,"dataGaName":1463,"dataGaLocation":1415},"https://status.gitlab.com/","status",{"text":1465,"config":1466},"Terms of use",{"href":1467,"dataGaName":1468,"dataGaLocation":1415},"/terms/","terms of use",{"text":1470,"config":1471},"Privacy statement",{"href":1472,"dataGaName":1473,"dataGaLocation":1415},"/privacy/","privacy statement",{"text":1475,"config":1476},"Cookie preferences",{"dataGaName":1477,"dataGaLocation":1415,"id":1478,"isOneTrustButton":201},"cookie preferences","ot-sdk-btn",{"title":1021,"links":1480,"subMenu":1489},[1481,1485],{"text":1482,"config":1483},"DevSecOps platform",{"href":1003,"dataGaName":1484,"dataGaLocation":1415},"devsecops platform",{"text":1486,"config":1487},"AI-Assisted Development",{"href":1010,"dataGaName":1488,"dataGaLocation":1415},"ai-assisted development",[1490],{"title":1491,"links":1492},"Topics",[1493,1498,1503,1508,1513,1518,1523,1528],{"text":1494,"config":1495},"CICD",{"href":1496,"dataGaName":1497,"dataGaLocation":1415},"/topics/ci-cd/","cicd",{"text":1499,"config":1500},"GitOps",{"href":1501,"dataGaName":1502,"dataGaLocation":1415},"/topics/gitops/","gitops",{"text":1504,"config":1505},"DevOps",{"href":1506,"dataGaName":1507,"dataGaLocation":1415},"/topics/devops/","devops",{"text":1509,"config":1510},"Version Control",{"href":1511,"dataGaName":1512,"dataGaLocation":1415},"/topics/version-control/","version control",{"text":1514,"config":1515},"DevSecOps",{"href":1516,"dataGaName":1517,"dataGaLocation":1415},"/topics/devsecops/","devsecops",{"text":1519,"config":1520},"Cloud Native",{"href":1521,"dataGaName":1522,"dataGaLocation":1415},"/topics/cloud-native/","cloud native",{"text":1524,"config":1525},"AI for Coding",{"href":1526,"dataGaName":1527,"dataGaLocation":1415},"/topics/devops/ai-for-coding/","ai for coding",{"text":1529,"config":1530},"Agentic AI",{"href":1531,"dataGaName":1532,"dataGaLocation":1415},"/topics/agentic-ai/","agentic ai",{"title":1534,"links":1535},"Solutions",[1536,1538,1540,1545,1549,1552,1556,1559,1561,1564,1567,1572],{"text":1065,"config":1537},{"href":1060,"dataGaName":1065,"dataGaLocation":1415},{"text":1054,"config":1539},{"href":1037,"dataGaName":1038,"dataGaLocation":1415},{"text":1541,"config":1542},"Agile development",{"href":1543,"dataGaName":1544,"dataGaLocation":1415},"/solutions/agile-delivery/","agile delivery",{"text":1546,"config":1547},"SCM",{"href":1050,"dataGaName":1548,"dataGaLocation":1415},"source code management",{"text":1494,"config":1550},{"href":1043,"dataGaName":1551,"dataGaLocation":1415},"continuous integration & delivery",{"text":1553,"config":1554},"Value stream management",{"href":1093,"dataGaName":1555,"dataGaLocation":1415},"value stream management",{"text":1499,"config":1557},{"href":1558,"dataGaName":1502,"dataGaLocation":1415},"/solutions/gitops/",{"text":1103,"config":1560},{"href":1106,"dataGaName":1107,"dataGaLocation":1415},{"text":1562,"config":1563},"Small business",{"href":1112,"dataGaName":1113,"dataGaLocation":1415},{"text":1565,"config":1566},"Public sector",{"href":1118,"dataGaName":1119,"dataGaLocation":1415},{"text":1568,"config":1569},"Education",{"href":1570,"dataGaName":1571,"dataGaLocation":1415},"/solutions/education/","education",{"text":1573,"config":1574},"Financial services",{"href":1575,"dataGaName":1576,"dataGaLocation":1415},"/solutions/finance/","financial services",{"title":1126,"links":1578},[1579,1581,1583,1585,1588,1590,1593,1595,1597,1599,1601,1603,1605,1607],{"text":1139,"config":1580},{"href":1141,"dataGaName":1142,"dataGaLocation":1415},{"text":1144,"config":1582},{"href":1146,"dataGaName":1147,"dataGaLocation":1415},{"text":1149,"config":1584},{"href":1151,"dataGaName":1152,"dataGaLocation":1415},{"text":1154,"config":1586},{"href":1156,"dataGaName":1587,"dataGaLocation":1415},"docs",{"text":1177,"config":1589},{"href":1179,"dataGaName":1180,"dataGaLocation":1415},{"text":1591,"config":1592},"What's new",{"href":1237,"dataGaName":1238,"dataGaLocation":1415},{"text":1172,"config":1594},{"href":1174,"dataGaName":1175,"dataGaLocation":1415},{"text":1191,"config":1596},{"href":1193,"dataGaName":1194,"dataGaLocation":1415},{"text":1199,"config":1598},{"href":1201,"dataGaName":1202,"dataGaLocation":1415},{"text":1204,"config":1600},{"href":1206,"dataGaName":1207,"dataGaLocation":1415},{"text":1209,"config":1602},{"href":1211,"dataGaName":1212,"dataGaLocation":1415},{"text":1214,"config":1604},{"href":1216,"dataGaName":1217,"dataGaLocation":1415},{"text":1219,"config":1606},{"href":1221,"dataGaName":1222,"dataGaLocation":1415},{"text":1224,"config":1608},{"href":1226,"dataGaName":1227,"dataGaLocation":1415},{"title":1240,"links":1610},[1611,1613,1615,1617,1619,1621,1625,1630,1632,1634,1636],{"text":1248,"config":1612},{"href":1250,"dataGaName":1242,"dataGaLocation":1415},{"text":1253,"config":1614},{"href":1255,"dataGaName":1256,"dataGaLocation":1415},{"text":1261,"config":1616},{"href":1263,"dataGaName":1264,"dataGaLocation":1415},{"text":1266,"config":1618},{"href":1268,"dataGaName":1269,"dataGaLocation":1415},{"text":1271,"config":1620},{"href":1273,"dataGaName":1274,"dataGaLocation":1415},{"text":1622,"config":1623},"Sustainability",{"href":1624,"dataGaName":1622,"dataGaLocation":1415},"/sustainability/",{"text":1626,"config":1627},"Diversity, inclusion and belonging (DIB)",{"href":1628,"dataGaName":1629,"dataGaLocation":1415},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1276,"config":1631},{"href":1278,"dataGaName":1279,"dataGaLocation":1415},{"text":1286,"config":1633},{"href":1288,"dataGaName":1289,"dataGaLocation":1415},{"text":1291,"config":1635},{"href":1293,"dataGaName":1294,"dataGaLocation":1415},{"text":1637,"config":1638},"Modern Slavery Transparency Statement",{"href":1639,"dataGaName":1640,"dataGaLocation":1415},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1642},[1643,1646,1649],{"text":1644,"config":1645},"Terms",{"href":1467,"dataGaName":1468,"dataGaLocation":1415},{"text":1647,"config":1648},"Cookies",{"dataGaName":1477,"dataGaLocation":1415,"id":1478,"isOneTrustButton":201},{"text":1650,"config":1651},"Privacy",{"href":1472,"dataGaName":1473,"dataGaLocation":1415},[1653,1667,1678,1689,1701,1713],{"id":1654,"title":7,"body":953,"config":1655,"content":1657,"description":953,"extension":1661,"meta":1662,"navigation":201,"path":1663,"seo":1664,"stem":1665,"__hash__":1666},"blogAuthors/en-us/blog/authors/michael-henriksen.yml",{"template":1656},"BlogAuthor",{"name":7,"config":1658},{"headshot":1659,"ctfId":1660},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","3DmojnawcJFqAgoNMCpFTX","yml",{},"/en-us/blog/authors/michael-henriksen",{},"en-us/blog/authors/michael-henriksen","dTL4-g73rNy2nzSawJkuBZzClePkjmBsk3b5cEkIceg",{"id":1668,"title":8,"body":953,"config":1669,"content":1670,"description":953,"extension":1661,"meta":1673,"navigation":201,"path":1674,"seo":1675,"stem":1676,"__hash__":1677},"blogAuthors/en-us/blog/authors/martynas-krupskis.yml",{"template":1656},{"name":8,"config":1671},{"headshot":1659,"ctfId":1672},"3tK5S0f4QshGFGRrdEl7rn",{},"/en-us/blog/authors/martynas-krupskis",{},"en-us/blog/authors/martynas-krupskis","jF-G8mJ2BMnDXV6pkjS0gWlXnGhuB5YvZhPEwsbfJtc",{"id":1679,"title":9,"body":953,"config":1680,"content":1681,"description":953,"extension":1661,"meta":1684,"navigation":201,"path":1685,"seo":1686,"stem":1687,"__hash__":1688},"blogAuthors/en-us/blog/authors/mark-art.yml",{"template":1656},{"name":9,"config":1682},{"headshot":1659,"ctfId":1683},"55KCfyNmgPaJRmBZhiN7k5",{},"/en-us/blog/authors/mark-art",{},"en-us/blog/authors/mark-art","Q8q6LzNGjWl-Gu8Jfjft1zpzB85r784TwYc9N_PzsVo",{"id":1690,"title":10,"body":953,"config":1691,"content":1692,"description":953,"extension":1661,"meta":1696,"navigation":201,"path":1697,"seo":1698,"stem":1699,"__hash__":1700},"blogAuthors/en-us/blog/authors/dinesh-bolkensteyn.yml",{"template":1656},{"name":10,"config":1693},{"headshot":1694,"ctfId":1695},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1781016491/cs30c757njvhqnyizzmn.jpg","EpylYWgjPmFOL5NX3Zxmk",{},"/en-us/blog/authors/dinesh-bolkensteyn",{},"en-us/blog/authors/dinesh-bolkensteyn","Pv3nFIJV4WoNXz6FcpkaLOBx8QTtXH1KIVGmxt1GGME",{"id":1702,"title":11,"body":953,"config":1703,"content":1704,"description":953,"extension":1661,"meta":1708,"navigation":201,"path":1709,"seo":1710,"stem":1711,"__hash__":1712},"blogAuthors/en-us/blog/authors/isaac-dawson.yml",{"template":1656},{"name":11,"config":1705},{"headshot":1706,"ctfId":1707},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669814/Blog/Author%20Headshots/idawson-headshot.jpg","idawson",{},"/en-us/blog/authors/isaac-dawson",{},"en-us/blog/authors/isaac-dawson","UpCqyNOSlM21joWN2Eu9Z_uC29MGdlJWAYDQImap3w8",{"id":1714,"title":12,"body":953,"config":1715,"content":1716,"description":953,"extension":1661,"meta":1719,"navigation":201,"path":1720,"seo":1721,"stem":1722,"__hash__":1723},"blogAuthors/en-us/blog/authors/julian-thome.yml",{"template":1656},{"name":12,"config":1717},{"headshot":191,"ctfId":1718},"jthome",{},"/en-us/blog/authors/julian-thome",{},"en-us/blog/authors/julian-thome","60j2yTW0PuY7q83cXf4NkfzrKTRE2sUlVv5TXE6o1xM",[1725,1733,1741],{"title":1726,"description":1727,"heroImage":1728,"category":949,"date":1729,"authors":1730,"slug":1732,"externalUrl":953},"What's new in Git 2.55.0?","Learn about the new features and changes in Git 2.55, including a new git-history(1) fixup command, an fsmonitor daemon for Linux, pushing to remote groups, and more.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782732487/ztwgrvlolpifo01vj8qc.png","2026-06-29",[1731],"Toon Claes","whats-new-in-git-2-55-0",{"title":1734,"description":1735,"heroImage":1736,"category":949,"date":1737,"authors":1738,"slug":1740,"externalUrl":953},"GitLab AI Hackathon 2026: Meet the winners","Nearly 7,000 developers built 600+ AI agents and flows on GitLab Duo Agent Platform. Find out who won and what they created.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1776457632/llddiylsgwuze0u1rjks.png","2026-04-22",[1739],"Nick Veenhof","gitlab-ai-hackathon-2026-meet-the-winners",{"title":1742,"description":1743,"heroImage":1744,"category":949,"date":1745,"authors":1746,"slug":1748,"externalUrl":953},"What’s new in Git 2.54.0?","Learn about release contributions, including new repository maintenance, a new command to edit commit history, a replacement for git-sizer(1), and more.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782734716/ztwgrvlolpifo01vj8qc.png","2026-04-20",[1747],"Patrick Steinhardt","whats-new-in-git-2-54-0",{"promotions":1750},[1751,1765,1777,1789],{"id":1752,"categories":1753,"header":1755,"text":1756,"button":1757,"image":1762},"ai-modernization",[1754],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1758,"config":1759},"Get your AI maturity score",{"href":1760,"dataGaName":1761,"dataGaLocation":1180},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1763},{"src":1764},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1766,"categories":1767,"header":1769,"text":1756,"button":1770,"image":1774},"devops-modernization",[1768,1517],"product","Are you just managing tools or shipping innovation?",{"text":1771,"config":1772},"Get your DevOps maturity score",{"href":1773,"dataGaName":1761,"dataGaLocation":1180},"/assessments/devops-modernization-assessment/",{"config":1775},{"src":1776},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1778,"categories":1779,"header":1781,"text":1756,"button":1782,"image":1786},"security-modernization",[1780],"security","Are you trading speed for security?",{"text":1783,"config":1784},"Get your security maturity score",{"href":1785,"dataGaName":1761,"dataGaLocation":1180},"/assessments/security-modernization-assessment/",{"config":1787},{"src":1788},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1790,"paths":1791,"header":1794,"text":1795,"button":1796,"image":1801},"github-azure-migration",[1792,1793],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1797,"config":1798},"See how GitLab compares to GitHub",{"href":1799,"dataGaName":1800,"dataGaLocation":1180},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1802},{"src":1776},{"header":1804,"blurb":1805,"button":1806,"secondaryButton":1811},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1807,"config":1808},"Get your free trial",{"href":1809,"dataGaName":979,"dataGaLocation":1810},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1453,"config":1812},{"href":1305,"dataGaName":984,"dataGaLocation":1810},1786803753627]