[{"data":1,"prerenderedAt":1119},["ShallowReactive",2],{"/blog/a-community-driven-advisory-database":3,"navigation-en-us":299,"banner-en-us":727,"footer-en-us":737,"blog-post-authors-en-us-Mark Art|Dinesh Bolkensteyn|Isaac Dawson|Julian Thome":982,"blog-related-posts-en-us-a-community-driven-advisory-database":1032,"blog-promotions-en-us":1056,"next-steps-en-us":1109},{"id":4,"title":5,"authors":6,"body":11,"category":278,"date":279,"description":280,"extension":281,"externalUrl":282,"faq":282,"featured":283,"heroImage":284,"meta":285,"navigation":286,"path":287,"seo":288,"slug":293,"stem":294,"tags":295,"template":297,"updatedDate":282,"__hash__":298},"blogPosts/en-us/blog/a-community-driven-advisory-database.md","Introducing a community-driven advisory database for third-party software dependencies",[7,8,9,10],"Mark Art","Dinesh Bolkensteyn","Isaac Dawson","Julian Thome",{"type":12,"value":13,"toc":276},"minimark",[14,55,73,105,152,173,195,220,233,250,258,272],[15,16,17,18,24,25,30,31,36,37,42,43,48,49,54],"p",{},"GitLab provides a ",[19,20,23],"a",{"href":21,"rel":22},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency Scanning","\nfeature that can automatically detect vulnerabilities in your software\ndependencies. Dependency Scanning covers various programming languages and\nrelies on the ",[19,26,29],{"href":27,"rel":28},"https://gitlab.com/gitlab-org/security-products/gemnasium-db",[],"GitLab Advisory Database",", that\nis\n",[19,32,35],{"href":33,"rel":34},"https://gitlab.com/gitlab-org/security-products/gemnasium-db/activity",[],"updated","\non a periodic basis by the\n",[19,38,41],{"href":39,"rel":40},"https://handbook.gitlab.com/handbook/engineering/development/sec/secure/vulnerability-research/",[],"Vulnerability Research","\nteam at GitLab. The GitLab Advisory Database covers security advisories in software packages that have a CVE identifier, as well as malicious packages marked as such by their ecosystem (",[19,44,47],{"href":45,"rel":46},"https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/npm/lodahs/CVE-2019-19771.yml",[],"example","). The database is an essential part of\nthe Dependency Scanning feature, which is\n",[19,50,53],{"href":51,"rel":52},"https://about.gitlab.com/pricing/",[],"available"," in GitLab Ultimate self-managed\nand GitLab Ultimate SaaS.",[15,56,57,58,62,63,68,69,72],{},"As of recently, GitLab also provides a ",[59,60,61],"em",{},"free and open-source"," version of the\ndatabase, the ",[19,64,67],{"href":65,"rel":66},"https://gitlab.com/gitlab-org/advisories-community",[],"GitLab Advisory Database (Open Source Edition)",", a time-delayed\n(+30 days) clone of the ",[19,70,29],{"href":27,"rel":71},[],".",[15,74,75,76,81,82,87,88,93,94,99,100,104],{},"In the spirit of\n",[19,77,80],{"href":78,"rel":79},"https://handbook.gitlab.com/handbook/values/#collaboration",[],"Collaboration"," and\n",[19,83,86],{"href":84,"rel":85},"https://handbook.gitlab.com/handbook/values/#transparency",[],"Transparency",", two of\nthe ",[19,89,92],{"href":90,"rel":91},"https://handbook.gitlab.com/handbook/values/",[],"GitLab core values",", we share\nthe database with the open-source community in a format that is\n",[19,95,98],{"href":96,"rel":97},"https://gitlab.com/gitlab-org/security-products/gemnasium-db#yaml-schema",[],"well-documented","\nand can be easily parsed. The advisory data can be readily adopted, adapted, and\nexchanged. For example, links to proof of concepts or write-ups, or any other\ndirectly related information that will benefit the community, can be added to\nthe ",[101,102,103],"code",{},"urls"," array:",[106,107,112],"pre",{"className":108,"code":109,"language":110,"meta":111,"style":111},"language-yaml shiki shiki-themes github-light","urls:\n  - \"https://hackerone.com/reports/1104077\"\n  - \"https://nvd.nist.gov/vuln/detail/CVE-2021-28965\"\n  - \"https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/\"\n\n","yaml","",[101,113,114,126,136,144],{"__ignoreMap":111},[115,116,119,122],"span",{"class":117,"line":118},"line",1,[115,120,103],{"class":121},"shJU0",[115,123,125],{"class":124},"sgsFI",":\n",[115,127,129,132],{"class":117,"line":128},2,[115,130,131],{"class":124},"  - ",[115,133,135],{"class":134},"sYBdl","\"https://hackerone.com/reports/1104077\"\n",[115,137,139,141],{"class":117,"line":138},3,[115,140,131],{"class":124},[115,142,143],{"class":134},"\"https://nvd.nist.gov/vuln/detail/CVE-2021-28965\"\n",[115,145,147,149],{"class":117,"line":146},4,[115,148,131],{"class":124},[115,150,151],{"class":134},"\"https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/\"\n",[15,153,154,155,160,161,166,167,172],{},"Additionally, in our advisories we use ",[19,156,159],{"href":157,"rel":158},"https://cwe.mitre.org/index.html",[],"Common Weakness Enumeration","\nin conjunction with ",[19,162,165],{"href":163,"rel":164},"https://www.first.org/cvss/",[],"Common Vulnerability Scoring System"," as a standard means\nof ",[19,168,171],{"href":169,"rel":170},"https://handbook.gitlab.com/handbook/engineering/development/sec/secure/products/metrics/",[],"communicating vulnerabilities",", as well as their impact/severity, internally and externally.",[15,174,175,176,179,180,183,184,189,190,194],{},"The ",[19,177,29],{"href":27,"rel":178},[]," is integrated\ninto GitLab ",[19,181,23],{"href":21,"rel":182},[],". Once\nan existing advisory is modified or a new advisory is created, the information included in the advisory will appear\nin the ",[19,185,188],{"href":186,"rel":187},"https://docs.gitlab.com/user/application_security/vulnerabilities/",[],"Vulnerability Pages","\nwhere findings/vulnerabilities originating from all ",[19,191,193],{"href":192},"/stages-devops-lifecycle/secure/","security scanners",",\nincluding Dependency Scanning, can be managed at a central place.",[15,196,197,198,203,204,209,210,215,216,219],{},"The open-source database has recently been integrated into\n",[19,199,202],{"href":200,"rel":201},"https://github.com/aquasecurity/trivy",[],"Trivy",", a free and open-source solution\nfor ",[19,205,208],{"href":206,"rel":207},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"container scanning",".\nWe are very grateful for ",[19,211,214],{"href":212,"rel":213},"https://gitlab.com/gitlab-org/security-products/gemnasium-db#credits",[],"community contributions","\nto the ",[19,217,29],{"href":27,"rel":218},[],".\nOur community has aided us by suggesting improvements to our data or by\ncreating entirely new advisories, allowing everyone to benefit from their\ncontributions.",[15,221,222,223,228,229,232],{},"At GitLab, ",[19,224,227],{"href":225,"rel":226},"https://handbook.gitlab.com/handbook/company/mission/",[],"everyone can contribute",".\nThe ",[19,230,41],{"href":39,"rel":231},[],"\nteam at GitLab has made it easy to contribute to both databases.",[15,234,235,236,240,241,249],{},"Community contributions can be made available in\n",[19,237,239],{"href":65,"rel":238},[],"advisories-community","\ninstantaneously by means of the ",[19,242,245,248],{"href":243,"rel":244},"https://gitlab.com/gitlab-org/security-products/gemnasium-db#advisory-headers",[],[101,246,247],{},"community-sync"," flag",",\nwhich has been introduced recently. Using this synchronization, you can make\nthe same contribution appear in both databases at the time of a Merge Request\n(within one hour after the merge).",[15,251,252,253,257],{},"We have also used this flag to make the advisories concerning the recent\n",[19,254,256],{"href":255},"/blog/updates-and-actions-to-address-logj-in-gitlab/","log4Shell","\nvulnerabilities available to the community immediately after these were made public.\nEven though the open-source version of the database is time-delayed, particular\nvulnerabilities that have the potential to become widespread and cause\ndisruptions to the entire Internet, are pushed into the open-source version\nof the GitLab security advisory database.",[15,259,260,261,266,267],{},"Cover image by ",[19,262,265],{"href":263,"rel":264},"https://unsplash.com/@charlesdeluvio",[],"Charles Deluvio"," on ",[19,268,271],{"href":269,"rel":270},"https://unsplash.com/photos/AT5vuPoi8vc",[],"Unsplash",[273,274,275],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":111,"searchDepth":128,"depth":128,"links":277},[],"security","2022-02-16","The advisory data can be readily adopted, adapted, and exchanged. Learn more here.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749668354/Blog/Hero%20Images/handshake.png",{},true,"/en-us/blog/a-community-driven-advisory-database",{"title":289,"description":280,"ogTitle":289,"ogDescription":280,"noIndex":283,"ogImage":284,"ogUrl":290,"ogSiteName":291,"ogType":292,"canonicalUrls":290},"Community-driven advisory database for dependencies launched","https://about.gitlab.com/blog/a-community-driven-advisory-database","https://about.gitlab.com","article","a-community-driven-advisory-database","en-us/blog/a-community-driven-advisory-database",[278,296],"collaboration","BlogPost","rLkVu9PklIyE5txLq0g4zajFsf2o3pE4p0sl7wzxBNc",{"logo":300,"freeTrial":305,"sales":310,"login":315,"items":320,"search":647,"minimal":678,"duo":697,"switchNav":706,"pricingDeployment":717},{"config":301},{"href":302,"dataGaName":303,"dataGaLocation":304},"/","gitlab logo","header",{"text":306,"config":307},"Get free trial",{"href":308,"dataGaName":309,"dataGaLocation":304},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":311,"config":312},"Request a demo",{"href":313,"dataGaName":314,"dataGaLocation":304},"/sales/?contact-topic=request-demo","sales",{"text":316,"config":317},"Sign in",{"href":318,"dataGaName":319,"dataGaLocation":304},"https://gitlab.com/users/sign_in/","sign in",[321,350,450,455,569,625],{"text":322,"config":323,"menu":325},"Platform",{"dataNavLevelOne":324},"platform",{"type":326,"columns":327},"cards",[328,334,342],{"title":322,"description":329,"link":330},"The intelligent orchestration platform for DevSecOps",{"text":331,"config":332},"Explore our Platform",{"href":333,"dataGaName":324,"dataGaLocation":304},"/platform/",{"title":335,"description":336,"link":337},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":338,"config":339},"Meet GitLab Duo",{"href":340,"dataGaName":341,"dataGaLocation":304},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":343,"description":344,"link":345},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":346,"config":347},"Learn more",{"href":348,"dataGaName":349,"dataGaLocation":304},"/why-gitlab/","why gitlab",{"text":351,"left":286,"config":352,"menu":354},"Product",{"dataNavLevelOne":353},"solutions",{"type":355,"link":356,"columns":360,"feature":429},"lists",{"text":357,"config":358},"View all Solutions",{"href":359,"dataGaName":353,"dataGaLocation":304},"/solutions/",[361,385,408],{"title":362,"description":363,"link":364,"items":369},"Automation","CI/CD and automation to accelerate deployment",{"config":365},{"icon":366,"href":367,"dataGaName":368,"dataGaLocation":304},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[370,374,377,381],{"text":371,"config":372},"CI/CD",{"href":373,"dataGaLocation":304,"dataGaName":371},"/solutions/continuous-integration/",{"text":335,"config":375},{"href":340,"dataGaLocation":304,"dataGaName":376},"gitlab duo agent platform - product menu",{"text":378,"config":379},"Source Code Management",{"href":380,"dataGaLocation":304,"dataGaName":378},"/solutions/source-code-management/",{"text":382,"config":383},"Automated Software Delivery",{"href":367,"dataGaLocation":304,"dataGaName":384},"Automated software delivery",{"title":386,"description":387,"link":388,"items":393},"Security","Deliver code faster without compromising security",{"config":389},{"href":390,"dataGaName":391,"dataGaLocation":304,"icon":392},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[394,398,403],{"text":395,"config":396},"Application Security Testing",{"href":390,"dataGaName":397,"dataGaLocation":304},"Application security testing",{"text":399,"config":400},"Software Supply Chain Security",{"href":401,"dataGaLocation":304,"dataGaName":402},"/solutions/supply-chain/","Software supply chain security",{"text":404,"config":405},"Software Compliance",{"href":406,"dataGaName":407,"dataGaLocation":304},"/solutions/software-compliance/","software compliance",{"title":409,"link":410,"items":415},"Measurement",{"config":411},{"icon":412,"href":413,"dataGaName":414,"dataGaLocation":304},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[416,420,424],{"text":417,"config":418},"Visibility & Measurement",{"href":413,"dataGaLocation":304,"dataGaName":419},"Visibility and Measurement",{"text":421,"config":422},"Value Stream Management",{"href":423,"dataGaLocation":304,"dataGaName":421},"/solutions/value-stream-management/",{"text":425,"config":426},"Analytics & Insights",{"href":427,"dataGaLocation":304,"dataGaName":428},"/solutions/analytics-and-insights/","Analytics and insights",{"title":430,"type":355,"items":431},"GitLab for",[432,438,444],{"text":433,"config":434},"Enterprise",{"icon":435,"href":436,"dataGaLocation":304,"dataGaName":437},"Building","/enterprise/","enterprise",{"text":439,"config":440},"Small Business",{"icon":441,"href":442,"dataGaLocation":304,"dataGaName":443},"Work","/small-business/","small business",{"text":445,"config":446},"Public Sector",{"icon":447,"href":448,"dataGaLocation":304,"dataGaName":449},"Organization","/solutions/public-sector/","public sector",{"text":451,"config":452},"Pricing",{"href":453,"dataGaName":454,"dataGaLocation":304,"dataNavLevelOne":454},"/pricing/","pricing",{"text":456,"config":457,"menu":459},"Resources",{"dataNavLevelOne":458},"resources",{"type":355,"link":460,"columns":464,"feature":558},{"text":461,"config":462},"View all resources",{"href":463,"dataGaName":458,"dataGaLocation":304},"/resources/",[465,498,525],{"title":466,"items":467},"Getting started",[468,473,478,483,488,493],{"text":469,"config":470},"Install",{"href":471,"dataGaName":472,"dataGaLocation":304},"/install/","install",{"text":474,"config":475},"Quick start guides",{"href":476,"dataGaName":477,"dataGaLocation":304},"/get-started/","quick setup checklists",{"text":479,"config":480},"Learn",{"href":481,"dataGaLocation":304,"dataGaName":482},"https://university.gitlab.com/","learn",{"text":484,"config":485},"Product documentation",{"href":486,"dataGaName":487,"dataGaLocation":304},"https://docs.gitlab.com/","product documentation",{"text":489,"config":490},"Best practice videos",{"href":491,"dataGaName":492,"dataGaLocation":304},"/getting-started-videos/","best practice videos",{"text":494,"config":495},"Integrations",{"href":496,"dataGaName":497,"dataGaLocation":304},"/integrations/","integrations",{"title":499,"items":500},"Discover",[501,506,511,516,520],{"text":502,"config":503},"Customer success stories",{"href":504,"dataGaName":505,"dataGaLocation":304},"/customers/","customer success stories",{"text":507,"config":508},"Blog",{"href":509,"dataGaName":510,"dataGaLocation":304},"/blog/","blog",{"text":512,"config":513},"Demo Hub",{"href":514,"dataGaName":515,"dataGaLocation":304},"/demo-hub/","demo hub",{"text":517,"config":518},"The Source",{"href":519,"dataGaName":510,"dataGaLocation":304},"/the-source/",{"text":521,"config":522},"Remote",{"href":523,"dataGaName":524,"dataGaLocation":304},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":526,"items":527},"Connect",[528,533,538,543,548,553],{"text":529,"config":530},"GitLab Services",{"href":531,"dataGaName":532,"dataGaLocation":304},"/services/","services",{"text":534,"config":535},"Contribute",{"href":536,"dataGaName":537,"dataGaLocation":304},"https://contributors.gitlab.com","contribute",{"text":539,"config":540},"Community",{"href":541,"dataGaName":542,"dataGaLocation":304},"/community/","community",{"text":544,"config":545},"Forum",{"href":546,"dataGaName":547,"dataGaLocation":304},"https://forum.gitlab.com/","forum",{"text":549,"config":550},"Events",{"href":551,"dataGaName":552,"dataGaLocation":304},"/events/","events",{"text":554,"config":555},"Partners",{"href":556,"dataGaName":557,"dataGaLocation":304},"/partners/","partners",{"config":559,"title":562,"text":563,"link":564},{"background":560,"textColor":561},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":565,"config":566},"Read the latest",{"href":567,"dataGaName":568,"dataGaLocation":304},"/whats-new/","whats new",{"text":570,"config":571,"menu":573},"Company",{"dataNavLevelOne":572},"company",{"type":355,"columns":574},[575],{"items":576},[577,582,588,590,595,600,605,610,615,620],{"text":578,"config":579},"About",{"href":580,"dataGaName":581,"dataGaLocation":304},"/company/","about",{"text":583,"config":584,"footerGa":587},"Jobs",{"href":585,"dataGaName":586,"dataGaLocation":304},"/jobs/","jobs",{"dataGaName":586},{"text":549,"config":589},{"href":551,"dataGaName":552,"dataGaLocation":304},{"text":591,"config":592},"Leadership",{"href":593,"dataGaName":594,"dataGaLocation":304},"/company/team/e-group/","leadership",{"text":596,"config":597},"Handbook",{"href":598,"dataGaName":599,"dataGaLocation":304},"https://handbook.gitlab.com/","handbook",{"text":601,"config":602},"Investor relations",{"href":603,"dataGaName":604,"dataGaLocation":304},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":606,"config":607},"Trust Center",{"href":608,"dataGaName":609,"dataGaLocation":304},"/security/","trust center",{"text":611,"config":612},"AI Transparency Center",{"href":613,"dataGaName":614,"dataGaLocation":304},"/ai-transparency-center/","ai transparency center",{"text":616,"config":617},"Newsletter",{"href":618,"dataGaName":619,"dataGaLocation":304},"/company/contact/#contact-forms","newsletter",{"text":621,"config":622},"Press",{"href":623,"dataGaName":624,"dataGaLocation":304},"/press/","press",{"text":626,"config":627,"menu":628},"Contact us",{"dataNavLevelOne":572},{"type":355,"columns":629},[630],{"items":631},[632,637,642],{"text":633,"config":634},"Talk to sales",{"href":635,"dataGaName":636,"dataGaLocation":304},"/sales/","talk to sales",{"text":638,"config":639},"Support portal",{"href":640,"dataGaName":641,"dataGaLocation":304},"https://support.gitlab.com/hc/en-us","support portal",{"text":643,"config":644},"Customer portal",{"href":645,"dataGaName":646,"dataGaLocation":304},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":648,"login":649,"suggestions":656},"Close",{"text":650,"link":651},"To search repositories and projects, login to",{"text":652,"config":653},"gitlab.com",{"href":318,"dataGaName":654,"dataGaLocation":655},"search login","search",{"text":657,"default":658},"Suggestions",[659,661,665,667,671,675],{"text":335,"config":660},{"href":340,"dataGaName":335,"dataGaLocation":655},{"text":662,"config":663},"Code Suggestions (AI)",{"href":664,"dataGaName":662,"dataGaLocation":655},"/solutions/code-suggestions/",{"text":371,"config":666},{"href":373,"dataGaName":371,"dataGaLocation":655},{"text":668,"config":669},"GitLab on AWS",{"href":670,"dataGaName":668,"dataGaLocation":655},"/partners/technology-partners/aws/",{"text":672,"config":673},"GitLab on Google Cloud",{"href":674,"dataGaName":672,"dataGaLocation":655},"/partners/technology-partners/google-cloud-platform/",{"text":676,"config":677},"Why GitLab?",{"href":348,"dataGaName":676,"dataGaLocation":655},{"freeTrial":679,"mobileIcon":684,"desktopIcon":689,"secondaryButton":692},{"text":680,"config":681},"Start free trial",{"href":682,"dataGaName":309,"dataGaLocation":683},"https://gitlab.com/-/trials/new/","nav",{"altText":685,"config":686},"Gitlab Icon",{"src":687,"dataGaName":688,"dataGaLocation":683},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":685,"config":690},{"src":691,"dataGaName":688,"dataGaLocation":683},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":693,"config":694},"Get Started",{"href":695,"dataGaName":696,"dataGaLocation":683},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":698,"mobileIcon":702,"desktopIcon":704},{"text":699,"config":700},"Learn more about GitLab Duo",{"href":340,"dataGaName":701,"dataGaLocation":683},"gitlab duo",{"altText":685,"config":703},{"src":687,"dataGaName":688,"dataGaLocation":683},{"altText":685,"config":705},{"src":691,"dataGaName":688,"dataGaLocation":683},{"button":707,"mobileIcon":712,"desktopIcon":714},{"text":708,"config":709},"/switch",{"href":710,"dataGaName":711,"dataGaLocation":683},"#contact","switch",{"altText":685,"config":713},{"src":687,"dataGaName":688,"dataGaLocation":683},{"altText":685,"config":715},{"src":716,"dataGaName":688,"dataGaLocation":683},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":718,"mobileIcon":723,"desktopIcon":725},{"text":719,"config":720},"Back to pricing",{"href":453,"dataGaName":721,"dataGaLocation":683,"icon":722},"back to pricing","GoBack",{"altText":685,"config":724},{"src":687,"dataGaName":688,"dataGaLocation":683},{"altText":685,"config":726},{"src":691,"dataGaName":688,"dataGaLocation":683},{"title":728,"titleMobile":729,"button":730,"config":735},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":346,"config":731},{"href":732,"dataGaName":733,"dataGaLocation":734},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":736,"disabled":283},"release",{"data":738},{"text":739,"source":740,"edit":746,"contribute":751,"config":756,"items":761,"minimal":971},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":741,"config":742},"View page source",{"href":743,"dataGaName":744,"dataGaLocation":745},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":747,"config":748},"Edit this page",{"href":749,"dataGaName":750,"dataGaLocation":745},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":752,"config":753},"Please contribute",{"href":754,"dataGaName":755,"dataGaLocation":745},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":757,"facebook":758,"youtube":759,"linkedin":760},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[762,809,863,907,939],{"title":451,"links":763,"subMenu":778},[764,768,773],{"text":765,"config":766},"View plans",{"href":453,"dataGaName":767,"dataGaLocation":745},"view plans",{"text":769,"config":770},"Why Premium?",{"href":771,"dataGaName":772,"dataGaLocation":745},"/pricing/premium/","why premium",{"text":774,"config":775},"Why Ultimate?",{"href":776,"dataGaName":777,"dataGaLocation":745},"/pricing/ultimate/","why ultimate",[779],{"title":780,"links":781},"Contact Us",[782,785,787,789,794,799,804],{"text":783,"config":784},"Contact sales",{"href":635,"dataGaName":314,"dataGaLocation":745},{"text":638,"config":786},{"href":640,"dataGaName":641,"dataGaLocation":745},{"text":643,"config":788},{"href":645,"dataGaName":646,"dataGaLocation":745},{"text":790,"config":791},"Status",{"href":792,"dataGaName":793,"dataGaLocation":745},"https://status.gitlab.com/","status",{"text":795,"config":796},"Terms of use",{"href":797,"dataGaName":798,"dataGaLocation":745},"/terms/","terms of use",{"text":800,"config":801},"Privacy statement",{"href":802,"dataGaName":803,"dataGaLocation":745},"/privacy/","privacy statement",{"text":805,"config":806},"Cookie preferences",{"dataGaName":807,"dataGaLocation":745,"id":808,"isOneTrustButton":286},"cookie preferences","ot-sdk-btn",{"title":351,"links":810,"subMenu":819},[811,815],{"text":812,"config":813},"DevSecOps platform",{"href":333,"dataGaName":814,"dataGaLocation":745},"devsecops platform",{"text":816,"config":817},"AI-Assisted Development",{"href":340,"dataGaName":818,"dataGaLocation":745},"ai-assisted development",[820],{"title":821,"links":822},"Topics",[823,828,833,838,843,848,853,858],{"text":824,"config":825},"CICD",{"href":826,"dataGaName":827,"dataGaLocation":745},"/topics/ci-cd/","cicd",{"text":829,"config":830},"GitOps",{"href":831,"dataGaName":832,"dataGaLocation":745},"/topics/gitops/","gitops",{"text":834,"config":835},"DevOps",{"href":836,"dataGaName":837,"dataGaLocation":745},"/topics/devops/","devops",{"text":839,"config":840},"Version Control",{"href":841,"dataGaName":842,"dataGaLocation":745},"/topics/version-control/","version control",{"text":844,"config":845},"DevSecOps",{"href":846,"dataGaName":847,"dataGaLocation":745},"/topics/devsecops/","devsecops",{"text":849,"config":850},"Cloud Native",{"href":851,"dataGaName":852,"dataGaLocation":745},"/topics/cloud-native/","cloud native",{"text":854,"config":855},"AI for Coding",{"href":856,"dataGaName":857,"dataGaLocation":745},"/topics/devops/ai-for-coding/","ai for coding",{"text":859,"config":860},"Agentic AI",{"href":861,"dataGaName":862,"dataGaLocation":745},"/topics/agentic-ai/","agentic ai",{"title":864,"links":865},"Solutions",[866,868,870,875,879,882,886,889,891,894,897,902],{"text":395,"config":867},{"href":390,"dataGaName":395,"dataGaLocation":745},{"text":384,"config":869},{"href":367,"dataGaName":368,"dataGaLocation":745},{"text":871,"config":872},"Agile development",{"href":873,"dataGaName":874,"dataGaLocation":745},"/solutions/agile-delivery/","agile delivery",{"text":876,"config":877},"SCM",{"href":380,"dataGaName":878,"dataGaLocation":745},"source code management",{"text":824,"config":880},{"href":373,"dataGaName":881,"dataGaLocation":745},"continuous integration & delivery",{"text":883,"config":884},"Value stream management",{"href":423,"dataGaName":885,"dataGaLocation":745},"value stream management",{"text":829,"config":887},{"href":888,"dataGaName":832,"dataGaLocation":745},"/solutions/gitops/",{"text":433,"config":890},{"href":436,"dataGaName":437,"dataGaLocation":745},{"text":892,"config":893},"Small business",{"href":442,"dataGaName":443,"dataGaLocation":745},{"text":895,"config":896},"Public sector",{"href":448,"dataGaName":449,"dataGaLocation":745},{"text":898,"config":899},"Education",{"href":900,"dataGaName":901,"dataGaLocation":745},"/solutions/education/","education",{"text":903,"config":904},"Financial services",{"href":905,"dataGaName":906,"dataGaLocation":745},"/solutions/finance/","financial services",{"title":456,"links":908},[909,911,913,915,918,920,923,925,927,929,931,933,935,937],{"text":469,"config":910},{"href":471,"dataGaName":472,"dataGaLocation":745},{"text":474,"config":912},{"href":476,"dataGaName":477,"dataGaLocation":745},{"text":479,"config":914},{"href":481,"dataGaName":482,"dataGaLocation":745},{"text":484,"config":916},{"href":486,"dataGaName":917,"dataGaLocation":745},"docs",{"text":507,"config":919},{"href":509,"dataGaName":510,"dataGaLocation":745},{"text":921,"config":922},"What's new",{"href":567,"dataGaName":568,"dataGaLocation":745},{"text":502,"config":924},{"href":504,"dataGaName":505,"dataGaLocation":745},{"text":521,"config":926},{"href":523,"dataGaName":524,"dataGaLocation":745},{"text":529,"config":928},{"href":531,"dataGaName":532,"dataGaLocation":745},{"text":534,"config":930},{"href":536,"dataGaName":537,"dataGaLocation":745},{"text":539,"config":932},{"href":541,"dataGaName":542,"dataGaLocation":745},{"text":544,"config":934},{"href":546,"dataGaName":547,"dataGaLocation":745},{"text":549,"config":936},{"href":551,"dataGaName":552,"dataGaLocation":745},{"text":554,"config":938},{"href":556,"dataGaName":557,"dataGaLocation":745},{"title":570,"links":940},[941,943,945,947,949,951,955,960,962,964,966],{"text":578,"config":942},{"href":580,"dataGaName":572,"dataGaLocation":745},{"text":583,"config":944},{"href":585,"dataGaName":586,"dataGaLocation":745},{"text":591,"config":946},{"href":593,"dataGaName":594,"dataGaLocation":745},{"text":596,"config":948},{"href":598,"dataGaName":599,"dataGaLocation":745},{"text":601,"config":950},{"href":603,"dataGaName":604,"dataGaLocation":745},{"text":952,"config":953},"Sustainability",{"href":954,"dataGaName":952,"dataGaLocation":745},"/sustainability/",{"text":956,"config":957},"Diversity, inclusion and belonging (DIB)",{"href":958,"dataGaName":959,"dataGaLocation":745},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":606,"config":961},{"href":608,"dataGaName":609,"dataGaLocation":745},{"text":616,"config":963},{"href":618,"dataGaName":619,"dataGaLocation":745},{"text":621,"config":965},{"href":623,"dataGaName":624,"dataGaLocation":745},{"text":967,"config":968},"Modern Slavery Transparency Statement",{"href":969,"dataGaName":970,"dataGaLocation":745},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":972},[973,976,979],{"text":974,"config":975},"Terms",{"href":797,"dataGaName":798,"dataGaLocation":745},{"text":977,"config":978},"Cookies",{"dataGaName":807,"dataGaLocation":745,"id":808,"isOneTrustButton":286},{"text":980,"config":981},"Privacy",{"href":802,"dataGaName":803,"dataGaLocation":745},[983,997,1009,1021],{"id":984,"title":7,"body":282,"config":985,"content":987,"description":282,"extension":991,"meta":992,"navigation":286,"path":993,"seo":994,"stem":995,"__hash__":996},"blogAuthors/en-us/blog/authors/mark-art.yml",{"template":986},"BlogAuthor",{"name":7,"config":988},{"headshot":989,"ctfId":990},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","55KCfyNmgPaJRmBZhiN7k5","yml",{},"/en-us/blog/authors/mark-art",{},"en-us/blog/authors/mark-art","Q8q6LzNGjWl-Gu8Jfjft1zpzB85r784TwYc9N_PzsVo",{"id":998,"title":8,"body":282,"config":999,"content":1000,"description":282,"extension":991,"meta":1004,"navigation":286,"path":1005,"seo":1006,"stem":1007,"__hash__":1008},"blogAuthors/en-us/blog/authors/dinesh-bolkensteyn.yml",{"template":986},{"name":8,"config":1001},{"headshot":1002,"ctfId":1003},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1781016491/cs30c757njvhqnyizzmn.jpg","EpylYWgjPmFOL5NX3Zxmk",{},"/en-us/blog/authors/dinesh-bolkensteyn",{},"en-us/blog/authors/dinesh-bolkensteyn","Pv3nFIJV4WoNXz6FcpkaLOBx8QTtXH1KIVGmxt1GGME",{"id":1010,"title":9,"body":282,"config":1011,"content":1012,"description":282,"extension":991,"meta":1016,"navigation":286,"path":1017,"seo":1018,"stem":1019,"__hash__":1020},"blogAuthors/en-us/blog/authors/isaac-dawson.yml",{"template":986},{"name":9,"config":1013},{"headshot":1014,"ctfId":1015},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669814/Blog/Author%20Headshots/idawson-headshot.jpg","idawson",{},"/en-us/blog/authors/isaac-dawson",{},"en-us/blog/authors/isaac-dawson","UpCqyNOSlM21joWN2Eu9Z_uC29MGdlJWAYDQImap3w8",{"id":1022,"title":10,"body":282,"config":1023,"content":1024,"description":282,"extension":991,"meta":1027,"navigation":286,"path":1028,"seo":1029,"stem":1030,"__hash__":1031},"blogAuthors/en-us/blog/authors/julian-thome.yml",{"template":986},{"name":10,"config":1025},{"headshot":111,"ctfId":1026},"jthome",{},"/en-us/blog/authors/julian-thome",{},"en-us/blog/authors/julian-thome","60j2yTW0PuY7q83cXf4NkfzrKTRE2sUlVv5TXE6o1xM",[1033,1040,1048],{"title":1034,"description":1035,"heroImage":1036,"category":278,"date":1037,"authors":1038,"slug":1039,"externalUrl":282},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[10],"improved-scope-offset-fingerprinting",{"title":1041,"description":1042,"heroImage":1036,"category":278,"date":1043,"authors":1044,"slug":1047,"externalUrl":282},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1045,1046],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1049,"description":1050,"heroImage":1051,"category":278,"date":1052,"authors":1053,"slug":1055,"externalUrl":282},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1054],"Alisa Ho","claude-security-and-gitlab",{"promotions":1057},[1058,1072,1084,1095],{"id":1059,"categories":1060,"header":1062,"text":1063,"button":1064,"image":1069},"ai-modernization",[1061],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1065,"config":1066},"Get your AI maturity score",{"href":1067,"dataGaName":1068,"dataGaLocation":510},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1070},{"src":1071},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1073,"categories":1074,"header":1076,"text":1063,"button":1077,"image":1081},"devops-modernization",[1075,847],"product","Are you just managing tools or shipping innovation?",{"text":1078,"config":1079},"Get your DevOps maturity score",{"href":1080,"dataGaName":1068,"dataGaLocation":510},"/assessments/devops-modernization-assessment/",{"config":1082},{"src":1083},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1085,"categories":1086,"header":1087,"text":1063,"button":1088,"image":1092},"security-modernization",[278],"Are you trading speed for security?",{"text":1089,"config":1090},"Get your security maturity score",{"href":1091,"dataGaName":1068,"dataGaLocation":510},"/assessments/security-modernization-assessment/",{"config":1093},{"src":1094},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1096,"paths":1097,"header":1100,"text":1101,"button":1102,"image":1107},"github-azure-migration",[1098,1099],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1103,"config":1104},"See how GitLab compares to GitHub",{"href":1105,"dataGaName":1106,"dataGaLocation":510},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1108},{"src":1083},{"header":1110,"blurb":1111,"button":1112,"secondaryButton":1117},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1113,"config":1114},"Get your free trial",{"href":1115,"dataGaName":309,"dataGaLocation":1116},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":783,"config":1118},{"href":635,"dataGaName":314,"dataGaLocation":1116},1786803744304]