[{"data":1,"prerenderedAt":1087},["ShallowReactive",2],{"/blog/align-engineering-security-appsec-tests-in-ci":3,"navigation-en-us":306,"banner-en-us":731,"footer-en-us":741,"blog-post-authors-en-us-Joni Klippert":983,"blog-related-posts-en-us-align-engineering-security-appsec-tests-in-ci":998,"blog-promotions-en-us":1024,"next-steps-en-us":1077},{"id":4,"title":5,"authors":6,"body":8,"category":281,"date":282,"description":283,"extension":284,"externalUrl":285,"faq":285,"featured":286,"heroImage":287,"meta":288,"navigation":289,"path":290,"seo":291,"slug":296,"stem":297,"tags":298,"template":304,"updatedDate":285,"__hash__":305},"blogPosts/en-us/blog/align-engineering-security-appsec-tests-in-ci.md","How developer-centric AppSec testing can dramatically change your DevOps team",[7],"Joni Klippert",{"type":9,"value":10,"toc":265},"minimark",[11,21,24,45,58,63,66,69,72,75,79,82,86,89,109,113,116,137,141,150,154,157,166,169,174,183,187,190,195,198,202,205,209,217,220,223,227,246,251],[12,13,14,15,20],"p",{},"Software development has accelerated dramatically over the past decade. As ",[16,17,19],"a",{"href":18},"/topics/devops/","DevOps"," became pervasive, companies went from shipping software monthly to shipping software to production frequently throughout the day. This happened as engineering teams took ownership of the deployment, performance, and resilience of their software.",[12,22,23],{},"And it has paid off. Companies that have adopted DevOps are deploying software significantly faster, ultimately driving business value as innovation is more rapidly delivered to customers.",[12,25,26,27,32,33,38,39,44],{},"Security, however, did not keep up. Security teams typically fell into one of two positions - the blocker of frequent deployments or the team perpetually bringing up issues in last month’s work. The need for a shift in the security model is widely known. It was the subject of the ",[16,28,31],{"href":29,"rel":30},"https://www.blackhat.com/us-19/briefings/schedule/index.html#every-security-team-is-a-software-team-now-17280",[],"2019 Black Hat Conference keynote",", stats from GitLab’s ",[16,34,37],{"href":35,"rel":36},"https://about.gitlab.com/resources/downloads/2020-devsecops-report.pdf",[],"2020 Global DevSecOps Survey"," make this obvious, and we’ve ",[16,40,43],{"href":41,"rel":42},"https://www.stackhawk.com/blog/application-security-is-broken/",[],"shared our opinions"," at StackHawk.",[12,46,47,48,52,53,57],{},"I believe there is a solution (or at least a ",[49,50,51],"em",{},"huge"," step in the right direction)... developer-centric ",[16,54,56],{"href":55},"/topics/devsecops/","application security"," tooling in the CI pipeline.",[59,60,62],"h2",{"id":61},"the-ci-pipeline-aligns-engineering-and-security","The CI pipeline aligns engineering and security",[12,64,65],{},"While some in the industry have been debating the term DevSecOps, leading companies have started adopting developer-first security tooling that brings alignment through the CI pipeline. Instrumented correctly, it ensures that security bugs are caught before they hit production and that the fix cycle is drastically shortened.",[12,67,68],{},"The legacy model has security teams running application security tests against production environments. These sort of checks are great if they are your backstop. But if this is the primary way of assessing your application’s security posture, you need to catch up with modern engineering practices.",[12,70,71],{},"Modern teams are running checks on each microservice that makes up the customer facing application, catching bugs in pipeline, and equipping developers with the information to self serve fixes and triage issues. Fix times are significantly shorter, as developers are still in the context of the code they were working on. By testing microservices vs. the end state application, the underlying bugs are much easier to find and fix. And with developer-centric tooling, developers can fix bugs themselves instead of cycling through siloed internal processes. This structure better aligns each function with their best skill sets. Engineers know the application the best and are most equipped to fix, and security teams are able to focus on strategy instead of Jira ticket creation.",[12,73,74],{},"The key is to get the instrumentation right (read: don’t break the build for stupid stuff).",[59,76,78],{"id":77},"application-security-tests-in-ci","Application security tests in CI",[12,80,81],{},"That sounds great in theory, but what does it look like in practice? Getting started is actually more simple than it seems. We suggest adding three application security tests to start:",[59,83,85],{"id":84},"software-composition-analysis-sca","Software composition analysis (SCA)",[12,87,88],{},"SCA identifies the open source dependencies in your code base and compares that against a database of known security vulnerabilities. Some tools automatically create pull requests to patch outdated libraries. Open source use is exponentially growing, especially with chained dependencies. SCA is incredibly important, but also can be noisy with non-exploitable findings.",[12,90,91,92,96,97,102,103,108],{},"Some of the leading vendors in the space are ",[16,93,95],{"href":94},"/","GitLab"," and ",[16,98,101],{"href":99,"rel":100},"https://snyk.io/",[],"Snyk",", with up and comers like ",[16,104,107],{"href":105,"rel":106},"https://fossa.com/",[],"FOSSA"," also worth paying attention to.",[59,110,112],{"id":111},"dynamic-application-security-testing-dast","Dynamic application security testing (DAST)",[12,114,115],{},"DAST runs security tests against your running application, from localhost to CI to production. The beauty of DAST is that it most closely resembles what an attacker would see, by attacking your running application and reducing false positives. The two things to be sure of as you start testing with DAST is that your scanner is finding all of your paths and API endpoints and that it is able to scan as an authenticated user.",[12,117,118,119,124,125,130,131,136],{},"GitLab provides DAST checks for Ultimate tier customers. If you want more robust scanning options and additional functionality to manage and fix bugs, ",[16,120,123],{"href":121,"rel":122},"https://www.stackhawk.com",[],"StackHawk"," is the only place to turn (obviously I’m biased here). Other solutions include legacy vendors such as ",[16,126,129],{"href":127,"rel":128},"https://www.rapid7.com/",[],"Rapid7"," or open source leader ",[16,132,135],{"href":133,"rel":134},"https://www.zaproxy.org/",[],"ZAP",".",[59,138,140],{"id":139},"secrets-detection","Secrets detection",[12,142,143,144,149],{},"Finally, you’ll want to ensure that you have detection for leaked secrets in code. This tooling looks for credentials, keys, or other secrets that may have unintentionally been committed to the code base by developers. GitLab includes ",[16,145,148],{"href":146,"rel":147},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"secret detection"," in their GitLab Ultimate security tooling.",[59,151,153],{"id":152},"getting-started","Getting started",[12,155,156],{},"Oftentimes, the thought of adding application security tests to the development workflow feels insurmountable. With a long list of priorities, engineering leadership will sometimes put this off. The reality, however, is that it is not that hard.",[12,158,159,160,165],{},"At StackHawk, we see many customers completing their first successful scans within 15 minutes of sign up and instrumentation in CI is literally as easy as adding ",[16,161,164],{"href":162,"rel":163},"https://docs.stackhawk.com/continuous-integration/",[],"a few lines of YAML"," to your build.",[12,167,168],{},"Here is our recommended playbook of how to get started with AppSec in CI. While this is specific to StackHawk, the principles can be applied to other tools as well.",[170,171,173],"h3",{"id":172},"step-1-local-testing-and-config","Step 1: local testing and config",[12,175,176,177,182],{},"After signing up and grabbing your API key, start iterating on ",[16,178,181],{"href":179,"rel":180},"https://docs.stackhawk.com/hawkscan/configuration/",[],"configuration"," while testing against your application on localhost. This allows you to quickly adjust config and get successful authenticated scans running.",[170,184,186],{"id":185},"step-2-non-blocking-ci-instrumentation","Step 2: non-blocking CI instrumentation",[12,188,189],{},"After you’ve ironed out the configuration locally, add the test to your CI pipeline. At this point, it is strongly recommended to instrument as a non-blocking test so that you can triage any existing findings and smooth out any kinks.",[191,192,194],"h4",{"id":193},"step-3-bug-triage-fix-critical-issues-in-flight-backlog-and-discuss-the-rest","Step 3: bug triage - fix critical issues in flight, backlog and discuss the rest",[12,196,197],{},"After your first non-blocking CI run, start triaging any initial findings. Any bugs marked as High criticality should likely be fixed with some sense of urgency. Lows and Mediums should be triaged depending on your application and the bugs, either quickly addressed or added to a backlog for review. Existing findings should not be the blocker for you instrumenting checks to ensure that new bugs don’t get shipped to production.",[191,199,201],{"id":200},"step-4-switch-to-blocking-tests","Step 4: switch to blocking tests",[12,203,204],{},"After ironing out config locally and in CI, and then triaging initial findings, it is time to finalize the roll out. Switch the StackHawk test to blocking mode to ensure that new security bugs don’t hit production. You can set the scanner to break on High or Medium and High, which depends on your business and the nature of the application. With this in place, you can be confident that production-ready applications have been scanned for security.",[59,206,208],{"id":207},"cultural-shifts-it-is-more-than-ci","Cultural shifts: it is more than CI",[12,210,211,212,216],{},"The CI pipeline is the natural hingepoint to start aligning engineering and security. A cultural shift, however, is absolutely needed. (If you're doubtful about this, here's a frank look at why ",[16,213,215],{"href":214},"/blog/developer-security-divide/","dev and sec don't get along",".) Modern engineering teams recognize that delivering a secure application is part of quality engineering. Engineers aren’t comfortable shipping applications with UI bugs, and they shouldn’t accept security holes either.",[12,218,219],{},"Security, on the other hand, needs to shift from the blocker to speedy development and to the enabler of safety in an environment of high speed delivery. Modern security engineers are ensuring that their teams are working with safe-by-default frameworks, are equipped with developer-centric tooling, and that there are proper integration tests for business logic that can’t be tested by external tooling.",[12,221,222],{},"While there is significant catch up needed, it is encouraging to see the leading software teams out there testing application security on every build.",[59,224,226],{"id":225},"dig-deeper","Dig deeper",[12,228,229,230,235,236,240,241,136],{},"To learn more about adding AppSec tests to your CI build, join me at my ",[16,231,234],{"href":232,"rel":233},"https://sched.co/dUWD",[],"How Security Belongs in DevOps"," talk at GitLab Commit on August 26th. You can also always sign up for a ",[16,237,239],{"href":121,"rel":238},[],"free StackHawk trial or demo"," or talk to your GitLab sales representative about the security features in GitLab Ultimate. And for the best of both worlds, check out more details on running ",[16,242,245],{"href":243,"rel":244},"https://docs.stackhawk.com/continuous-integration/gitlab.html",[],"automated security testing with StackHawk in GitLab",[12,247,248],{},[49,249,250],{},"Joni Klippert is founder & CEO of StackHawk, a software-as-a-service company built to help developers find and fix security vulnerabilities in their code. Joni has been building software for developers for more than 10 years, previously serving as VP Product, VictorOps from seed stage to acquisition by Splunk. Joni is a Colorado native and holds an MBA from the University of Colorado. She currently lives in Denver with her fiance Jason and Whippet \"Q\".",[12,252,253,254,259,260],{},"Cover image by ",[16,255,258],{"href":256,"rel":257},"https://unsplash.com/@adigold1",[],"Adi Goldstein"," on ",[16,261,264],{"href":262,"rel":263},"https://unsplash.com",[],"Unsplash",{"title":266,"searchDepth":267,"depth":267,"links":268},"",2,[269,270,271,272,273,274,279,280],{"id":61,"depth":267,"text":62},{"id":77,"depth":267,"text":78},{"id":84,"depth":267,"text":85},{"id":111,"depth":267,"text":112},{"id":139,"depth":267,"text":140},{"id":152,"depth":267,"text":153,"children":275},[276,278],{"id":172,"depth":277,"text":173},3,{"id":185,"depth":277,"text":186},{"id":207,"depth":267,"text":208},{"id":225,"depth":267,"text":226},"engineering","2020-08-21","Find and fix security bugs faster by implementing developer-centric application security testing in the CI pipeline. And the bonus? Engineering and security will finally be better aligned.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749681513/Blog/Hero%20Images/stackhawk.jpg",{},true,"/en-us/blog/align-engineering-security-appsec-tests-in-ci",{"title":292,"description":283,"ogTitle":292,"ogDescription":283,"noIndex":286,"ogImage":287,"ogUrl":293,"ogSiteName":294,"ogType":295,"canonicalUrls":293},"How Developer-Centric AppSec Testing Transforms DevOps Teams","https://about.gitlab.com/blog/align-engineering-security-appsec-tests-in-ci","https://about.gitlab.com","article","align-engineering-security-appsec-tests-in-ci","en-us/blog/align-engineering-security-appsec-tests-in-ci",[299,300,19,301,302,303],"CI/CD","collaboration","security","testing","workflow","BlogPost","DfW-7k6dcbyTEBwe_80Akqo2OzQd9tpdY3jJQywaQFU",{"logo":307,"freeTrial":311,"sales":316,"login":321,"items":326,"search":651,"minimal":682,"duo":701,"switchNav":710,"pricingDeployment":721},{"config":308},{"href":94,"dataGaName":309,"dataGaLocation":310},"gitlab logo","header",{"text":312,"config":313},"Get free trial",{"href":314,"dataGaName":315,"dataGaLocation":310},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":317,"config":318},"Request a demo",{"href":319,"dataGaName":320,"dataGaLocation":310},"/sales/?contact-topic=request-demo","sales",{"text":322,"config":323},"Sign in",{"href":324,"dataGaName":325,"dataGaLocation":310},"https://gitlab.com/users/sign_in/","sign in",[327,356,455,460,573,629],{"text":328,"config":329,"menu":331},"Platform",{"dataNavLevelOne":330},"platform",{"type":332,"columns":333},"cards",[334,340,348],{"title":328,"description":335,"link":336},"The intelligent orchestration platform for DevSecOps",{"text":337,"config":338},"Explore our Platform",{"href":339,"dataGaName":330,"dataGaLocation":310},"/platform/",{"title":341,"description":342,"link":343},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":344,"config":345},"Meet GitLab Duo",{"href":346,"dataGaName":347,"dataGaLocation":310},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":349,"description":350,"link":351},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":352,"config":353},"Learn more",{"href":354,"dataGaName":355,"dataGaLocation":310},"/why-gitlab/","why gitlab",{"text":357,"left":289,"config":358,"menu":360},"Product",{"dataNavLevelOne":359},"solutions",{"type":361,"link":362,"columns":366,"feature":434},"lists",{"text":363,"config":364},"View all Solutions",{"href":365,"dataGaName":359,"dataGaLocation":310},"/solutions/",[367,390,413],{"title":368,"description":369,"link":370,"items":375},"Automation","CI/CD and automation to accelerate deployment",{"config":371},{"icon":372,"href":373,"dataGaName":374,"dataGaLocation":310},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[376,379,382,386],{"text":299,"config":377},{"href":378,"dataGaLocation":310,"dataGaName":299},"/solutions/continuous-integration/",{"text":341,"config":380},{"href":346,"dataGaLocation":310,"dataGaName":381},"gitlab duo agent platform - product menu",{"text":383,"config":384},"Source Code Management",{"href":385,"dataGaLocation":310,"dataGaName":383},"/solutions/source-code-management/",{"text":387,"config":388},"Automated Software Delivery",{"href":373,"dataGaLocation":310,"dataGaName":389},"Automated software delivery",{"title":391,"description":392,"link":393,"items":398},"Security","Deliver code faster without compromising security",{"config":394},{"href":395,"dataGaName":396,"dataGaLocation":310,"icon":397},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[399,403,408],{"text":400,"config":401},"Application Security Testing",{"href":395,"dataGaName":402,"dataGaLocation":310},"Application security testing",{"text":404,"config":405},"Software Supply Chain Security",{"href":406,"dataGaLocation":310,"dataGaName":407},"/solutions/supply-chain/","Software supply chain security",{"text":409,"config":410},"Software Compliance",{"href":411,"dataGaName":412,"dataGaLocation":310},"/solutions/software-compliance/","software compliance",{"title":414,"link":415,"items":420},"Measurement",{"config":416},{"icon":417,"href":418,"dataGaName":419,"dataGaLocation":310},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[421,425,429],{"text":422,"config":423},"Visibility & Measurement",{"href":418,"dataGaLocation":310,"dataGaName":424},"Visibility and Measurement",{"text":426,"config":427},"Value Stream Management",{"href":428,"dataGaLocation":310,"dataGaName":426},"/solutions/value-stream-management/",{"text":430,"config":431},"Analytics & Insights",{"href":432,"dataGaLocation":310,"dataGaName":433},"/solutions/analytics-and-insights/","Analytics and insights",{"title":435,"type":361,"items":436},"GitLab for",[437,443,449],{"text":438,"config":439},"Enterprise",{"icon":440,"href":441,"dataGaLocation":310,"dataGaName":442},"Building","/enterprise/","enterprise",{"text":444,"config":445},"Small Business",{"icon":446,"href":447,"dataGaLocation":310,"dataGaName":448},"Work","/small-business/","small business",{"text":450,"config":451},"Public Sector",{"icon":452,"href":453,"dataGaLocation":310,"dataGaName":454},"Organization","/solutions/public-sector/","public sector",{"text":456,"config":457},"Pricing",{"href":458,"dataGaName":459,"dataGaLocation":310,"dataNavLevelOne":459},"/pricing/","pricing",{"text":461,"config":462,"menu":464},"Resources",{"dataNavLevelOne":463},"resources",{"type":361,"link":465,"columns":469,"feature":562},{"text":466,"config":467},"View all resources",{"href":468,"dataGaName":463,"dataGaLocation":310},"/resources/",[470,502,529],{"title":153,"items":471},[472,477,482,487,492,497],{"text":473,"config":474},"Install",{"href":475,"dataGaName":476,"dataGaLocation":310},"/install/","install",{"text":478,"config":479},"Quick start guides",{"href":480,"dataGaName":481,"dataGaLocation":310},"/get-started/","quick setup checklists",{"text":483,"config":484},"Learn",{"href":485,"dataGaLocation":310,"dataGaName":486},"https://university.gitlab.com/","learn",{"text":488,"config":489},"Product documentation",{"href":490,"dataGaName":491,"dataGaLocation":310},"https://docs.gitlab.com/","product documentation",{"text":493,"config":494},"Best practice videos",{"href":495,"dataGaName":496,"dataGaLocation":310},"/getting-started-videos/","best practice videos",{"text":498,"config":499},"Integrations",{"href":500,"dataGaName":501,"dataGaLocation":310},"/integrations/","integrations",{"title":503,"items":504},"Discover",[505,510,515,520,524],{"text":506,"config":507},"Customer success stories",{"href":508,"dataGaName":509,"dataGaLocation":310},"/customers/","customer success stories",{"text":511,"config":512},"Blog",{"href":513,"dataGaName":514,"dataGaLocation":310},"/blog/","blog",{"text":516,"config":517},"Demo Hub",{"href":518,"dataGaName":519,"dataGaLocation":310},"/demo-hub/","demo hub",{"text":521,"config":522},"The Source",{"href":523,"dataGaName":514,"dataGaLocation":310},"/the-source/",{"text":525,"config":526},"Remote",{"href":527,"dataGaName":528,"dataGaLocation":310},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":530,"items":531},"Connect",[532,537,542,547,552,557],{"text":533,"config":534},"GitLab Services",{"href":535,"dataGaName":536,"dataGaLocation":310},"/services/","services",{"text":538,"config":539},"Contribute",{"href":540,"dataGaName":541,"dataGaLocation":310},"https://contributors.gitlab.com","contribute",{"text":543,"config":544},"Community",{"href":545,"dataGaName":546,"dataGaLocation":310},"/community/","community",{"text":548,"config":549},"Forum",{"href":550,"dataGaName":551,"dataGaLocation":310},"https://forum.gitlab.com/","forum",{"text":553,"config":554},"Events",{"href":555,"dataGaName":556,"dataGaLocation":310},"/events/","events",{"text":558,"config":559},"Partners",{"href":560,"dataGaName":561,"dataGaLocation":310},"/partners/","partners",{"config":563,"title":566,"text":567,"link":568},{"background":564,"textColor":565},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":569,"config":570},"Read the latest",{"href":571,"dataGaName":572,"dataGaLocation":310},"/whats-new/","whats new",{"text":574,"config":575,"menu":577},"Company",{"dataNavLevelOne":576},"company",{"type":361,"columns":578},[579],{"items":580},[581,586,592,594,599,604,609,614,619,624],{"text":582,"config":583},"About",{"href":584,"dataGaName":585,"dataGaLocation":310},"/company/","about",{"text":587,"config":588,"footerGa":591},"Jobs",{"href":589,"dataGaName":590,"dataGaLocation":310},"/jobs/","jobs",{"dataGaName":590},{"text":553,"config":593},{"href":555,"dataGaName":556,"dataGaLocation":310},{"text":595,"config":596},"Leadership",{"href":597,"dataGaName":598,"dataGaLocation":310},"/company/team/e-group/","leadership",{"text":600,"config":601},"Handbook",{"href":602,"dataGaName":603,"dataGaLocation":310},"https://handbook.gitlab.com/","handbook",{"text":605,"config":606},"Investor relations",{"href":607,"dataGaName":608,"dataGaLocation":310},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":610,"config":611},"Trust Center",{"href":612,"dataGaName":613,"dataGaLocation":310},"/security/","trust center",{"text":615,"config":616},"AI Transparency Center",{"href":617,"dataGaName":618,"dataGaLocation":310},"/ai-transparency-center/","ai transparency center",{"text":620,"config":621},"Newsletter",{"href":622,"dataGaName":623,"dataGaLocation":310},"/company/contact/#contact-forms","newsletter",{"text":625,"config":626},"Press",{"href":627,"dataGaName":628,"dataGaLocation":310},"/press/","press",{"text":630,"config":631,"menu":632},"Contact us",{"dataNavLevelOne":576},{"type":361,"columns":633},[634],{"items":635},[636,641,646],{"text":637,"config":638},"Talk to sales",{"href":639,"dataGaName":640,"dataGaLocation":310},"/sales/","talk to sales",{"text":642,"config":643},"Support portal",{"href":644,"dataGaName":645,"dataGaLocation":310},"https://support.gitlab.com/hc/en-us","support portal",{"text":647,"config":648},"Customer portal",{"href":649,"dataGaName":650,"dataGaLocation":310},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":652,"login":653,"suggestions":660},"Close",{"text":654,"link":655},"To search repositories and projects, login to",{"text":656,"config":657},"gitlab.com",{"href":324,"dataGaName":658,"dataGaLocation":659},"search login","search",{"text":661,"default":662},"Suggestions",[663,665,669,671,675,679],{"text":341,"config":664},{"href":346,"dataGaName":341,"dataGaLocation":659},{"text":666,"config":667},"Code Suggestions (AI)",{"href":668,"dataGaName":666,"dataGaLocation":659},"/solutions/code-suggestions/",{"text":299,"config":670},{"href":378,"dataGaName":299,"dataGaLocation":659},{"text":672,"config":673},"GitLab on AWS",{"href":674,"dataGaName":672,"dataGaLocation":659},"/partners/technology-partners/aws/",{"text":676,"config":677},"GitLab on Google Cloud",{"href":678,"dataGaName":676,"dataGaLocation":659},"/partners/technology-partners/google-cloud-platform/",{"text":680,"config":681},"Why GitLab?",{"href":354,"dataGaName":680,"dataGaLocation":659},{"freeTrial":683,"mobileIcon":688,"desktopIcon":693,"secondaryButton":696},{"text":684,"config":685},"Start free trial",{"href":686,"dataGaName":315,"dataGaLocation":687},"https://gitlab.com/-/trials/new/","nav",{"altText":689,"config":690},"Gitlab Icon",{"src":691,"dataGaName":692,"dataGaLocation":687},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":689,"config":694},{"src":695,"dataGaName":692,"dataGaLocation":687},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":697,"config":698},"Get Started",{"href":699,"dataGaName":700,"dataGaLocation":687},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":702,"mobileIcon":706,"desktopIcon":708},{"text":703,"config":704},"Learn more about GitLab Duo",{"href":346,"dataGaName":705,"dataGaLocation":687},"gitlab duo",{"altText":689,"config":707},{"src":691,"dataGaName":692,"dataGaLocation":687},{"altText":689,"config":709},{"src":695,"dataGaName":692,"dataGaLocation":687},{"button":711,"mobileIcon":716,"desktopIcon":718},{"text":712,"config":713},"/switch",{"href":714,"dataGaName":715,"dataGaLocation":687},"#contact","switch",{"altText":689,"config":717},{"src":691,"dataGaName":692,"dataGaLocation":687},{"altText":689,"config":719},{"src":720,"dataGaName":692,"dataGaLocation":687},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":722,"mobileIcon":727,"desktopIcon":729},{"text":723,"config":724},"Back to pricing",{"href":458,"dataGaName":725,"dataGaLocation":687,"icon":726},"back to pricing","GoBack",{"altText":689,"config":728},{"src":691,"dataGaName":692,"dataGaLocation":687},{"altText":689,"config":730},{"src":695,"dataGaName":692,"dataGaLocation":687},{"title":732,"titleMobile":733,"button":734,"config":739},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":352,"config":735},{"href":736,"dataGaName":737,"dataGaLocation":738},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":740,"disabled":286},"release",{"data":742},{"text":743,"source":744,"edit":750,"contribute":755,"config":760,"items":765,"minimal":972},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":745,"config":746},"View page source",{"href":747,"dataGaName":748,"dataGaLocation":749},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":751,"config":752},"Edit this page",{"href":753,"dataGaName":754,"dataGaLocation":749},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":756,"config":757},"Please contribute",{"href":758,"dataGaName":759,"dataGaLocation":749},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":761,"facebook":762,"youtube":763,"linkedin":764},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[766,813,864,908,940],{"title":456,"links":767,"subMenu":782},[768,772,777],{"text":769,"config":770},"View plans",{"href":458,"dataGaName":771,"dataGaLocation":749},"view plans",{"text":773,"config":774},"Why Premium?",{"href":775,"dataGaName":776,"dataGaLocation":749},"/pricing/premium/","why premium",{"text":778,"config":779},"Why Ultimate?",{"href":780,"dataGaName":781,"dataGaLocation":749},"/pricing/ultimate/","why ultimate",[783],{"title":784,"links":785},"Contact Us",[786,789,791,793,798,803,808],{"text":787,"config":788},"Contact sales",{"href":639,"dataGaName":320,"dataGaLocation":749},{"text":642,"config":790},{"href":644,"dataGaName":645,"dataGaLocation":749},{"text":647,"config":792},{"href":649,"dataGaName":650,"dataGaLocation":749},{"text":794,"config":795},"Status",{"href":796,"dataGaName":797,"dataGaLocation":749},"https://status.gitlab.com/","status",{"text":799,"config":800},"Terms of use",{"href":801,"dataGaName":802,"dataGaLocation":749},"/terms/","terms of use",{"text":804,"config":805},"Privacy statement",{"href":806,"dataGaName":807,"dataGaLocation":749},"/privacy/","privacy statement",{"text":809,"config":810},"Cookie preferences",{"dataGaName":811,"dataGaLocation":749,"id":812,"isOneTrustButton":289},"cookie preferences","ot-sdk-btn",{"title":357,"links":814,"subMenu":823},[815,819],{"text":816,"config":817},"DevSecOps platform",{"href":339,"dataGaName":818,"dataGaLocation":749},"devsecops platform",{"text":820,"config":821},"AI-Assisted Development",{"href":346,"dataGaName":822,"dataGaLocation":749},"ai-assisted development",[824],{"title":825,"links":826},"Topics",[827,832,837,840,845,849,854,859],{"text":828,"config":829},"CICD",{"href":830,"dataGaName":831,"dataGaLocation":749},"/topics/ci-cd/","cicd",{"text":833,"config":834},"GitOps",{"href":835,"dataGaName":836,"dataGaLocation":749},"/topics/gitops/","gitops",{"text":19,"config":838},{"href":18,"dataGaName":839,"dataGaLocation":749},"devops",{"text":841,"config":842},"Version Control",{"href":843,"dataGaName":844,"dataGaLocation":749},"/topics/version-control/","version control",{"text":846,"config":847},"DevSecOps",{"href":55,"dataGaName":848,"dataGaLocation":749},"devsecops",{"text":850,"config":851},"Cloud Native",{"href":852,"dataGaName":853,"dataGaLocation":749},"/topics/cloud-native/","cloud native",{"text":855,"config":856},"AI for Coding",{"href":857,"dataGaName":858,"dataGaLocation":749},"/topics/devops/ai-for-coding/","ai for coding",{"text":860,"config":861},"Agentic AI",{"href":862,"dataGaName":863,"dataGaLocation":749},"/topics/agentic-ai/","agentic ai",{"title":865,"links":866},"Solutions",[867,869,871,876,880,883,887,890,892,895,898,903],{"text":400,"config":868},{"href":395,"dataGaName":400,"dataGaLocation":749},{"text":389,"config":870},{"href":373,"dataGaName":374,"dataGaLocation":749},{"text":872,"config":873},"Agile development",{"href":874,"dataGaName":875,"dataGaLocation":749},"/solutions/agile-delivery/","agile delivery",{"text":877,"config":878},"SCM",{"href":385,"dataGaName":879,"dataGaLocation":749},"source code management",{"text":828,"config":881},{"href":378,"dataGaName":882,"dataGaLocation":749},"continuous integration & delivery",{"text":884,"config":885},"Value stream management",{"href":428,"dataGaName":886,"dataGaLocation":749},"value stream management",{"text":833,"config":888},{"href":889,"dataGaName":836,"dataGaLocation":749},"/solutions/gitops/",{"text":438,"config":891},{"href":441,"dataGaName":442,"dataGaLocation":749},{"text":893,"config":894},"Small business",{"href":447,"dataGaName":448,"dataGaLocation":749},{"text":896,"config":897},"Public sector",{"href":453,"dataGaName":454,"dataGaLocation":749},{"text":899,"config":900},"Education",{"href":901,"dataGaName":902,"dataGaLocation":749},"/solutions/education/","education",{"text":904,"config":905},"Financial services",{"href":906,"dataGaName":907,"dataGaLocation":749},"/solutions/finance/","financial services",{"title":461,"links":909},[910,912,914,916,919,921,924,926,928,930,932,934,936,938],{"text":473,"config":911},{"href":475,"dataGaName":476,"dataGaLocation":749},{"text":478,"config":913},{"href":480,"dataGaName":481,"dataGaLocation":749},{"text":483,"config":915},{"href":485,"dataGaName":486,"dataGaLocation":749},{"text":488,"config":917},{"href":490,"dataGaName":918,"dataGaLocation":749},"docs",{"text":511,"config":920},{"href":513,"dataGaName":514,"dataGaLocation":749},{"text":922,"config":923},"What's new",{"href":571,"dataGaName":572,"dataGaLocation":749},{"text":506,"config":925},{"href":508,"dataGaName":509,"dataGaLocation":749},{"text":525,"config":927},{"href":527,"dataGaName":528,"dataGaLocation":749},{"text":533,"config":929},{"href":535,"dataGaName":536,"dataGaLocation":749},{"text":538,"config":931},{"href":540,"dataGaName":541,"dataGaLocation":749},{"text":543,"config":933},{"href":545,"dataGaName":546,"dataGaLocation":749},{"text":548,"config":935},{"href":550,"dataGaName":551,"dataGaLocation":749},{"text":553,"config":937},{"href":555,"dataGaName":556,"dataGaLocation":749},{"text":558,"config":939},{"href":560,"dataGaName":561,"dataGaLocation":749},{"title":574,"links":941},[942,944,946,948,950,952,956,961,963,965,967],{"text":582,"config":943},{"href":584,"dataGaName":576,"dataGaLocation":749},{"text":587,"config":945},{"href":589,"dataGaName":590,"dataGaLocation":749},{"text":595,"config":947},{"href":597,"dataGaName":598,"dataGaLocation":749},{"text":600,"config":949},{"href":602,"dataGaName":603,"dataGaLocation":749},{"text":605,"config":951},{"href":607,"dataGaName":608,"dataGaLocation":749},{"text":953,"config":954},"Sustainability",{"href":955,"dataGaName":953,"dataGaLocation":749},"/sustainability/",{"text":957,"config":958},"Diversity, inclusion and belonging (DIB)",{"href":959,"dataGaName":960,"dataGaLocation":749},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":610,"config":962},{"href":612,"dataGaName":613,"dataGaLocation":749},{"text":620,"config":964},{"href":622,"dataGaName":623,"dataGaLocation":749},{"text":625,"config":966},{"href":627,"dataGaName":628,"dataGaLocation":749},{"text":968,"config":969},"Modern Slavery Transparency Statement",{"href":970,"dataGaName":971,"dataGaLocation":749},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":973},[974,977,980],{"text":975,"config":976},"Terms",{"href":801,"dataGaName":802,"dataGaLocation":749},{"text":978,"config":979},"Cookies",{"dataGaName":811,"dataGaLocation":749,"id":812,"isOneTrustButton":289},{"text":981,"config":982},"Privacy",{"href":806,"dataGaName":807,"dataGaLocation":749},[984],{"id":985,"title":7,"body":285,"config":986,"content":988,"description":285,"extension":992,"meta":993,"navigation":289,"path":994,"seo":995,"stem":996,"__hash__":997},"blogAuthors/en-us/blog/authors/joni-klippert.yml",{"template":987},"BlogAuthor",{"name":7,"config":989},{"headshot":990,"ctfId":991},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","Joni-Klippert","yml",{},"/en-us/blog/authors/joni-klippert",{},"en-us/blog/authors/joni-klippert","FR-wbcZjgNkmvOT4704POmDg5loLWGkTQsLagRuo0YM",[999,1008,1016],{"title":1000,"description":1001,"heroImage":1002,"category":281,"date":1003,"authors":1004,"slug":1007,"externalUrl":285},"Confidential AI for GitLab Self-Hosted","Give developers AI coding agents in GitLab Duo without source code leaving a hardware-encrypted boundary — no GPUs needed.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773866173/vte9qh8rriznvyclhkes.png","2026-08-06",[1005,1006],"Mathias Ewald","Martin Paloncy, Edgeless Systems","confidential-ai-for-gitlab-self-hosted",{"title":1009,"description":1010,"heroImage":1011,"category":281,"date":1012,"authors":1013,"slug":1015,"externalUrl":285},"Green DevOps: Why carbon measurement belongs in your CI/CD pipeline","CI/CD pipelines have a hidden carbon cost. Here's why measuring it matters, and how you can get started with Eco CI and Carmen in GitLab.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1765809212/noh0mdfn9o94ry9ykura.png","2026-07-09",[1014],"Lysanne Pinto","green-devops-carbon-measurement-cicd-pipeline",{"title":1017,"description":1018,"heroImage":1019,"category":281,"date":1020,"authors":1021,"slug":1023,"externalUrl":285},"How to build CI/CD observability at scale","This practical guide to GitLab pipeline analytics helps self-managed users gain operational insights using Prometheus and Grafana.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774465167/n5hlvrsrheadeccyr1oz.png","2026-04-28",[1022],"Paul Meresanu","how-to-build-ci-cd-observability-at-scale",{"promotions":1025},[1026,1040,1052,1063],{"id":1027,"categories":1028,"header":1030,"text":1031,"button":1032,"image":1037},"ai-modernization",[1029],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1033,"config":1034},"Get your AI maturity score",{"href":1035,"dataGaName":1036,"dataGaLocation":514},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1038},{"src":1039},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1041,"categories":1042,"header":1044,"text":1031,"button":1045,"image":1049},"devops-modernization",[1043,848],"product","Are you just managing tools or shipping innovation?",{"text":1046,"config":1047},"Get your DevOps maturity score",{"href":1048,"dataGaName":1036,"dataGaLocation":514},"/assessments/devops-modernization-assessment/",{"config":1050},{"src":1051},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1053,"categories":1054,"header":1055,"text":1031,"button":1056,"image":1060},"security-modernization",[301],"Are you trading speed for security?",{"text":1057,"config":1058},"Get your security maturity score",{"href":1059,"dataGaName":1036,"dataGaLocation":514},"/assessments/security-modernization-assessment/",{"config":1061},{"src":1062},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1064,"paths":1065,"header":1068,"text":1069,"button":1070,"image":1075},"github-azure-migration",[1066,1067],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1071,"config":1072},"See how GitLab compares to GitHub",{"href":1073,"dataGaName":1074,"dataGaLocation":514},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1076},{"src":1051},{"header":1078,"blurb":1079,"button":1080,"secondaryButton":1085},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1081,"config":1082},"Get your free trial",{"href":1083,"dataGaName":315,"dataGaLocation":1084},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":787,"config":1086},{"href":639,"dataGaName":320,"dataGaLocation":1084},1786803753972]