[{"data":1,"prerenderedAt":1034},["ShallowReactive",2],{"/blog/ask-gitlab-security-paul-harrison":3,"navigation-en-us":248,"banner-en-us":676,"footer-en-us":686,"blog-post-authors-en-us-Heather Simpson":931,"blog-related-posts-en-us-ask-gitlab-security-paul-harrison":946,"blog-promotions-en-us":971,"next-steps-en-us":1024},{"id":4,"title":5,"authors":6,"body":8,"category":227,"date":228,"description":229,"extension":230,"externalUrl":231,"faq":231,"featured":232,"heroImage":233,"meta":234,"navigation":235,"path":236,"seo":237,"slug":241,"stem":242,"tags":243,"template":246,"updatedDate":231,"__hash__":247},"blogPosts/en-us/blog/ask-gitlab-security-paul-harrison.md","Ask GitLab Security: Paul Harrison",[7],"Heather Simpson",{"type":9,"value":10,"toc":221},"minimark",[11,15,18,25,32,38,44,56,72,77,80,84,93,97,107,111,120,124,127,131,134,138,146,152,160,167,178,182,191,200,204,207,211,214,218],[12,13,14],"p",{},"What’s it like working to secure one of the most transparent organizations\nin the world?  To be a security practitioner in a highly iterative and agile\nenvironment? What does that look like and what kind of people thrive in that\nenvironment? It takes a certain individual ... curious, analytical,\ncollaborative and dedicated. Of course, there’s more than meets the eye when\nit comes to our GitLab Security team; they also tackle the hard topics like\nthe age-old 'Is a hotdog a sandwich?' debate, Vim vs Emacs, and Linux\ndistros.",[12,16,17],{},"We take securing the GitLab product and service and protecting our company\nvery seriously. But, we try not to take ourselves too seriously. We hope you\nlearn something new in this series, but that you enjoy yourself too.",[12,19,20],{},[21,22],"img",{"alt":23,"src":24},"Paul Harrison Headshot","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398820/blog/Content%20Images/paul-harrison-headshot.png",[12,26,27,31],{},[28,29,30],"strong",{},"Name:"," Paul Harrison",[12,33,34,37],{},[28,35,36],{},"Title:"," Senior Security Engineer / Interim Security Manager, Security\nOperations",[12,39,40,43],{},[28,41,42],{},"How long have you been at GitLab?"," I started in January 2019",[12,45,46,49,50],{},[28,47,48],{},"GitLab handle:"," ",[51,52,55],"a",{"href":53,"rel":54},"https://gitlab.com/pharrison",[],"@pharrison",[12,57,58,49,61,66,67],{},[28,59,60],{},"Connect with Paul:",[51,62,65],{"href":63,"rel":64},"https://www.linkedin.com/in/pharrison33",[],"LinkedIn"," /\n",[51,68,71],{"href":69,"rel":70},"https://twitter.com/iyampaul",[],"Twitter",[73,74,76],"h4",{"id":75},"tell-us-what-you-do-here-at-gitlab","Tell us what you do here at GitLab:",[12,78,79],{},"I’m responsible for defining and implementing the operational security\nresponse processes and procedures to handle new and emerging risks to GitLab\nthe company, the product, and GitLab.com. I’m also involved in day-to-day\nsecurity event handling and engaging with partner teams around GitLab on any\nrelated questions or issues.",[73,81,83],{"id":82},"whats-the-most-challenging-or-rewarding-aspect-of-your-role","What’s the most challenging or rewarding aspect of your role?",[12,85,86,87,92],{},"The most challenging AND rewarding aspect is helping to design our security\nposture and working to meet those goals one step at a time. This is\nincredibly unique and challenging as we’re 100 percent remote, the\ntopography of the company and its environments is constantly iterating, and\nwe want to ensure we hold true to our ",[51,88,91],{"href":89,"rel":90},"https://handbook.gitlab.com/handbook/values/",[],"values"," by being\nas transparent and open as possible.",[73,94,96],{"id":95},"and-what-are-the-top-2-3-initiatives-youre-currently-focused-on","And, what are the top 2-3 initiatives you’re currently focused on?",[98,99,100,104],"ul",{},[101,102,103],"li",{},"Operational Security Architecture: Designing the end-to-end flow of how\nsecurity risks, events, and incidents are handled across GitLab. (Handbook\nMR coming soon!)",[101,105,106],{},"Log Aggregation Working\nGroup: Analyzing,\ndocumenting, and working with Infrastructure and Development teams to\nimprove the quality and efficiency of logs being produced by GitLab-CE/EE\nand GitLab.com.",[73,108,110],{"id":109},"how-did-you-get-into-security","How did you get into security?",[12,112,113,114,119],{},"Dialing into local\n",[51,115,118],{"href":116,"rel":117},"https://en.wikipedia.org/wiki/Bulletin_board_system",[],"BBS","s in the early\n'90s, IRC in the mid-90s, and being introduced to reading material like\nPhrack, 2600, and other amusing bits at an early and malleable age. Combined\nwith a general interest in discovering how things work, breaking them in the\nprocess, and the kind of interesting things you can find!",[73,121,123],{"id":122},"in-the-past-decade-how-has-your-area-of-expertise-changed","In the past decade, how has your area of expertise changed?",[12,125,126],{},"10 years ago I was almost entirely focused on the security and compliance\ntools necessary to keep a solid grasp on enterprise email (well ... as best\nas you can!). From there, I broadened my horizons by taking on security\nmanagement and architecture of local and remotely hosted environments, then\ncompliance for interesting and terrifying acronyms like GDPR. This has\nresulted in a decent breadth of knowledge in many areas … and enough to be\ndangerous in others.",[73,128,130],{"id":129},"what-is-the-most-significant-piece-of-security-advice-you-could-provide-to-a-colleague-or-friend","What is the most significant piece of security advice you could provide to a colleague or friend?",[12,132,133],{},"Please, please, please, please use a password manager like 1Password, or\nLastPass, or Bitwarden (examples, not endorsements, YMMV and pick what fits\nyour workflow best!) and start using it to generate and save unique and\ndifficult passwords for each of your sites or services. You won’t need to\nremember them and so you don’t need to use a memorable one. Then, while\nyou’re at it, turn on two-factor authentication (2FA), and not that SMS/text\nmessage-based one. Use an app like Google Authenticator or Microsoft\nAuthenticator, which will give you the six-digit number (aka Time-Based,\nOne-Time Password) on your mobile device, or better. Having strong, unique\npasswords and 2FA enabled will significantly decrease the chance of your\naccounts being compromised.",[73,135,137],{"id":136},"gitlab-is-very-unique-in-that-we-strive-to-be-incredibly-transparentabout-everything-what-sort-of-challenges-does-that-present-to-you-as-a-security-professional-what-opportunities","GitLab is very unique in that we strive to be incredibly transparent...about everything. What sort of challenges does that present to you as a security professional? What opportunities?",[12,139,140],{},[28,141,142],{},[143,144,145],"em",{},"First, the opportunities:",[12,147,148,149],{},"Striving, and for the vast majority of situations, succeeding, at being\ntransparent is a hugely rewarding and helpful experience for both GitLab and\nthe community. At first I was sceptical and from working with very\ntight-lipped organizations with their well-massaged disclosure\ncommunications, my mindset has been to not “air our dirty laundry.” ",[28,150,151],{},"But,\nbeing able to be transparent about vulnerabilities and issues means:",[98,153,154,157],{},[101,155,156],{},"The community can see how we became aware of, handled, and resolved the\nsituation, then subsequently learned from it so we won’t repeat the issue.\nThis information might help them in their own environment, or their own\nprocesses, and, we hope, might also increase their trust in our product!",[101,158,159],{},"We can give credit to all the awesome, hard-working, and talented people\nat GitLab who come up with clever and creative solutions to protect our\ncustomers and their data. When the issues are public, anyone can see who\nworked it, came up with the obscure and amazing solution, and deployed it.\nIn most companies this information is part of their secret sauce, but this\nis something we can, should, and do celebrate.",[12,161,162],{},[28,163,164],{},[143,165,166],{},"Now, the challenges:",[98,168,169,172,175],{},[101,170,171],{},"The need to keep vulnerability details close so our customers have the\nopportunity to update before it’s being exploited in the wild.",[101,173,174],{},"Old habits die hard, particularly in the Security community. When the\ndefault state in most companies is to lock away and carefully communicate a\nwell-crafted and rehearsed statement, transparency is something to get used\nto and can be uncomfortable for many people who’ve been in the industry for\na while.",[101,176,177],{},"Determining, and sticking with, the few rare scenarios where, due to the\nsensitive nature, it is necessary to keep certain data confidential.  Scope\ncreep can be hard.",[73,179,181],{"id":180},"what-are-your-thoughts-on-cybersecurity-bachelors-degrees-as-a-way-to-scale-training-of-security-professionals","What are your thoughts on cybersecurity bachelor’s degrees as a way to scale training of security professionals?",[12,183,184,185,190],{},"With the premise of a bachelor’s degree being more focused on providing the\ndeep, foundational knowledge and enabling people to continue to learn after\ncompleting the degree, a Security-focused bachelor’s program could be\nvaluable. However, the continued learning aspect is absolutely a necessity\nin this space as, despite ",[51,186,189],{"href":187,"rel":188},"https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project",[],"OWASP Top\n10"," (for\nexample) having largely remained unchanged, the rest of the security\nlandscape has shifted tremendously in the last decade. Without having the\nwillingness to grow and the tools at your disposal to understand how to\ngrow, you would have a difficult time.",[192,193,195,196,199],"h2",{"id":194},"now-for-the-questions-you-really-want-to-have-answered","Now, for the questions you ",[143,197,198],{},"really"," want to have answered:",[73,201,203],{"id":202},"favorite-linux-distro","Favorite Linux distro?",[12,205,206],{},"Debian, specifically Debian Stable. It just works. Fast and reliable for\nserver use and great for a desktop/workstation. I’ve been using Debian since\nversion 5 or 6 and it is always my first choice when setting up a new\nsystem.",[73,208,210],{"id":209},"you-get-one-superpower-what-is-it","You get one superpower, what is it?",[12,212,213],{},"I’d like to be able to look at any one plant and make it to grow at any\nspeed and to any size I wish. I could make one beanstalk be 100 feet tall\nand 3 feet wide, or a fully formed spruce tree but scaled down to a foot,\nall in a matter of seconds!",[73,215,217],{"id":216},"now-its-time-for-the-age-old-debate-is-a-hotdog-a-sandwich-and-on-that-note-is-a-taco-a-sandwich","Now, it’s time for the age-old debate: Is a hotdog a sandwich? And, on that note, is a taco a sandwich?",[12,219,220],{},"Neither a hotdog nor a taco are sandwiches! A sandwich is formed by bringing\ntogether two distinct pieces of something to hold an object or several\nobjects between them, sandwiched between them one could say! A hotdog or\ntaco are different from a sandwich because in both circumstances the hotdog\nitself (aka meat-tube) or the taco fillings are inserted into a crevice\nformed from a single continuous piece of something, which is no longer\nsandwiching anything but instead is actually formed to enable the holding of\nthe hotdog or taco-fillings.",{"title":222,"searchDepth":223,"depth":223,"links":224},"",2,[225],{"id":194,"depth":223,"text":226},"Now, for the questions you really want to have answered:","security","2019-05-31","What’s it like working to secure one of the most transparent organizations in the world? Meet our security team.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749679726/Blog/Hero%20Images/ask-security-cover.png",{},true,"/en-us/blog/ask-gitlab-security-paul-harrison",{"ogTitle":5,"ogImage":233,"ogDescription":229,"ogSiteName":238,"noIndex":232,"ogType":239,"ogUrl":240,"title":5,"canonicalUrls":240,"description":229},"https://about.gitlab.com","article","https://about.gitlab.com/blog/ask-gitlab-security-paul-harrison","ask-gitlab-security-paul-harrison","en-us/blog/ask-gitlab-security-paul-harrison",[244,245,227,227],"careers","inside GitLab","BlogPost","AGYjMhaNftoFpo3z_gv-zI7xlky9TdOk0CUVyDSYLzA",{"logo":249,"freeTrial":254,"sales":259,"login":264,"items":269,"search":596,"minimal":627,"duo":646,"switchNav":655,"pricingDeployment":666},{"config":250},{"href":251,"dataGaName":252,"dataGaLocation":253},"/","gitlab logo","header",{"text":255,"config":256},"Get free trial",{"href":257,"dataGaName":258,"dataGaLocation":253},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":260,"config":261},"Request a demo",{"href":262,"dataGaName":263,"dataGaLocation":253},"/sales/?contact-topic=request-demo","sales",{"text":265,"config":266},"Sign in",{"href":267,"dataGaName":268,"dataGaLocation":253},"https://gitlab.com/users/sign_in/","sign in",[270,299,399,404,518,574],{"text":271,"config":272,"menu":274},"Platform",{"dataNavLevelOne":273},"platform",{"type":275,"columns":276},"cards",[277,283,291],{"title":271,"description":278,"link":279},"The intelligent orchestration platform for DevSecOps",{"text":280,"config":281},"Explore our Platform",{"href":282,"dataGaName":273,"dataGaLocation":253},"/platform/",{"title":284,"description":285,"link":286},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":287,"config":288},"Meet GitLab Duo",{"href":289,"dataGaName":290,"dataGaLocation":253},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":292,"description":293,"link":294},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":295,"config":296},"Learn more",{"href":297,"dataGaName":298,"dataGaLocation":253},"/why-gitlab/","why gitlab",{"text":300,"left":235,"config":301,"menu":303},"Product",{"dataNavLevelOne":302},"solutions",{"type":304,"link":305,"columns":309,"feature":378},"lists",{"text":306,"config":307},"View all Solutions",{"href":308,"dataGaName":302,"dataGaLocation":253},"/solutions/",[310,334,357],{"title":311,"description":312,"link":313,"items":318},"Automation","CI/CD and automation to accelerate deployment",{"config":314},{"icon":315,"href":316,"dataGaName":317,"dataGaLocation":253},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[319,323,326,330],{"text":320,"config":321},"CI/CD",{"href":322,"dataGaLocation":253,"dataGaName":320},"/solutions/continuous-integration/",{"text":284,"config":324},{"href":289,"dataGaLocation":253,"dataGaName":325},"gitlab duo agent platform - product menu",{"text":327,"config":328},"Source Code Management",{"href":329,"dataGaLocation":253,"dataGaName":327},"/solutions/source-code-management/",{"text":331,"config":332},"Automated Software Delivery",{"href":316,"dataGaLocation":253,"dataGaName":333},"Automated software delivery",{"title":335,"description":336,"link":337,"items":342},"Security","Deliver code faster without compromising security",{"config":338},{"href":339,"dataGaName":340,"dataGaLocation":253,"icon":341},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[343,347,352],{"text":344,"config":345},"Application Security Testing",{"href":339,"dataGaName":346,"dataGaLocation":253},"Application security testing",{"text":348,"config":349},"Software Supply Chain Security",{"href":350,"dataGaLocation":253,"dataGaName":351},"/solutions/supply-chain/","Software supply chain security",{"text":353,"config":354},"Software Compliance",{"href":355,"dataGaName":356,"dataGaLocation":253},"/solutions/software-compliance/","software compliance",{"title":358,"link":359,"items":364},"Measurement",{"config":360},{"icon":361,"href":362,"dataGaName":363,"dataGaLocation":253},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[365,369,373],{"text":366,"config":367},"Visibility & Measurement",{"href":362,"dataGaLocation":253,"dataGaName":368},"Visibility and Measurement",{"text":370,"config":371},"Value Stream Management",{"href":372,"dataGaLocation":253,"dataGaName":370},"/solutions/value-stream-management/",{"text":374,"config":375},"Analytics & Insights",{"href":376,"dataGaLocation":253,"dataGaName":377},"/solutions/analytics-and-insights/","Analytics and insights",{"title":379,"type":304,"items":380},"GitLab for",[381,387,393],{"text":382,"config":383},"Enterprise",{"icon":384,"href":385,"dataGaLocation":253,"dataGaName":386},"Building","/enterprise/","enterprise",{"text":388,"config":389},"Small Business",{"icon":390,"href":391,"dataGaLocation":253,"dataGaName":392},"Work","/small-business/","small business",{"text":394,"config":395},"Public Sector",{"icon":396,"href":397,"dataGaLocation":253,"dataGaName":398},"Organization","/solutions/public-sector/","public sector",{"text":400,"config":401},"Pricing",{"href":402,"dataGaName":403,"dataGaLocation":253,"dataNavLevelOne":403},"/pricing/","pricing",{"text":405,"config":406,"menu":408},"Resources",{"dataNavLevelOne":407},"resources",{"type":304,"link":409,"columns":413,"feature":507},{"text":410,"config":411},"View all resources",{"href":412,"dataGaName":407,"dataGaLocation":253},"/resources/",[414,447,474],{"title":415,"items":416},"Getting started",[417,422,427,432,437,442],{"text":418,"config":419},"Install",{"href":420,"dataGaName":421,"dataGaLocation":253},"/install/","install",{"text":423,"config":424},"Quick start guides",{"href":425,"dataGaName":426,"dataGaLocation":253},"/get-started/","quick setup checklists",{"text":428,"config":429},"Learn",{"href":430,"dataGaLocation":253,"dataGaName":431},"https://university.gitlab.com/","learn",{"text":433,"config":434},"Product documentation",{"href":435,"dataGaName":436,"dataGaLocation":253},"https://docs.gitlab.com/","product documentation",{"text":438,"config":439},"Best practice videos",{"href":440,"dataGaName":441,"dataGaLocation":253},"/getting-started-videos/","best practice videos",{"text":443,"config":444},"Integrations",{"href":445,"dataGaName":446,"dataGaLocation":253},"/integrations/","integrations",{"title":448,"items":449},"Discover",[450,455,460,465,469],{"text":451,"config":452},"Customer success stories",{"href":453,"dataGaName":454,"dataGaLocation":253},"/customers/","customer success stories",{"text":456,"config":457},"Blog",{"href":458,"dataGaName":459,"dataGaLocation":253},"/blog/","blog",{"text":461,"config":462},"Demo Hub",{"href":463,"dataGaName":464,"dataGaLocation":253},"/demo-hub/","demo hub",{"text":466,"config":467},"The Source",{"href":468,"dataGaName":459,"dataGaLocation":253},"/the-source/",{"text":470,"config":471},"Remote",{"href":472,"dataGaName":473,"dataGaLocation":253},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":475,"items":476},"Connect",[477,482,487,492,497,502],{"text":478,"config":479},"GitLab Services",{"href":480,"dataGaName":481,"dataGaLocation":253},"/services/","services",{"text":483,"config":484},"Contribute",{"href":485,"dataGaName":486,"dataGaLocation":253},"https://contributors.gitlab.com","contribute",{"text":488,"config":489},"Community",{"href":490,"dataGaName":491,"dataGaLocation":253},"/community/","community",{"text":493,"config":494},"Forum",{"href":495,"dataGaName":496,"dataGaLocation":253},"https://forum.gitlab.com/","forum",{"text":498,"config":499},"Events",{"href":500,"dataGaName":501,"dataGaLocation":253},"/events/","events",{"text":503,"config":504},"Partners",{"href":505,"dataGaName":506,"dataGaLocation":253},"/partners/","partners",{"config":508,"title":511,"text":512,"link":513},{"background":509,"textColor":510},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":514,"config":515},"Read the latest",{"href":516,"dataGaName":517,"dataGaLocation":253},"/whats-new/","whats new",{"text":519,"config":520,"menu":522},"Company",{"dataNavLevelOne":521},"company",{"type":304,"columns":523},[524],{"items":525},[526,531,537,539,544,549,554,559,564,569],{"text":527,"config":528},"About",{"href":529,"dataGaName":530,"dataGaLocation":253},"/company/","about",{"text":532,"config":533,"footerGa":536},"Jobs",{"href":534,"dataGaName":535,"dataGaLocation":253},"/jobs/","jobs",{"dataGaName":535},{"text":498,"config":538},{"href":500,"dataGaName":501,"dataGaLocation":253},{"text":540,"config":541},"Leadership",{"href":542,"dataGaName":543,"dataGaLocation":253},"/company/team/e-group/","leadership",{"text":545,"config":546},"Handbook",{"href":547,"dataGaName":548,"dataGaLocation":253},"https://handbook.gitlab.com/","handbook",{"text":550,"config":551},"Investor relations",{"href":552,"dataGaName":553,"dataGaLocation":253},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":555,"config":556},"Trust Center",{"href":557,"dataGaName":558,"dataGaLocation":253},"/security/","trust center",{"text":560,"config":561},"AI Transparency Center",{"href":562,"dataGaName":563,"dataGaLocation":253},"/ai-transparency-center/","ai transparency center",{"text":565,"config":566},"Newsletter",{"href":567,"dataGaName":568,"dataGaLocation":253},"/company/contact/#contact-forms","newsletter",{"text":570,"config":571},"Press",{"href":572,"dataGaName":573,"dataGaLocation":253},"/press/","press",{"text":575,"config":576,"menu":577},"Contact us",{"dataNavLevelOne":521},{"type":304,"columns":578},[579],{"items":580},[581,586,591],{"text":582,"config":583},"Talk to sales",{"href":584,"dataGaName":585,"dataGaLocation":253},"/sales/","talk to sales",{"text":587,"config":588},"Support portal",{"href":589,"dataGaName":590,"dataGaLocation":253},"https://support.gitlab.com/hc/en-us","support portal",{"text":592,"config":593},"Customer portal",{"href":594,"dataGaName":595,"dataGaLocation":253},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":597,"login":598,"suggestions":605},"Close",{"text":599,"link":600},"To search repositories and projects, login to",{"text":601,"config":602},"gitlab.com",{"href":267,"dataGaName":603,"dataGaLocation":604},"search login","search",{"text":606,"default":607},"Suggestions",[608,610,614,616,620,624],{"text":284,"config":609},{"href":289,"dataGaName":284,"dataGaLocation":604},{"text":611,"config":612},"Code Suggestions (AI)",{"href":613,"dataGaName":611,"dataGaLocation":604},"/solutions/code-suggestions/",{"text":320,"config":615},{"href":322,"dataGaName":320,"dataGaLocation":604},{"text":617,"config":618},"GitLab on AWS",{"href":619,"dataGaName":617,"dataGaLocation":604},"/partners/technology-partners/aws/",{"text":621,"config":622},"GitLab on Google Cloud",{"href":623,"dataGaName":621,"dataGaLocation":604},"/partners/technology-partners/google-cloud-platform/",{"text":625,"config":626},"Why GitLab?",{"href":297,"dataGaName":625,"dataGaLocation":604},{"freeTrial":628,"mobileIcon":633,"desktopIcon":638,"secondaryButton":641},{"text":629,"config":630},"Start free trial",{"href":631,"dataGaName":258,"dataGaLocation":632},"https://gitlab.com/-/trials/new/","nav",{"altText":634,"config":635},"Gitlab Icon",{"src":636,"dataGaName":637,"dataGaLocation":632},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":634,"config":639},{"src":640,"dataGaName":637,"dataGaLocation":632},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":642,"config":643},"Get Started",{"href":644,"dataGaName":645,"dataGaLocation":632},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":647,"mobileIcon":651,"desktopIcon":653},{"text":648,"config":649},"Learn more about GitLab Duo",{"href":289,"dataGaName":650,"dataGaLocation":632},"gitlab duo",{"altText":634,"config":652},{"src":636,"dataGaName":637,"dataGaLocation":632},{"altText":634,"config":654},{"src":640,"dataGaName":637,"dataGaLocation":632},{"button":656,"mobileIcon":661,"desktopIcon":663},{"text":657,"config":658},"/switch",{"href":659,"dataGaName":660,"dataGaLocation":632},"#contact","switch",{"altText":634,"config":662},{"src":636,"dataGaName":637,"dataGaLocation":632},{"altText":634,"config":664},{"src":665,"dataGaName":637,"dataGaLocation":632},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":667,"mobileIcon":672,"desktopIcon":674},{"text":668,"config":669},"Back to pricing",{"href":402,"dataGaName":670,"dataGaLocation":632,"icon":671},"back to pricing","GoBack",{"altText":634,"config":673},{"src":636,"dataGaName":637,"dataGaLocation":632},{"altText":634,"config":675},{"src":640,"dataGaName":637,"dataGaLocation":632},{"title":677,"titleMobile":678,"button":679,"config":684},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":295,"config":680},{"href":681,"dataGaName":682,"dataGaLocation":683},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":685,"disabled":232},"release",{"data":687},{"text":688,"source":689,"edit":695,"contribute":700,"config":705,"items":710,"minimal":920},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":690,"config":691},"View page source",{"href":692,"dataGaName":693,"dataGaLocation":694},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":696,"config":697},"Edit this page",{"href":698,"dataGaName":699,"dataGaLocation":694},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":701,"config":702},"Please contribute",{"href":703,"dataGaName":704,"dataGaLocation":694},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":706,"facebook":707,"youtube":708,"linkedin":709},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[711,758,812,856,888],{"title":400,"links":712,"subMenu":727},[713,717,722],{"text":714,"config":715},"View plans",{"href":402,"dataGaName":716,"dataGaLocation":694},"view plans",{"text":718,"config":719},"Why Premium?",{"href":720,"dataGaName":721,"dataGaLocation":694},"/pricing/premium/","why premium",{"text":723,"config":724},"Why Ultimate?",{"href":725,"dataGaName":726,"dataGaLocation":694},"/pricing/ultimate/","why ultimate",[728],{"title":729,"links":730},"Contact Us",[731,734,736,738,743,748,753],{"text":732,"config":733},"Contact sales",{"href":584,"dataGaName":263,"dataGaLocation":694},{"text":587,"config":735},{"href":589,"dataGaName":590,"dataGaLocation":694},{"text":592,"config":737},{"href":594,"dataGaName":595,"dataGaLocation":694},{"text":739,"config":740},"Status",{"href":741,"dataGaName":742,"dataGaLocation":694},"https://status.gitlab.com/","status",{"text":744,"config":745},"Terms of use",{"href":746,"dataGaName":747,"dataGaLocation":694},"/terms/","terms of use",{"text":749,"config":750},"Privacy statement",{"href":751,"dataGaName":752,"dataGaLocation":694},"/privacy/","privacy statement",{"text":754,"config":755},"Cookie preferences",{"dataGaName":756,"dataGaLocation":694,"id":757,"isOneTrustButton":235},"cookie preferences","ot-sdk-btn",{"title":300,"links":759,"subMenu":768},[760,764],{"text":761,"config":762},"DevSecOps platform",{"href":282,"dataGaName":763,"dataGaLocation":694},"devsecops platform",{"text":765,"config":766},"AI-Assisted Development",{"href":289,"dataGaName":767,"dataGaLocation":694},"ai-assisted development",[769],{"title":770,"links":771},"Topics",[772,777,782,787,792,797,802,807],{"text":773,"config":774},"CICD",{"href":775,"dataGaName":776,"dataGaLocation":694},"/topics/ci-cd/","cicd",{"text":778,"config":779},"GitOps",{"href":780,"dataGaName":781,"dataGaLocation":694},"/topics/gitops/","gitops",{"text":783,"config":784},"DevOps",{"href":785,"dataGaName":786,"dataGaLocation":694},"/topics/devops/","devops",{"text":788,"config":789},"Version Control",{"href":790,"dataGaName":791,"dataGaLocation":694},"/topics/version-control/","version control",{"text":793,"config":794},"DevSecOps",{"href":795,"dataGaName":796,"dataGaLocation":694},"/topics/devsecops/","devsecops",{"text":798,"config":799},"Cloud Native",{"href":800,"dataGaName":801,"dataGaLocation":694},"/topics/cloud-native/","cloud native",{"text":803,"config":804},"AI for Coding",{"href":805,"dataGaName":806,"dataGaLocation":694},"/topics/devops/ai-for-coding/","ai for coding",{"text":808,"config":809},"Agentic AI",{"href":810,"dataGaName":811,"dataGaLocation":694},"/topics/agentic-ai/","agentic ai",{"title":813,"links":814},"Solutions",[815,817,819,824,828,831,835,838,840,843,846,851],{"text":344,"config":816},{"href":339,"dataGaName":344,"dataGaLocation":694},{"text":333,"config":818},{"href":316,"dataGaName":317,"dataGaLocation":694},{"text":820,"config":821},"Agile development",{"href":822,"dataGaName":823,"dataGaLocation":694},"/solutions/agile-delivery/","agile delivery",{"text":825,"config":826},"SCM",{"href":329,"dataGaName":827,"dataGaLocation":694},"source code management",{"text":773,"config":829},{"href":322,"dataGaName":830,"dataGaLocation":694},"continuous integration & delivery",{"text":832,"config":833},"Value stream management",{"href":372,"dataGaName":834,"dataGaLocation":694},"value stream management",{"text":778,"config":836},{"href":837,"dataGaName":781,"dataGaLocation":694},"/solutions/gitops/",{"text":382,"config":839},{"href":385,"dataGaName":386,"dataGaLocation":694},{"text":841,"config":842},"Small business",{"href":391,"dataGaName":392,"dataGaLocation":694},{"text":844,"config":845},"Public sector",{"href":397,"dataGaName":398,"dataGaLocation":694},{"text":847,"config":848},"Education",{"href":849,"dataGaName":850,"dataGaLocation":694},"/solutions/education/","education",{"text":852,"config":853},"Financial services",{"href":854,"dataGaName":855,"dataGaLocation":694},"/solutions/finance/","financial services",{"title":405,"links":857},[858,860,862,864,867,869,872,874,876,878,880,882,884,886],{"text":418,"config":859},{"href":420,"dataGaName":421,"dataGaLocation":694},{"text":423,"config":861},{"href":425,"dataGaName":426,"dataGaLocation":694},{"text":428,"config":863},{"href":430,"dataGaName":431,"dataGaLocation":694},{"text":433,"config":865},{"href":435,"dataGaName":866,"dataGaLocation":694},"docs",{"text":456,"config":868},{"href":458,"dataGaName":459,"dataGaLocation":694},{"text":870,"config":871},"What's new",{"href":516,"dataGaName":517,"dataGaLocation":694},{"text":451,"config":873},{"href":453,"dataGaName":454,"dataGaLocation":694},{"text":470,"config":875},{"href":472,"dataGaName":473,"dataGaLocation":694},{"text":478,"config":877},{"href":480,"dataGaName":481,"dataGaLocation":694},{"text":483,"config":879},{"href":485,"dataGaName":486,"dataGaLocation":694},{"text":488,"config":881},{"href":490,"dataGaName":491,"dataGaLocation":694},{"text":493,"config":883},{"href":495,"dataGaName":496,"dataGaLocation":694},{"text":498,"config":885},{"href":500,"dataGaName":501,"dataGaLocation":694},{"text":503,"config":887},{"href":505,"dataGaName":506,"dataGaLocation":694},{"title":519,"links":889},[890,892,894,896,898,900,904,909,911,913,915],{"text":527,"config":891},{"href":529,"dataGaName":521,"dataGaLocation":694},{"text":532,"config":893},{"href":534,"dataGaName":535,"dataGaLocation":694},{"text":540,"config":895},{"href":542,"dataGaName":543,"dataGaLocation":694},{"text":545,"config":897},{"href":547,"dataGaName":548,"dataGaLocation":694},{"text":550,"config":899},{"href":552,"dataGaName":553,"dataGaLocation":694},{"text":901,"config":902},"Sustainability",{"href":903,"dataGaName":901,"dataGaLocation":694},"/sustainability/",{"text":905,"config":906},"Diversity, inclusion and belonging (DIB)",{"href":907,"dataGaName":908,"dataGaLocation":694},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":555,"config":910},{"href":557,"dataGaName":558,"dataGaLocation":694},{"text":565,"config":912},{"href":567,"dataGaName":568,"dataGaLocation":694},{"text":570,"config":914},{"href":572,"dataGaName":573,"dataGaLocation":694},{"text":916,"config":917},"Modern Slavery Transparency Statement",{"href":918,"dataGaName":919,"dataGaLocation":694},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":921},[922,925,928],{"text":923,"config":924},"Terms",{"href":746,"dataGaName":747,"dataGaLocation":694},{"text":926,"config":927},"Cookies",{"dataGaName":756,"dataGaLocation":694,"id":757,"isOneTrustButton":235},{"text":929,"config":930},"Privacy",{"href":751,"dataGaName":752,"dataGaLocation":694},[932],{"id":933,"title":7,"body":231,"config":934,"content":936,"description":231,"extension":940,"meta":941,"navigation":235,"path":942,"seo":943,"stem":944,"__hash__":945},"blogAuthors/en-us/blog/authors/heather-simpson.yml",{"template":935},"BlogAuthor",{"name":7,"config":937},{"headshot":938,"ctfId":939},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","hsimpson","yml",{},"/en-us/blog/authors/heather-simpson",{},"en-us/blog/authors/heather-simpson","4CpsZWXsBE_aB4RLpF20WPoTR1QnmwDhrVLV8WUGGTk",[947,955,963],{"title":948,"description":949,"heroImage":950,"category":227,"date":951,"authors":952,"slug":954,"externalUrl":231},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[953],"Julian Thome","improved-scope-offset-fingerprinting",{"title":956,"description":957,"heroImage":950,"category":227,"date":958,"authors":959,"slug":962,"externalUrl":231},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[960,961],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":964,"description":965,"heroImage":966,"category":227,"date":967,"authors":968,"slug":970,"externalUrl":231},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[969],"Alisa Ho","claude-security-and-gitlab",{"promotions":972},[973,987,999,1010],{"id":974,"categories":975,"header":977,"text":978,"button":979,"image":984},"ai-modernization",[976],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":980,"config":981},"Get your AI maturity score",{"href":982,"dataGaName":983,"dataGaLocation":459},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":985},{"src":986},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":988,"categories":989,"header":991,"text":978,"button":992,"image":996},"devops-modernization",[990,796],"product","Are you just managing tools or shipping innovation?",{"text":993,"config":994},"Get your DevOps maturity score",{"href":995,"dataGaName":983,"dataGaLocation":459},"/assessments/devops-modernization-assessment/",{"config":997},{"src":998},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1000,"categories":1001,"header":1002,"text":978,"button":1003,"image":1007},"security-modernization",[227],"Are you trading speed for security?",{"text":1004,"config":1005},"Get your security maturity score",{"href":1006,"dataGaName":983,"dataGaLocation":459},"/assessments/security-modernization-assessment/",{"config":1008},{"src":1009},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1011,"paths":1012,"header":1015,"text":1016,"button":1017,"image":1022},"github-azure-migration",[1013,1014],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1018,"config":1019},"See how GitLab compares to GitHub",{"href":1020,"dataGaName":1021,"dataGaLocation":459},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1023},{"src":998},{"header":1025,"blurb":1026,"button":1027,"secondaryButton":1032},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1028,"config":1029},"Get your free trial",{"href":1030,"dataGaName":258,"dataGaLocation":1031},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":732,"config":1033},{"href":584,"dataGaName":263,"dataGaLocation":1031},1786803763338]