[{"data":1,"prerenderedAt":2197},["ShallowReactive",2],{"/blog/auto-dismiss-vulnerability-management-policy":3,"navigation-en-us":1413,"banner-en-us":1840,"footer-en-us":1851,"blog-post-authors-en-us-Grant Hickman":2095,"blog-related-posts-en-us-auto-dismiss-vulnerability-management-policy":2110,"blog-promotions-en-us":2135,"next-steps-en-us":2187},{"id":4,"title":5,"authors":6,"body":8,"category":1394,"date":1395,"description":1396,"extension":1397,"externalUrl":1398,"faq":1398,"featured":1399,"heroImage":1400,"meta":1401,"navigation":1399,"path":1402,"seo":1403,"slug":1404,"stem":1405,"tags":1406,"template":1411,"updatedDate":1398,"__hash__":1412},"blogPosts/en-us/blog/auto-dismiss-vulnerability-management-policy.md","Manage vulnerability noise at scale with auto-dismiss policies",[7],"Grant Hickman",{"type":9,"value":10,"toc":1380},"minimark",[11,15,18,23,26,55,59,90,94,97,102,105,370,374,389,564,568,571,747,751,754,928,932,935,1075,1079,1086,1191,1195,1311,1315,1318,1354,1364,1376],[12,13,14],"p",{},"Security scanners are essential, but not every finding requires action. Test code, vendored dependencies, generated files, and known false positives create noise that buries the vulnerabilities that actually matter. Security teams waste hours manually dismissing the same irrelevant findings across projects and pipelines. They experience slower triage, alert fatigue, and developer friction that undermines adoption of security scanning itself.",[12,16,17],{},"GitLab's auto-dismiss vulnerability policies let you codify your triage decisions once and apply them automatically on every default-branch pipeline. Define criteria based on file path, directory, or vulnerability identifier (CVE, CWE), choose a dismissal reason, and let GitLab handle the rest.",[19,20,22],"h2",{"id":21},"why-auto-dismiss","Why auto-dismiss?",[12,24,25],{},"Auto-dismiss vulnerability policies enable security teams to:",[27,28,29,37,43,49],"ul",{},[30,31,32,36],"li",{},[33,34,35],"strong",{},"Eliminate triage noise",": Automatically dismiss findings in test code, vendored dependencies, and generated files.",[30,38,39,42],{},[33,40,41],{},"Enforce decisions at scale",": Apply policies centrally to dismiss known false positives across your entire organization.",[30,44,45,48],{},[33,46,47],{},"Maintain audit transparency",": Every auto-dismissed finding includes a documented reason and links back to the policy that triggered it.",[30,50,51,54],{},[33,52,53],{},"Preserve the record",": Unlike scanner exclusions, dismissed vulnerabilities remain in your report, so you can revisit decisions if conditions change.",[19,56,58],{"id":57},"how-auto-dismiss-policies-work","How auto-dismiss policies work",[60,61,62,68,78,84],"ol",{},[30,63,64,67],{},[33,65,66],{},"Define your policy"," in a vulnerability management policy YAML file. Specify match criteria (file path, directory, or identifier) and a dismissal reason.",[30,69,70,73,74,77],{},[33,71,72],{},"Merge and activate."," Create the policy via ",[33,75,76],{},"Secure > Policies > New  policy > Vulnerability management policy",". Merge the MR to enable it.",[30,79,80,83],{},[33,81,82],{},"Run your pipeline."," On every default-branch pipeline, matching vulnerabilities are automatically set to \"Dismissed\" with the specified reason. Up to 1,000 vulnerabilities are processed per run.",[30,85,86,89],{},[33,87,88],{},"Measure the impact."," Filter your vulnerability report by status \"Dismissed\" to see exactly what was cleaned up and validate that the right findings are being handled.",[19,91,93],{"id":92},"use-cases-with-ready-to-use-configurations","Use cases with ready-to-use configurations",[12,95,96],{},"Each example below includes a policy configuration you can copy, customize, and apply immediately.",[98,99,101],"h3",{"id":100},"_1-dismiss-test-code-vulnerabilities","1. Dismiss test code vulnerabilities",[12,103,104],{},"SAST and dependency scanners flag hardcoded credentials, insecure fixtures, and dev-only dependencies in test directories. These are not production risks.",[106,107,112],"pre",{"className":108,"code":109,"language":110,"meta":111,"style":111},"language-yaml shiki shiki-themes github-light","vulnerability_management_policy:\n  - name: \"Dismiss test code vulnerabilities\"\n    description: \"Auto-dismiss findings in test directories\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: file_path\n            value: \"test/**/*\"\n      - type: detected\n        criteria:\n          - type: file_path\n            value: \"tests/**/*\"\n      - type: detected\n        criteria:\n          - type: file_path\n            value: \"spec/**/*\"\n      - type: detected\n        criteria:\n          - type: directory\n            value: \"__tests__/*\"\n    actions:\n      - type: auto_dismiss\n        dismissal_reason: used_in_tests\n\n","yaml","",[113,114,115,128,144,155,167,175,189,197,210,221,232,239,250,260,271,278,289,299,310,317,329,339,347,359],"code",{"__ignoreMap":111},[116,117,120,124],"span",{"class":118,"line":119},"line",1,[116,121,123],{"class":122},"shJU0","vulnerability_management_policy",[116,125,127],{"class":126},"sgsFI",":\n",[116,129,131,134,137,140],{"class":118,"line":130},2,[116,132,133],{"class":126},"  - ",[116,135,136],{"class":122},"name",[116,138,139],{"class":126},": ",[116,141,143],{"class":142},"sYBdl","\"Dismiss test code vulnerabilities\"\n",[116,145,147,150,152],{"class":118,"line":146},3,[116,148,149],{"class":122},"    description",[116,151,139],{"class":126},[116,153,154],{"class":142},"\"Auto-dismiss findings in test directories\"\n",[116,156,158,161,163],{"class":118,"line":157},4,[116,159,160],{"class":122},"    enabled",[116,162,139],{"class":126},[116,164,166],{"class":165},"sYu0t","true\n",[116,168,170,173],{"class":118,"line":169},5,[116,171,172],{"class":122},"    rules",[116,174,127],{"class":126},[116,176,178,181,184,186],{"class":118,"line":177},6,[116,179,180],{"class":126},"      - ",[116,182,183],{"class":122},"type",[116,185,139],{"class":126},[116,187,188],{"class":142},"detected\n",[116,190,192,195],{"class":118,"line":191},7,[116,193,194],{"class":122},"        criteria",[116,196,127],{"class":126},[116,198,200,203,205,207],{"class":118,"line":199},8,[116,201,202],{"class":126},"          - ",[116,204,183],{"class":122},[116,206,139],{"class":126},[116,208,209],{"class":142},"file_path\n",[116,211,213,216,218],{"class":118,"line":212},9,[116,214,215],{"class":122},"            value",[116,217,139],{"class":126},[116,219,220],{"class":142},"\"test/**/*\"\n",[116,222,224,226,228,230],{"class":118,"line":223},10,[116,225,180],{"class":126},[116,227,183],{"class":122},[116,229,139],{"class":126},[116,231,188],{"class":142},[116,233,235,237],{"class":118,"line":234},11,[116,236,194],{"class":122},[116,238,127],{"class":126},[116,240,242,244,246,248],{"class":118,"line":241},12,[116,243,202],{"class":126},[116,245,183],{"class":122},[116,247,139],{"class":126},[116,249,209],{"class":142},[116,251,253,255,257],{"class":118,"line":252},13,[116,254,215],{"class":122},[116,256,139],{"class":126},[116,258,259],{"class":142},"\"tests/**/*\"\n",[116,261,263,265,267,269],{"class":118,"line":262},14,[116,264,180],{"class":126},[116,266,183],{"class":122},[116,268,139],{"class":126},[116,270,188],{"class":142},[116,272,274,276],{"class":118,"line":273},15,[116,275,194],{"class":122},[116,277,127],{"class":126},[116,279,281,283,285,287],{"class":118,"line":280},16,[116,282,202],{"class":126},[116,284,183],{"class":122},[116,286,139],{"class":126},[116,288,209],{"class":142},[116,290,292,294,296],{"class":118,"line":291},17,[116,293,215],{"class":122},[116,295,139],{"class":126},[116,297,298],{"class":142},"\"spec/**/*\"\n",[116,300,302,304,306,308],{"class":118,"line":301},18,[116,303,180],{"class":126},[116,305,183],{"class":122},[116,307,139],{"class":126},[116,309,188],{"class":142},[116,311,313,315],{"class":118,"line":312},19,[116,314,194],{"class":122},[116,316,127],{"class":126},[116,318,320,322,324,326],{"class":118,"line":319},20,[116,321,202],{"class":126},[116,323,183],{"class":122},[116,325,139],{"class":126},[116,327,328],{"class":142},"directory\n",[116,330,332,334,336],{"class":118,"line":331},21,[116,333,215],{"class":122},[116,335,139],{"class":126},[116,337,338],{"class":142},"\"__tests__/*\"\n",[116,340,342,345],{"class":118,"line":341},22,[116,343,344],{"class":122},"    actions",[116,346,127],{"class":126},[116,348,350,352,354,356],{"class":118,"line":349},23,[116,351,180],{"class":126},[116,353,183],{"class":122},[116,355,139],{"class":126},[116,357,358],{"class":142},"auto_dismiss\n",[116,360,362,365,367],{"class":118,"line":361},24,[116,363,364],{"class":122},"        dismissal_reason",[116,366,139],{"class":126},[116,368,369],{"class":142},"used_in_tests\n",[98,371,373],{"id":372},"_2-dismiss-vendored-and-third-party-code","2. Dismiss vendored and third-party code",[12,375,376,377,380,381,384,385,388],{},"Vulnerabilities in ",[113,378,379],{},"vendor/",", ",[113,382,383],{},"third_party/",", or checked-in ",[113,386,387],{},"node_modules"," are managed upstream and not actionable for your team.",[106,390,392],{"className":108,"code":391,"language":110,"meta":111,"style":111},"vulnerability_management_policy:\n  - name: \"Dismiss vendored dependency findings\"\n    description: \"Findings in vendored code are managed upstream\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: directory\n            value: \"vendor/*\"\n      - type: detected\n        criteria:\n          - type: directory\n            value: \"third_party/*\"\n      - type: detected\n        criteria:\n          - type: directory\n            value: \"vendored/*\"\n    actions:\n      - type: auto_dismiss\n        dismissal_reason: not_applicable\n\n",[113,393,394,400,411,420,428,434,444,450,460,469,479,485,495,504,514,520,530,539,545,555],{"__ignoreMap":111},[116,395,396,398],{"class":118,"line":119},[116,397,123],{"class":122},[116,399,127],{"class":126},[116,401,402,404,406,408],{"class":118,"line":130},[116,403,133],{"class":126},[116,405,136],{"class":122},[116,407,139],{"class":126},[116,409,410],{"class":142},"\"Dismiss vendored dependency findings\"\n",[116,412,413,415,417],{"class":118,"line":146},[116,414,149],{"class":122},[116,416,139],{"class":126},[116,418,419],{"class":142},"\"Findings in vendored code are managed upstream\"\n",[116,421,422,424,426],{"class":118,"line":157},[116,423,160],{"class":122},[116,425,139],{"class":126},[116,427,166],{"class":165},[116,429,430,432],{"class":118,"line":169},[116,431,172],{"class":122},[116,433,127],{"class":126},[116,435,436,438,440,442],{"class":118,"line":177},[116,437,180],{"class":126},[116,439,183],{"class":122},[116,441,139],{"class":126},[116,443,188],{"class":142},[116,445,446,448],{"class":118,"line":191},[116,447,194],{"class":122},[116,449,127],{"class":126},[116,451,452,454,456,458],{"class":118,"line":199},[116,453,202],{"class":126},[116,455,183],{"class":122},[116,457,139],{"class":126},[116,459,328],{"class":142},[116,461,462,464,466],{"class":118,"line":212},[116,463,215],{"class":122},[116,465,139],{"class":126},[116,467,468],{"class":142},"\"vendor/*\"\n",[116,470,471,473,475,477],{"class":118,"line":223},[116,472,180],{"class":126},[116,474,183],{"class":122},[116,476,139],{"class":126},[116,478,188],{"class":142},[116,480,481,483],{"class":118,"line":234},[116,482,194],{"class":122},[116,484,127],{"class":126},[116,486,487,489,491,493],{"class":118,"line":241},[116,488,202],{"class":126},[116,490,183],{"class":122},[116,492,139],{"class":126},[116,494,328],{"class":142},[116,496,497,499,501],{"class":118,"line":252},[116,498,215],{"class":122},[116,500,139],{"class":126},[116,502,503],{"class":142},"\"third_party/*\"\n",[116,505,506,508,510,512],{"class":118,"line":262},[116,507,180],{"class":126},[116,509,183],{"class":122},[116,511,139],{"class":126},[116,513,188],{"class":142},[116,515,516,518],{"class":118,"line":273},[116,517,194],{"class":122},[116,519,127],{"class":126},[116,521,522,524,526,528],{"class":118,"line":280},[116,523,202],{"class":126},[116,525,183],{"class":122},[116,527,139],{"class":126},[116,529,328],{"class":142},[116,531,532,534,536],{"class":118,"line":291},[116,533,215],{"class":122},[116,535,139],{"class":126},[116,537,538],{"class":142},"\"vendored/*\"\n",[116,540,541,543],{"class":118,"line":301},[116,542,344],{"class":122},[116,544,127],{"class":126},[116,546,547,549,551,553],{"class":118,"line":312},[116,548,180],{"class":126},[116,550,183],{"class":122},[116,552,139],{"class":126},[116,554,358],{"class":142},[116,556,557,559,561],{"class":118,"line":319},[116,558,364],{"class":122},[116,560,139],{"class":126},[116,562,563],{"class":142},"not_applicable\n",[98,565,567],{"id":566},"_3-dismiss-known-false-positive-cves","3. Dismiss known false positive CVEs",[12,569,570],{},"Certain CVEs are repeatedly flagged but don't apply to your usage context. Teams dismiss these manually every time they appear. Replace the example CVEs below with your own.",[106,572,574],{"className":108,"code":573,"language":110,"meta":111,"style":111},"vulnerability_management_policy:\n  - name: \"Dismiss known false positive CVEs\"\n    description: \"CVEs confirmed as false positives for our environment\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            value: \"CVE-2023-44487\"\n      - type: detected\n        criteria:\n          - type: identifier\n            value: \"CVE-2024-29041\"\n      - type: detected\n        criteria:\n          - type: identifier\n            value: \"CVE-2023-26136\"\n    actions:\n      - type: auto_dismiss\n        dismissal_reason: false_positive\n\n",[113,575,576,582,593,602,610,616,626,632,643,652,662,668,678,687,697,703,713,722,728,738],{"__ignoreMap":111},[116,577,578,580],{"class":118,"line":119},[116,579,123],{"class":122},[116,581,127],{"class":126},[116,583,584,586,588,590],{"class":118,"line":130},[116,585,133],{"class":126},[116,587,136],{"class":122},[116,589,139],{"class":126},[116,591,592],{"class":142},"\"Dismiss known false positive CVEs\"\n",[116,594,595,597,599],{"class":118,"line":146},[116,596,149],{"class":122},[116,598,139],{"class":126},[116,600,601],{"class":142},"\"CVEs confirmed as false positives for our environment\"\n",[116,603,604,606,608],{"class":118,"line":157},[116,605,160],{"class":122},[116,607,139],{"class":126},[116,609,166],{"class":165},[116,611,612,614],{"class":118,"line":169},[116,613,172],{"class":122},[116,615,127],{"class":126},[116,617,618,620,622,624],{"class":118,"line":177},[116,619,180],{"class":126},[116,621,183],{"class":122},[116,623,139],{"class":126},[116,625,188],{"class":142},[116,627,628,630],{"class":118,"line":191},[116,629,194],{"class":122},[116,631,127],{"class":126},[116,633,634,636,638,640],{"class":118,"line":199},[116,635,202],{"class":126},[116,637,183],{"class":122},[116,639,139],{"class":126},[116,641,642],{"class":142},"identifier\n",[116,644,645,647,649],{"class":118,"line":212},[116,646,215],{"class":122},[116,648,139],{"class":126},[116,650,651],{"class":142},"\"CVE-2023-44487\"\n",[116,653,654,656,658,660],{"class":118,"line":223},[116,655,180],{"class":126},[116,657,183],{"class":122},[116,659,139],{"class":126},[116,661,188],{"class":142},[116,663,664,666],{"class":118,"line":234},[116,665,194],{"class":122},[116,667,127],{"class":126},[116,669,670,672,674,676],{"class":118,"line":241},[116,671,202],{"class":126},[116,673,183],{"class":122},[116,675,139],{"class":126},[116,677,642],{"class":142},[116,679,680,682,684],{"class":118,"line":252},[116,681,215],{"class":122},[116,683,139],{"class":126},[116,685,686],{"class":142},"\"CVE-2024-29041\"\n",[116,688,689,691,693,695],{"class":118,"line":262},[116,690,180],{"class":126},[116,692,183],{"class":122},[116,694,139],{"class":126},[116,696,188],{"class":142},[116,698,699,701],{"class":118,"line":273},[116,700,194],{"class":122},[116,702,127],{"class":126},[116,704,705,707,709,711],{"class":118,"line":280},[116,706,202],{"class":126},[116,708,183],{"class":122},[116,710,139],{"class":126},[116,712,642],{"class":142},[116,714,715,717,719],{"class":118,"line":291},[116,716,215],{"class":122},[116,718,139],{"class":126},[116,720,721],{"class":142},"\"CVE-2023-26136\"\n",[116,723,724,726],{"class":118,"line":301},[116,725,344],{"class":122},[116,727,127],{"class":126},[116,729,730,732,734,736],{"class":118,"line":312},[116,731,180],{"class":126},[116,733,183],{"class":122},[116,735,139],{"class":126},[116,737,358],{"class":142},[116,739,740,742,744],{"class":118,"line":319},[116,741,364],{"class":122},[116,743,139],{"class":126},[116,745,746],{"class":142},"false_positive\n",[98,748,750],{"id":749},"_4-dismiss-generated-and-auto-created-code","4. Dismiss generated and auto-created code",[12,752,753],{},"Protobuf, gRPC, OpenAPI generators, and ORM scaffolding tools produce files with flagged patterns that cannot be patched by your team.",[106,755,757],{"className":108,"code":756,"language":110,"meta":111,"style":111},"vulnerability_management_policy:\n  - name: \"Dismiss generated code findings\"\n    description: \"Generated files are not authored by us\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: directory\n            value: \"generated/*\"\n      - type: detected\n        criteria:\n          - type: file_path\n            value: \"**/*.pb.go\"\n      - type: detected\n        criteria:\n          - type: file_path\n            value: \"**/*.generated.*\"\n    actions:\n      - type: auto_dismiss\n        dismissal_reason: not_applicable\n\n",[113,758,759,765,776,785,793,799,809,815,825,834,844,850,860,869,879,885,895,904,910,920],{"__ignoreMap":111},[116,760,761,763],{"class":118,"line":119},[116,762,123],{"class":122},[116,764,127],{"class":126},[116,766,767,769,771,773],{"class":118,"line":130},[116,768,133],{"class":126},[116,770,136],{"class":122},[116,772,139],{"class":126},[116,774,775],{"class":142},"\"Dismiss generated code findings\"\n",[116,777,778,780,782],{"class":118,"line":146},[116,779,149],{"class":122},[116,781,139],{"class":126},[116,783,784],{"class":142},"\"Generated files are not authored by us\"\n",[116,786,787,789,791],{"class":118,"line":157},[116,788,160],{"class":122},[116,790,139],{"class":126},[116,792,166],{"class":165},[116,794,795,797],{"class":118,"line":169},[116,796,172],{"class":122},[116,798,127],{"class":126},[116,800,801,803,805,807],{"class":118,"line":177},[116,802,180],{"class":126},[116,804,183],{"class":122},[116,806,139],{"class":126},[116,808,188],{"class":142},[116,810,811,813],{"class":118,"line":191},[116,812,194],{"class":122},[116,814,127],{"class":126},[116,816,817,819,821,823],{"class":118,"line":199},[116,818,202],{"class":126},[116,820,183],{"class":122},[116,822,139],{"class":126},[116,824,328],{"class":142},[116,826,827,829,831],{"class":118,"line":212},[116,828,215],{"class":122},[116,830,139],{"class":126},[116,832,833],{"class":142},"\"generated/*\"\n",[116,835,836,838,840,842],{"class":118,"line":223},[116,837,180],{"class":126},[116,839,183],{"class":122},[116,841,139],{"class":126},[116,843,188],{"class":142},[116,845,846,848],{"class":118,"line":234},[116,847,194],{"class":122},[116,849,127],{"class":126},[116,851,852,854,856,858],{"class":118,"line":241},[116,853,202],{"class":126},[116,855,183],{"class":122},[116,857,139],{"class":126},[116,859,209],{"class":142},[116,861,862,864,866],{"class":118,"line":252},[116,863,215],{"class":122},[116,865,139],{"class":126},[116,867,868],{"class":142},"\"**/*.pb.go\"\n",[116,870,871,873,875,877],{"class":118,"line":262},[116,872,180],{"class":126},[116,874,183],{"class":122},[116,876,139],{"class":126},[116,878,188],{"class":142},[116,880,881,883],{"class":118,"line":273},[116,882,194],{"class":122},[116,884,127],{"class":126},[116,886,887,889,891,893],{"class":118,"line":280},[116,888,202],{"class":126},[116,890,183],{"class":122},[116,892,139],{"class":126},[116,894,209],{"class":142},[116,896,897,899,901],{"class":118,"line":291},[116,898,215],{"class":122},[116,900,139],{"class":126},[116,902,903],{"class":142},"\"**/*.generated.*\"\n",[116,905,906,908],{"class":118,"line":301},[116,907,344],{"class":122},[116,909,127],{"class":126},[116,911,912,914,916,918],{"class":118,"line":312},[116,913,180],{"class":126},[116,915,183],{"class":122},[116,917,139],{"class":126},[116,919,358],{"class":142},[116,921,922,924,926],{"class":118,"line":319},[116,923,364],{"class":122},[116,925,139],{"class":126},[116,927,563],{"class":142},[98,929,931],{"id":930},"_5-dismiss-infrastructure-mitigated-vulnerabilities","5. Dismiss infrastructure-mitigated vulnerabilities",[12,933,934],{},"Vulnerability classes like XSS (CWE-79) or SQL injection (CWE-89) that are already addressed by WAF rules or runtime protection. Only use this when mitigating controls are verified and consistently enforced.",[106,936,938],{"className":108,"code":937,"language":110,"meta":111,"style":111},"vulnerability_management_policy:\n  - name: \"Dismiss CWEs mitigated by WAF\"\n    description: \"XSS and SQLi mitigated by WAF rules\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            value: \"CWE-79\"\n      - type: detected\n        criteria:\n          - type: identifier\n            value: \"CWE-89\"\n    actions:\n      - type: auto_dismiss\n        dismissal_reason: mitigating_control\n\n",[113,939,940,946,957,966,974,980,990,996,1006,1015,1025,1031,1041,1050,1056,1066],{"__ignoreMap":111},[116,941,942,944],{"class":118,"line":119},[116,943,123],{"class":122},[116,945,127],{"class":126},[116,947,948,950,952,954],{"class":118,"line":130},[116,949,133],{"class":126},[116,951,136],{"class":122},[116,953,139],{"class":126},[116,955,956],{"class":142},"\"Dismiss CWEs mitigated by WAF\"\n",[116,958,959,961,963],{"class":118,"line":146},[116,960,149],{"class":122},[116,962,139],{"class":126},[116,964,965],{"class":142},"\"XSS and SQLi mitigated by WAF rules\"\n",[116,967,968,970,972],{"class":118,"line":157},[116,969,160],{"class":122},[116,971,139],{"class":126},[116,973,166],{"class":165},[116,975,976,978],{"class":118,"line":169},[116,977,172],{"class":122},[116,979,127],{"class":126},[116,981,982,984,986,988],{"class":118,"line":177},[116,983,180],{"class":126},[116,985,183],{"class":122},[116,987,139],{"class":126},[116,989,188],{"class":142},[116,991,992,994],{"class":118,"line":191},[116,993,194],{"class":122},[116,995,127],{"class":126},[116,997,998,1000,1002,1004],{"class":118,"line":199},[116,999,202],{"class":126},[116,1001,183],{"class":122},[116,1003,139],{"class":126},[116,1005,642],{"class":142},[116,1007,1008,1010,1012],{"class":118,"line":212},[116,1009,215],{"class":122},[116,1011,139],{"class":126},[116,1013,1014],{"class":142},"\"CWE-79\"\n",[116,1016,1017,1019,1021,1023],{"class":118,"line":223},[116,1018,180],{"class":126},[116,1020,183],{"class":122},[116,1022,139],{"class":126},[116,1024,188],{"class":142},[116,1026,1027,1029],{"class":118,"line":234},[116,1028,194],{"class":122},[116,1030,127],{"class":126},[116,1032,1033,1035,1037,1039],{"class":118,"line":241},[116,1034,202],{"class":126},[116,1036,183],{"class":122},[116,1038,139],{"class":126},[116,1040,642],{"class":142},[116,1042,1043,1045,1047],{"class":118,"line":252},[116,1044,215],{"class":122},[116,1046,139],{"class":126},[116,1048,1049],{"class":142},"\"CWE-89\"\n",[116,1051,1052,1054],{"class":118,"line":262},[116,1053,344],{"class":122},[116,1055,127],{"class":126},[116,1057,1058,1060,1062,1064],{"class":118,"line":273},[116,1059,180],{"class":126},[116,1061,183],{"class":122},[116,1063,139],{"class":126},[116,1065,358],{"class":142},[116,1067,1068,1070,1072],{"class":118,"line":280},[116,1069,364],{"class":122},[116,1071,139],{"class":126},[116,1073,1074],{"class":142},"mitigating_control\n",[98,1076,1078],{"id":1077},"_6-dismiss-cve-families-across-your-organization","6. Dismiss CVE families across your organization",[12,1080,1081,1082,1085],{},"A wave of related CVEs for a widely-used library your team has assessed? Apply at the group level to dismiss them across dozens of projects. The wildcard pattern (e.g., ",[113,1083,1084],{},"CVE-2021-44*",") matches all CVEs with that prefix.",[106,1087,1089],{"className":108,"code":1088,"language":110,"meta":111,"style":111},"vulnerability_management_policy:\n  - name: \"Accept risk for log4j CVE family\"\n    description: \"Log4j CVEs mitigated by version pinning and WAF\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            value: \"CVE-2021-44*\"\n    actions:\n      - type: auto_dismiss\n        dismissal_reason: acceptable_risk\n\n",[113,1090,1091,1097,1108,1117,1125,1131,1141,1147,1157,1166,1172,1182],{"__ignoreMap":111},[116,1092,1093,1095],{"class":118,"line":119},[116,1094,123],{"class":122},[116,1096,127],{"class":126},[116,1098,1099,1101,1103,1105],{"class":118,"line":130},[116,1100,133],{"class":126},[116,1102,136],{"class":122},[116,1104,139],{"class":126},[116,1106,1107],{"class":142},"\"Accept risk for log4j CVE family\"\n",[116,1109,1110,1112,1114],{"class":118,"line":146},[116,1111,149],{"class":122},[116,1113,139],{"class":126},[116,1115,1116],{"class":142},"\"Log4j CVEs mitigated by version pinning and WAF\"\n",[116,1118,1119,1121,1123],{"class":118,"line":157},[116,1120,160],{"class":122},[116,1122,139],{"class":126},[116,1124,166],{"class":165},[116,1126,1127,1129],{"class":118,"line":169},[116,1128,172],{"class":122},[116,1130,127],{"class":126},[116,1132,1133,1135,1137,1139],{"class":118,"line":177},[116,1134,180],{"class":126},[116,1136,183],{"class":122},[116,1138,139],{"class":126},[116,1140,188],{"class":142},[116,1142,1143,1145],{"class":118,"line":191},[116,1144,194],{"class":122},[116,1146,127],{"class":126},[116,1148,1149,1151,1153,1155],{"class":118,"line":199},[116,1150,202],{"class":126},[116,1152,183],{"class":122},[116,1154,139],{"class":126},[116,1156,642],{"class":142},[116,1158,1159,1161,1163],{"class":118,"line":212},[116,1160,215],{"class":122},[116,1162,139],{"class":126},[116,1164,1165],{"class":142},"\"CVE-2021-44*\"\n",[116,1167,1168,1170],{"class":118,"line":223},[116,1169,344],{"class":122},[116,1171,127],{"class":126},[116,1173,1174,1176,1178,1180],{"class":118,"line":234},[116,1175,180],{"class":126},[116,1177,183],{"class":122},[116,1179,139],{"class":126},[116,1181,358],{"class":142},[116,1183,1184,1186,1188],{"class":118,"line":241},[116,1185,364],{"class":122},[116,1187,139],{"class":126},[116,1189,1190],{"class":142},"acceptable_risk\n",[19,1192,1194],{"id":1193},"quick-reference","Quick reference",[1196,1197,1198,1211],"table",{},[1199,1200,1201],"thead",{},[1202,1203,1204,1208],"tr",{},[1205,1206,1207],"th",{},"Parameter",[1205,1209,1210],{},"Details",[1212,1213,1214,1247,1271,1281,1291,1301],"tbody",{},[1202,1215,1216,1222],{},[1217,1218,1219],"td",{},[33,1220,1221],{},"Criteria types",[1217,1223,1224,1227,1228,1231,1232,1235,1236,1231,1239,1242,1243,1246],{},[113,1225,1226],{},"file_path"," (glob patterns, e.g., ",[113,1229,1230],{},"test/**/*","), ",[113,1233,1234],{},"directory"," (e.g., ",[113,1237,1238],{},"vendor/*",[113,1240,1241],{},"identifier"," (CVE/CWE with wildcards, e.g., ",[113,1244,1245],{},"CVE-2023-*",")",[1202,1248,1249,1254],{},[1217,1250,1251],{},[33,1252,1253],{},"Dismissal reasons",[1217,1255,1256,380,1259,380,1262,380,1265,380,1268],{},[113,1257,1258],{},"acceptable_risk",[113,1260,1261],{},"false_positive",[113,1263,1264],{},"mitigating_control",[113,1266,1267],{},"used_in_tests",[113,1269,1270],{},"not_applicable",[1202,1272,1273,1278],{},[1217,1274,1275],{},[33,1276,1277],{},"Criteria logic",[1217,1279,1280],{},"Multiple criteria within a rule = AND (must match all). Multiple rules within a policy = OR (match any).",[1202,1282,1283,1288],{},[1217,1284,1285],{},[33,1286,1287],{},"Limits",[1217,1289,1290],{},"3 criteria per rule, 5 rules per policy, 5 policies per security policy project. Vulnerabilty management policy actions process 1000 vulnerabilities per pipeline run in the target project, until all matching vulnerabilities are processed.",[1202,1292,1293,1298],{},[1217,1294,1295],{},[33,1296,1297],{},"Affected statuses",[1217,1299,1300],{},"Needs triage, Confirmed",[1202,1302,1303,1308],{},[1217,1304,1305],{},[33,1306,1307],{},"Scope",[1217,1309,1310],{},"Project-level or group-level (group-level applies across all projects)",[19,1312,1314],{"id":1313},"getting-started","Getting started",[12,1316,1317],{},"Here's how to get started with auto-dismiss policies:",[60,1319,1320,1326,1332,1338,1348],{},[30,1321,1322,1325],{},[33,1323,1324],{},"Identify the noise."," Open your vulnerability report and sort by \"Needs triage.\" Look for patterns: test files, vendored code, the same CVE across projects.",[30,1327,1328,1331],{},[33,1329,1330],{},"Pick a scenario."," Start with whichever use case above accounts for the most findings.",[30,1333,1334,1337],{},[33,1335,1336],{},"Record your baseline."," Note the number of \"Needs triage\" vulnerabilities before creating a policy.",[30,1339,1340,1343,1344,1347],{},[33,1341,1342],{},"Create and enable."," Navigate to ",[33,1345,1346],{},"Secure > Policies > New policy > Vulnerability management policy",". Paste the configuration from the use case above, then merge the MR.",[30,1349,1350,1353],{},[33,1351,1352],{},"Validate results."," After the next default-branch pipeline, filter by status \"Dismissed\" to confirm the right findings were handled.",[12,1355,1356,1357,1363],{},"For full configuration details, see the ",[1358,1359,1362],"a",{"href":1360,"rel":1361},"https://docs.gitlab.com/user/application_security/policies/vulnerability_management_policy/#auto-dismiss-policies",[],"vulnerability management policy documentation",".",[1365,1366,1367],"blockquote",{},[12,1368,1369,1370,1375],{},"Ready to take control of vulnerability noise? ",[1358,1371,1374],{"href":1372,"rel":1373},"https://about.gitlab.com/free-trial/",[],"Start a free GitLab Ultimate trial"," and configure your first auto-dismiss policy today.",[1377,1378,1379],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":111,"searchDepth":130,"depth":130,"links":1381},[1382,1383,1384,1392,1393],{"id":21,"depth":130,"text":22},{"id":57,"depth":130,"text":58},{"id":92,"depth":130,"text":93,"children":1385},[1386,1387,1388,1389,1390,1391],{"id":100,"depth":146,"text":101},{"id":372,"depth":146,"text":373},{"id":566,"depth":146,"text":567},{"id":749,"depth":146,"text":750},{"id":930,"depth":146,"text":931},{"id":1077,"depth":146,"text":1078},{"id":1193,"depth":130,"text":1194},{"id":1313,"depth":130,"text":1314},"security","2026-03-25","Learn how to cut through scanner noise and focus on the vulnerabilities that matter most with GitLab security, including use cases and templates.","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1774375772/kpaaaiqhokevxxeoxvu0.png",{},"/en-us/blog/auto-dismiss-vulnerability-management-policy",{"title":5,"description":1396},"auto-dismiss-vulnerability-management-policy","en-us/blog/auto-dismiss-vulnerability-management-policy",[1394,1407,1408,1409,1410],"tutorial","DevSecOps","features","product","BlogPost","s6W5LlXuSfjelXLDEJfUeylV_sdxscS3j0M00rwdn-Y",{"logo":1414,"freeTrial":1419,"sales":1424,"login":1429,"items":1434,"search":1760,"minimal":1791,"duo":1810,"switchNav":1819,"pricingDeployment":1830},{"config":1415},{"href":1416,"dataGaName":1417,"dataGaLocation":1418},"/","gitlab logo","header",{"text":1420,"config":1421},"Get free trial",{"href":1422,"dataGaName":1423,"dataGaLocation":1418},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":1425,"config":1426},"Request a demo",{"href":1427,"dataGaName":1428,"dataGaLocation":1418},"/sales/?contact-topic=request-demo","sales",{"text":1430,"config":1431},"Sign in",{"href":1432,"dataGaName":1433,"dataGaLocation":1418},"https://gitlab.com/users/sign_in/","sign in",[1435,1464,1564,1569,1682,1738],{"text":1436,"config":1437,"menu":1439},"Platform",{"dataNavLevelOne":1438},"platform",{"type":1440,"columns":1441},"cards",[1442,1448,1456],{"title":1436,"description":1443,"link":1444},"The intelligent orchestration platform for DevSecOps",{"text":1445,"config":1446},"Explore our Platform",{"href":1447,"dataGaName":1438,"dataGaLocation":1418},"/platform/",{"title":1449,"description":1450,"link":1451},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1452,"config":1453},"Meet GitLab Duo",{"href":1454,"dataGaName":1455,"dataGaLocation":1418},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1457,"description":1458,"link":1459},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1460,"config":1461},"Learn more",{"href":1462,"dataGaName":1463,"dataGaLocation":1418},"/why-gitlab/","why gitlab",{"text":1465,"left":1399,"config":1466,"menu":1468},"Product",{"dataNavLevelOne":1467},"solutions",{"type":1469,"link":1470,"columns":1474,"feature":1543},"lists",{"text":1471,"config":1472},"View all Solutions",{"href":1473,"dataGaName":1467,"dataGaLocation":1418},"/solutions/",[1475,1499,1522],{"title":1476,"description":1477,"link":1478,"items":1483},"Automation","CI/CD and automation to accelerate deployment",{"config":1479},{"icon":1480,"href":1481,"dataGaName":1482,"dataGaLocation":1418},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1484,1488,1491,1495],{"text":1485,"config":1486},"CI/CD",{"href":1487,"dataGaLocation":1418,"dataGaName":1485},"/solutions/continuous-integration/",{"text":1449,"config":1489},{"href":1454,"dataGaLocation":1418,"dataGaName":1490},"gitlab duo agent platform - product menu",{"text":1492,"config":1493},"Source Code Management",{"href":1494,"dataGaLocation":1418,"dataGaName":1492},"/solutions/source-code-management/",{"text":1496,"config":1497},"Automated Software Delivery",{"href":1481,"dataGaLocation":1418,"dataGaName":1498},"Automated software delivery",{"title":1500,"description":1501,"link":1502,"items":1507},"Security","Deliver code faster without compromising security",{"config":1503},{"href":1504,"dataGaName":1505,"dataGaLocation":1418,"icon":1506},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1508,1512,1517],{"text":1509,"config":1510},"Application Security Testing",{"href":1504,"dataGaName":1511,"dataGaLocation":1418},"Application security testing",{"text":1513,"config":1514},"Software Supply Chain Security",{"href":1515,"dataGaLocation":1418,"dataGaName":1516},"/solutions/supply-chain/","Software supply chain security",{"text":1518,"config":1519},"Software Compliance",{"href":1520,"dataGaName":1521,"dataGaLocation":1418},"/solutions/software-compliance/","software compliance",{"title":1523,"link":1524,"items":1529},"Measurement",{"config":1525},{"icon":1526,"href":1527,"dataGaName":1528,"dataGaLocation":1418},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1530,1534,1538],{"text":1531,"config":1532},"Visibility & Measurement",{"href":1527,"dataGaLocation":1418,"dataGaName":1533},"Visibility and Measurement",{"text":1535,"config":1536},"Value Stream Management",{"href":1537,"dataGaLocation":1418,"dataGaName":1535},"/solutions/value-stream-management/",{"text":1539,"config":1540},"Analytics & Insights",{"href":1541,"dataGaLocation":1418,"dataGaName":1542},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1544,"type":1469,"items":1545},"GitLab for",[1546,1552,1558],{"text":1547,"config":1548},"Enterprise",{"icon":1549,"href":1550,"dataGaLocation":1418,"dataGaName":1551},"Building","/enterprise/","enterprise",{"text":1553,"config":1554},"Small Business",{"icon":1555,"href":1556,"dataGaLocation":1418,"dataGaName":1557},"Work","/small-business/","small business",{"text":1559,"config":1560},"Public Sector",{"icon":1561,"href":1562,"dataGaLocation":1418,"dataGaName":1563},"Organization","/solutions/public-sector/","public sector",{"text":1565,"config":1566},"Pricing",{"href":1567,"dataGaName":1568,"dataGaLocation":1418,"dataNavLevelOne":1568},"/pricing/","pricing",{"text":1570,"config":1571,"menu":1573},"Resources",{"dataNavLevelOne":1572},"resources",{"type":1469,"link":1574,"columns":1578,"feature":1671},{"text":1575,"config":1576},"View all resources",{"href":1577,"dataGaName":1572,"dataGaLocation":1418},"/resources/",[1579,1611,1638],{"title":1314,"items":1580},[1581,1586,1591,1596,1601,1606],{"text":1582,"config":1583},"Install",{"href":1584,"dataGaName":1585,"dataGaLocation":1418},"/install/","install",{"text":1587,"config":1588},"Quick start guides",{"href":1589,"dataGaName":1590,"dataGaLocation":1418},"/get-started/","quick setup checklists",{"text":1592,"config":1593},"Learn",{"href":1594,"dataGaLocation":1418,"dataGaName":1595},"https://university.gitlab.com/","learn",{"text":1597,"config":1598},"Product documentation",{"href":1599,"dataGaName":1600,"dataGaLocation":1418},"https://docs.gitlab.com/","product documentation",{"text":1602,"config":1603},"Best practice videos",{"href":1604,"dataGaName":1605,"dataGaLocation":1418},"/getting-started-videos/","best practice videos",{"text":1607,"config":1608},"Integrations",{"href":1609,"dataGaName":1610,"dataGaLocation":1418},"/integrations/","integrations",{"title":1612,"items":1613},"Discover",[1614,1619,1624,1629,1633],{"text":1615,"config":1616},"Customer success stories",{"href":1617,"dataGaName":1618,"dataGaLocation":1418},"/customers/","customer success stories",{"text":1620,"config":1621},"Blog",{"href":1622,"dataGaName":1623,"dataGaLocation":1418},"/blog/","blog",{"text":1625,"config":1626},"Demo Hub",{"href":1627,"dataGaName":1628,"dataGaLocation":1418},"/demo-hub/","demo hub",{"text":1630,"config":1631},"The Source",{"href":1632,"dataGaName":1623,"dataGaLocation":1418},"/the-source/",{"text":1634,"config":1635},"Remote",{"href":1636,"dataGaName":1637,"dataGaLocation":1418},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1639,"items":1640},"Connect",[1641,1646,1651,1656,1661,1666],{"text":1642,"config":1643},"GitLab Services",{"href":1644,"dataGaName":1645,"dataGaLocation":1418},"/services/","services",{"text":1647,"config":1648},"Contribute",{"href":1649,"dataGaName":1650,"dataGaLocation":1418},"https://contributors.gitlab.com","contribute",{"text":1652,"config":1653},"Community",{"href":1654,"dataGaName":1655,"dataGaLocation":1418},"/community/","community",{"text":1657,"config":1658},"Forum",{"href":1659,"dataGaName":1660,"dataGaLocation":1418},"https://forum.gitlab.com/","forum",{"text":1662,"config":1663},"Events",{"href":1664,"dataGaName":1665,"dataGaLocation":1418},"/events/","events",{"text":1667,"config":1668},"Partners",{"href":1669,"dataGaName":1670,"dataGaLocation":1418},"/partners/","partners",{"config":1672,"title":1675,"text":1676,"link":1677},{"background":1673,"textColor":1674},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1678,"config":1679},"Read the latest",{"href":1680,"dataGaName":1681,"dataGaLocation":1418},"/whats-new/","whats new",{"text":1683,"config":1684,"menu":1686},"Company",{"dataNavLevelOne":1685},"company",{"type":1469,"columns":1687},[1688],{"items":1689},[1690,1695,1701,1703,1708,1713,1718,1723,1728,1733],{"text":1691,"config":1692},"About",{"href":1693,"dataGaName":1694,"dataGaLocation":1418},"/company/","about",{"text":1696,"config":1697,"footerGa":1700},"Jobs",{"href":1698,"dataGaName":1699,"dataGaLocation":1418},"/jobs/","jobs",{"dataGaName":1699},{"text":1662,"config":1702},{"href":1664,"dataGaName":1665,"dataGaLocation":1418},{"text":1704,"config":1705},"Leadership",{"href":1706,"dataGaName":1707,"dataGaLocation":1418},"/company/team/e-group/","leadership",{"text":1709,"config":1710},"Handbook",{"href":1711,"dataGaName":1712,"dataGaLocation":1418},"https://handbook.gitlab.com/","handbook",{"text":1714,"config":1715},"Investor relations",{"href":1716,"dataGaName":1717,"dataGaLocation":1418},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1719,"config":1720},"Trust Center",{"href":1721,"dataGaName":1722,"dataGaLocation":1418},"/security/","trust center",{"text":1724,"config":1725},"AI Transparency Center",{"href":1726,"dataGaName":1727,"dataGaLocation":1418},"/ai-transparency-center/","ai transparency center",{"text":1729,"config":1730},"Newsletter",{"href":1731,"dataGaName":1732,"dataGaLocation":1418},"/company/contact/#contact-forms","newsletter",{"text":1734,"config":1735},"Press",{"href":1736,"dataGaName":1737,"dataGaLocation":1418},"/press/","press",{"text":1739,"config":1740,"menu":1741},"Contact us",{"dataNavLevelOne":1685},{"type":1469,"columns":1742},[1743],{"items":1744},[1745,1750,1755],{"text":1746,"config":1747},"Talk to sales",{"href":1748,"dataGaName":1749,"dataGaLocation":1418},"/sales/","talk to sales",{"text":1751,"config":1752},"Support portal",{"href":1753,"dataGaName":1754,"dataGaLocation":1418},"https://support.gitlab.com/hc/en-us","support portal",{"text":1756,"config":1757},"Customer portal",{"href":1758,"dataGaName":1759,"dataGaLocation":1418},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1761,"login":1762,"suggestions":1769},"Close",{"text":1763,"link":1764},"To search repositories and projects, login to",{"text":1765,"config":1766},"gitlab.com",{"href":1432,"dataGaName":1767,"dataGaLocation":1768},"search login","search",{"text":1770,"default":1771},"Suggestions",[1772,1774,1778,1780,1784,1788],{"text":1449,"config":1773},{"href":1454,"dataGaName":1449,"dataGaLocation":1768},{"text":1775,"config":1776},"Code Suggestions (AI)",{"href":1777,"dataGaName":1775,"dataGaLocation":1768},"/solutions/code-suggestions/",{"text":1485,"config":1779},{"href":1487,"dataGaName":1485,"dataGaLocation":1768},{"text":1781,"config":1782},"GitLab on AWS",{"href":1783,"dataGaName":1781,"dataGaLocation":1768},"/partners/technology-partners/aws/",{"text":1785,"config":1786},"GitLab on Google Cloud",{"href":1787,"dataGaName":1785,"dataGaLocation":1768},"/partners/technology-partners/google-cloud-platform/",{"text":1789,"config":1790},"Why GitLab?",{"href":1462,"dataGaName":1789,"dataGaLocation":1768},{"freeTrial":1792,"mobileIcon":1797,"desktopIcon":1802,"secondaryButton":1805},{"text":1793,"config":1794},"Start free trial",{"href":1795,"dataGaName":1423,"dataGaLocation":1796},"https://gitlab.com/-/trials/new/","nav",{"altText":1798,"config":1799},"Gitlab Icon",{"src":1800,"dataGaName":1801,"dataGaLocation":1796},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1798,"config":1803},{"src":1804,"dataGaName":1801,"dataGaLocation":1796},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1806,"config":1807},"Get Started",{"href":1808,"dataGaName":1809,"dataGaLocation":1796},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1811,"mobileIcon":1815,"desktopIcon":1817},{"text":1812,"config":1813},"Learn more about GitLab Duo",{"href":1454,"dataGaName":1814,"dataGaLocation":1796},"gitlab duo",{"altText":1798,"config":1816},{"src":1800,"dataGaName":1801,"dataGaLocation":1796},{"altText":1798,"config":1818},{"src":1804,"dataGaName":1801,"dataGaLocation":1796},{"button":1820,"mobileIcon":1825,"desktopIcon":1827},{"text":1821,"config":1822},"/switch",{"href":1823,"dataGaName":1824,"dataGaLocation":1796},"#contact","switch",{"altText":1798,"config":1826},{"src":1800,"dataGaName":1801,"dataGaLocation":1796},{"altText":1798,"config":1828},{"src":1829,"dataGaName":1801,"dataGaLocation":1796},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1831,"mobileIcon":1836,"desktopIcon":1838},{"text":1832,"config":1833},"Back to pricing",{"href":1567,"dataGaName":1834,"dataGaLocation":1796,"icon":1835},"back to pricing","GoBack",{"altText":1798,"config":1837},{"src":1800,"dataGaName":1801,"dataGaLocation":1796},{"altText":1798,"config":1839},{"src":1804,"dataGaName":1801,"dataGaLocation":1796},{"title":1841,"titleMobile":1842,"button":1843,"config":1848},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1460,"config":1844},{"href":1845,"dataGaName":1846,"dataGaLocation":1847},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1849,"disabled":1850},"release",false,{"data":1852},{"text":1853,"source":1854,"edit":1860,"contribute":1865,"config":1870,"items":1875,"minimal":2084},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1855,"config":1856},"View page source",{"href":1857,"dataGaName":1858,"dataGaLocation":1859},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1861,"config":1862},"Edit this page",{"href":1863,"dataGaName":1864,"dataGaLocation":1859},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1866,"config":1867},"Please contribute",{"href":1868,"dataGaName":1869,"dataGaLocation":1859},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1871,"facebook":1872,"youtube":1873,"linkedin":1874},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1876,1923,1976,2020,2052],{"title":1565,"links":1877,"subMenu":1892},[1878,1882,1887],{"text":1879,"config":1880},"View plans",{"href":1567,"dataGaName":1881,"dataGaLocation":1859},"view plans",{"text":1883,"config":1884},"Why Premium?",{"href":1885,"dataGaName":1886,"dataGaLocation":1859},"/pricing/premium/","why premium",{"text":1888,"config":1889},"Why Ultimate?",{"href":1890,"dataGaName":1891,"dataGaLocation":1859},"/pricing/ultimate/","why ultimate",[1893],{"title":1894,"links":1895},"Contact Us",[1896,1899,1901,1903,1908,1913,1918],{"text":1897,"config":1898},"Contact sales",{"href":1748,"dataGaName":1428,"dataGaLocation":1859},{"text":1751,"config":1900},{"href":1753,"dataGaName":1754,"dataGaLocation":1859},{"text":1756,"config":1902},{"href":1758,"dataGaName":1759,"dataGaLocation":1859},{"text":1904,"config":1905},"Status",{"href":1906,"dataGaName":1907,"dataGaLocation":1859},"https://status.gitlab.com/","status",{"text":1909,"config":1910},"Terms of use",{"href":1911,"dataGaName":1912,"dataGaLocation":1859},"/terms/","terms of use",{"text":1914,"config":1915},"Privacy statement",{"href":1916,"dataGaName":1917,"dataGaLocation":1859},"/privacy/","privacy statement",{"text":1919,"config":1920},"Cookie preferences",{"dataGaName":1921,"dataGaLocation":1859,"id":1922,"isOneTrustButton":1399},"cookie preferences","ot-sdk-btn",{"title":1465,"links":1924,"subMenu":1933},[1925,1929],{"text":1926,"config":1927},"DevSecOps platform",{"href":1447,"dataGaName":1928,"dataGaLocation":1859},"devsecops platform",{"text":1930,"config":1931},"AI-Assisted Development",{"href":1454,"dataGaName":1932,"dataGaLocation":1859},"ai-assisted development",[1934],{"title":1935,"links":1936},"Topics",[1937,1942,1947,1952,1957,1961,1966,1971],{"text":1938,"config":1939},"CICD",{"href":1940,"dataGaName":1941,"dataGaLocation":1859},"/topics/ci-cd/","cicd",{"text":1943,"config":1944},"GitOps",{"href":1945,"dataGaName":1946,"dataGaLocation":1859},"/topics/gitops/","gitops",{"text":1948,"config":1949},"DevOps",{"href":1950,"dataGaName":1951,"dataGaLocation":1859},"/topics/devops/","devops",{"text":1953,"config":1954},"Version Control",{"href":1955,"dataGaName":1956,"dataGaLocation":1859},"/topics/version-control/","version control",{"text":1408,"config":1958},{"href":1959,"dataGaName":1960,"dataGaLocation":1859},"/topics/devsecops/","devsecops",{"text":1962,"config":1963},"Cloud Native",{"href":1964,"dataGaName":1965,"dataGaLocation":1859},"/topics/cloud-native/","cloud native",{"text":1967,"config":1968},"AI for Coding",{"href":1969,"dataGaName":1970,"dataGaLocation":1859},"/topics/devops/ai-for-coding/","ai for coding",{"text":1972,"config":1973},"Agentic AI",{"href":1974,"dataGaName":1975,"dataGaLocation":1859},"/topics/agentic-ai/","agentic ai",{"title":1977,"links":1978},"Solutions",[1979,1981,1983,1988,1992,1995,1999,2002,2004,2007,2010,2015],{"text":1509,"config":1980},{"href":1504,"dataGaName":1509,"dataGaLocation":1859},{"text":1498,"config":1982},{"href":1481,"dataGaName":1482,"dataGaLocation":1859},{"text":1984,"config":1985},"Agile development",{"href":1986,"dataGaName":1987,"dataGaLocation":1859},"/solutions/agile-delivery/","agile delivery",{"text":1989,"config":1990},"SCM",{"href":1494,"dataGaName":1991,"dataGaLocation":1859},"source code management",{"text":1938,"config":1993},{"href":1487,"dataGaName":1994,"dataGaLocation":1859},"continuous integration & delivery",{"text":1996,"config":1997},"Value stream management",{"href":1537,"dataGaName":1998,"dataGaLocation":1859},"value stream management",{"text":1943,"config":2000},{"href":2001,"dataGaName":1946,"dataGaLocation":1859},"/solutions/gitops/",{"text":1547,"config":2003},{"href":1550,"dataGaName":1551,"dataGaLocation":1859},{"text":2005,"config":2006},"Small business",{"href":1556,"dataGaName":1557,"dataGaLocation":1859},{"text":2008,"config":2009},"Public sector",{"href":1562,"dataGaName":1563,"dataGaLocation":1859},{"text":2011,"config":2012},"Education",{"href":2013,"dataGaName":2014,"dataGaLocation":1859},"/solutions/education/","education",{"text":2016,"config":2017},"Financial services",{"href":2018,"dataGaName":2019,"dataGaLocation":1859},"/solutions/finance/","financial services",{"title":1570,"links":2021},[2022,2024,2026,2028,2031,2033,2036,2038,2040,2042,2044,2046,2048,2050],{"text":1582,"config":2023},{"href":1584,"dataGaName":1585,"dataGaLocation":1859},{"text":1587,"config":2025},{"href":1589,"dataGaName":1590,"dataGaLocation":1859},{"text":1592,"config":2027},{"href":1594,"dataGaName":1595,"dataGaLocation":1859},{"text":1597,"config":2029},{"href":1599,"dataGaName":2030,"dataGaLocation":1859},"docs",{"text":1620,"config":2032},{"href":1622,"dataGaName":1623,"dataGaLocation":1859},{"text":2034,"config":2035},"What's new",{"href":1680,"dataGaName":1681,"dataGaLocation":1859},{"text":1615,"config":2037},{"href":1617,"dataGaName":1618,"dataGaLocation":1859},{"text":1634,"config":2039},{"href":1636,"dataGaName":1637,"dataGaLocation":1859},{"text":1642,"config":2041},{"href":1644,"dataGaName":1645,"dataGaLocation":1859},{"text":1647,"config":2043},{"href":1649,"dataGaName":1650,"dataGaLocation":1859},{"text":1652,"config":2045},{"href":1654,"dataGaName":1655,"dataGaLocation":1859},{"text":1657,"config":2047},{"href":1659,"dataGaName":1660,"dataGaLocation":1859},{"text":1662,"config":2049},{"href":1664,"dataGaName":1665,"dataGaLocation":1859},{"text":1667,"config":2051},{"href":1669,"dataGaName":1670,"dataGaLocation":1859},{"title":1683,"links":2053},[2054,2056,2058,2060,2062,2064,2068,2073,2075,2077,2079],{"text":1691,"config":2055},{"href":1693,"dataGaName":1685,"dataGaLocation":1859},{"text":1696,"config":2057},{"href":1698,"dataGaName":1699,"dataGaLocation":1859},{"text":1704,"config":2059},{"href":1706,"dataGaName":1707,"dataGaLocation":1859},{"text":1709,"config":2061},{"href":1711,"dataGaName":1712,"dataGaLocation":1859},{"text":1714,"config":2063},{"href":1716,"dataGaName":1717,"dataGaLocation":1859},{"text":2065,"config":2066},"Sustainability",{"href":2067,"dataGaName":2065,"dataGaLocation":1859},"/sustainability/",{"text":2069,"config":2070},"Diversity, inclusion and belonging (DIB)",{"href":2071,"dataGaName":2072,"dataGaLocation":1859},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1719,"config":2074},{"href":1721,"dataGaName":1722,"dataGaLocation":1859},{"text":1729,"config":2076},{"href":1731,"dataGaName":1732,"dataGaLocation":1859},{"text":1734,"config":2078},{"href":1736,"dataGaName":1737,"dataGaLocation":1859},{"text":2080,"config":2081},"Modern Slavery Transparency Statement",{"href":2082,"dataGaName":2083,"dataGaLocation":1859},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":2085},[2086,2089,2092],{"text":2087,"config":2088},"Terms",{"href":1911,"dataGaName":1912,"dataGaLocation":1859},{"text":2090,"config":2091},"Cookies",{"dataGaName":1921,"dataGaLocation":1859,"id":1922,"isOneTrustButton":1399},{"text":2093,"config":2094},"Privacy",{"href":1916,"dataGaName":1917,"dataGaLocation":1859},[2096],{"id":2097,"title":7,"body":1398,"config":2098,"content":2100,"description":1398,"extension":2104,"meta":2105,"navigation":1399,"path":2106,"seo":2107,"stem":2108,"__hash__":2109},"blogAuthors/en-us/blog/authors/grant-hickman.yml",{"template":2099},"BlogAuthor",{"name":7,"config":2101},{"headshot":2102,"ctfId":2103},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749682570/Blog/Author%20Headshots/g.png","ghickman","yml",{},"/en-us/blog/authors/grant-hickman",{},"en-us/blog/authors/grant-hickman","3OY7ZjUzeOb_im7m1kimID61q_0OEhuzipAc3AHq2WM",[2111,2119,2127],{"title":2112,"description":2113,"heroImage":2114,"category":1394,"date":2115,"authors":2116,"slug":2118,"externalUrl":1398},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[2117],"Julian Thome","improved-scope-offset-fingerprinting",{"title":2120,"description":2121,"heroImage":2114,"category":1394,"date":2122,"authors":2123,"slug":2126,"externalUrl":1398},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[2124,2125],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":2128,"description":2129,"heroImage":2130,"category":1394,"date":2131,"authors":2132,"slug":2134,"externalUrl":1398},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[2133],"Alisa Ho","claude-security-and-gitlab",{"promotions":2136},[2137,2151,2162,2173],{"id":2138,"categories":2139,"header":2141,"text":2142,"button":2143,"image":2148},"ai-modernization",[2140],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":2144,"config":2145},"Get your AI maturity score",{"href":2146,"dataGaName":2147,"dataGaLocation":1623},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":2149},{"src":2150},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":2152,"categories":2153,"header":2154,"text":2142,"button":2155,"image":2159},"devops-modernization",[1410,1960],"Are you just managing tools or shipping innovation?",{"text":2156,"config":2157},"Get your DevOps maturity score",{"href":2158,"dataGaName":2147,"dataGaLocation":1623},"/assessments/devops-modernization-assessment/",{"config":2160},{"src":2161},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":2163,"categories":2164,"header":2165,"text":2142,"button":2166,"image":2170},"security-modernization",[1394],"Are you trading speed for security?",{"text":2167,"config":2168},"Get your security maturity score",{"href":2169,"dataGaName":2147,"dataGaLocation":1623},"/assessments/security-modernization-assessment/",{"config":2171},{"src":2172},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":2174,"paths":2175,"header":2178,"text":2179,"button":2180,"image":2185},"github-azure-migration",[2176,2177],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":2181,"config":2182},"See how GitLab compares to GitHub",{"href":2183,"dataGaName":2184,"dataGaLocation":1623},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":2186},{"src":2161},{"header":2188,"blurb":2189,"button":2190,"secondaryButton":2195},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":2191,"config":2192},"Get your free trial",{"href":2193,"dataGaName":1423,"dataGaLocation":2194},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1897,"config":2196},{"href":1748,"dataGaName":1428,"dataGaLocation":2194},1786734813740]