[{"data":1,"prerenderedAt":984},["ShallowReactive",2],{"/blog/browser-based-dast-feature-announcement":3,"navigation-en-us":204,"banner-en-us":632,"footer-en-us":642,"blog-post-authors-en-us-Isaac Dawson":887,"blog-related-posts-en-us-browser-based-dast-feature-announcement":902,"blog-promotions-en-us":921,"next-steps-en-us":974},{"id":4,"title":5,"authors":6,"body":8,"category":182,"date":183,"description":184,"extension":185,"externalUrl":186,"faq":186,"featured":187,"heroImage":188,"meta":189,"navigation":190,"path":191,"seo":192,"slug":196,"stem":197,"tags":198,"template":202,"updatedDate":186,"__hash__":203},"blogPosts/en-us/blog/browser-based-dast-feature-announcement.md","Introducing browser-based DAST and integrated passive checks",[7],"Isaac Dawson",{"type":9,"value":10,"toc":176},"minimark",[11,34,39,54,63,66,69,78,82,85,101,104,108,111,123,126,141,144,147,159,172],[12,13,14,15,21,22,27,28,33],"p",{},"The ",[16,17,20],"a",{"href":18,"rel":19},"https://docs.gitlab.com/user/application_security/dast/",[],"DAST"," and ",[16,23,26],{"href":24,"rel":25},"https://handbook.gitlab.com/handbook/engineering/development/sec/secure/vulnerability-research/",[],"Vulnerability Research"," teams at GitLab are excited to announce we have fully ",[16,29,32],{"href":30,"rel":31},"https://docs.gitlab.com/releases/#browser-based-dast-passive-check-milestone",[],"integrated passive checks"," into our new browser-based DAST analyzer. Passive checks work by monitoring the network traffic to target applications while the web site is automatically crawled. This allows us to identify weaknesses that may exist without sending potentially disruptive network requests. This continues our effort to fully switch over to our browser-based analyzer for DAST in the coming months. If you are interested in using our new DAST analyzer please see our documentation on how to configure a browser-based DAST scan.",[35,36,38],"h2",{"id":37},"history-of-dast-at-gitlab","History of DAST at GitLab",[12,40,41,42,47,48,53],{},"DAST was ",[16,43,46],{"href":44,"rel":45},"https://docs.gitlab.com/releases/",[],"officially launched"," as a part of the GitLab 10.4 release in January 2018. By utilizing the powerful OWASP ",[16,49,52],{"href":50,"rel":51},"https://www.zaproxy.org/",[],"Zed Attack Proxy"," we were able to give our customers the ability to dynamically scan\ntheir web applications. From that initial minimal viable product, we have grown to the point where we are now running over a million scans a month.",[12,55,56,57,62],{},"Scanning web applications in the CI/CD context comes with challenges. Unlike ",[16,58,61],{"href":59,"rel":60},"https://docs.gitlab.com/user/application_security/sast/",[],"SAST",", which is relatively fast, dynamically scanning an application can take a significant amount of time. DAST is resource intensive as it needs to process each request and response to the target application. To ensure smooth operations for the majority of our customers we have to run under the assumption that our memory and CPU footprints should be as small as possible. Finally, and most likely the biggest pain point, is the disconnect that often occurs when trying to visualize or understand how a web application should be analyzed when one can not physically see any of the interactions between the scanner and the target application.",[12,64,65],{},"ZAP was originally built as a desktop application, meaning auditors could use it to see the target application while conducting their testing. Only by utilizing ZAP's scripting API could we make DAST scans viable in a CI/CD context. This surfaced some challenges: what is easy to configure in the UI may or may not be straightforward to adjust from a configuration file or a command line option.",[12,67,68],{},"When reviewing our support tickets however, a very clear picture began to surface. Users were having the most problem with configuring authentication for their applications. This makes sense, as it is where the user interacts with the scanner the most. Modern applications almost require a browser to authenticate, due to relying on browser features like local or session storage. These features are commonly used for handling JSON Web Token (JWT) based authentication and authorization.",[12,70,71,72,77],{},"It should be noted that ZAP does have a browser based crawler extension, called AJAX Spider. This extension uses ",[16,73,76],{"href":74,"rel":75},"https://github.com/crawljax/crawljax",[],"Crawljax",". GitLab provides this feature by supplying the correct CI/CD variable, but it is no longer recommended. AJAX Spider is however, only an extension, and does not represent a tight integration between the browser and the DAST tool.",[35,79,81],{"id":80},"a-path-forward","A path forward",[12,83,84],{},"We needed a system where we could have full control over a browser to allow us to instrument interactions between a website and the DAST tool. A DAST tool which does not tightly integrate with a browser will be limited in its ability to fully interact with today's demanding web applications. Just some of the challenges of this are:",[86,87,88,92,95,98],"ul",{},[89,90,91],"li",{},"Single Page Applications (SPAs)",[89,93,94],{},"Complex, multi-step sign in features",[89,96,97],{},"Complex front-end frameworks",[89,99,100],{},"Utilization of built-in browser features (e.g. usage of localStorage or sessionStorage)",[12,102,103],{},"A new DAST tool based completely off instrumenting a browser and written in Go would give GitLab a lot more control going forward. What started as a side project during nights and weekends began to show some promise. The Vulnerability Research and DAST teams worked together to assess the viability of building out this DAST analyzer. To allow us to take advantage of new features without having to implement the entire engine, we opted to continue to use ZAP as the proxy. This means our analyzer is forwarding all the browser traffic through ZAP, but processing logic of crawling and passive checks are now done in our engine. While we've been relatively quiet on our progress, we've been incrementally rolling out new features with almost every release. The end goal is to completely replace ZAP with our own engine.",[35,105,107],{"id":106},"where-we-are-today","Where we are today",[12,109,110],{},"Of course the biggest announcement is that we have fully switched over to using our own vulnerability check system for passive checks. These checks replace ZAP's \"passive\" checks. The Vulnerability Research team invested a lot of time looking over how each ZAP plugin worked and determined whether it was worth implementing, or if it should be implemented differently. Alert fatigue is a real concern we share with our customers. By reducing the noise (false positives) in our DAST offering, we hope to reduce the chance of our customers ignoring real findings. As such, our goal is to significantly reduce the noise that is usually associated with DAST scan results, and this is achieved through three different methods:",[112,113,114,117,120],"ol",{},[89,115,116],{},"Not implementing certain checks",[89,118,119],{},"Reducing false positives (incorrect findings)",[89,121,122],{},"Aggregating true positives (real findings)",[12,124,125],{},"Point one is worth expanding upon. DAST vulnerabilities are unique in that in some cases the fix for a vulnerability is reliant on the browser or user-agent being modified, and not  the target application. Browsers increase their security directly or have it increased by deprecating features that were used in attacks. Browsers deciding to disable Flash is a good example of this – what was a vulnerability yesterday may no longer be a vulnerability today.",[12,127,128,129,134,135,140],{},"ZAP's check for ",[16,130,133],{"href":131,"rel":132},"https://www.zaproxy.org/docs/alerts/90011/",[],"Charset mis-match"," is another case in point. After ",[16,136,139],{"href":137,"rel":138},"https://gitlab.com/gitlab-org/gitlab/-/issues/331218",[],"researching"," what was possible in 2022, it turns out this is no longer an issue worth reporting. Other DAST tools report similar issues that are no longer realistically exploitable or worth reporting, so this is not just an issue with ZAP.",[12,142,143],{},"Reducing false positives is another major initiative, and one that led us to create a rather unique system for creating new vulnerability checks. Traditionally, DAST tools use a plugin architecture of hardcoded vulnerability checks. While quick to implement, they can have the downside of being difficult to understand or error prone. They are also harder to implement in a standardized way. At GitLab we opted to use a configuration-file-based check system, much like today's SAST tools.",[12,145,146],{},"Finally, aggregating true positives allows us to merge similar issues into a single finding. These types of issues are usually fixed by a single configuration change, such as adding a security header.",[12,148,149,150,154,155,158],{},"Our passive checks are almost entirely written in YAML, using a custom specification that allows us to define a check as text. Where this is not feasible, reusable components are written that can be referenced by various checks. Below is an example check that looks for the ",[151,152,153],"code",{},"X-Content-Type-Options"," header in HTTP response headers and reports if it is missing the ",[151,156,157],{},"nosniff"," value.",[160,161,165],"pre",{"className":162,"code":163,"language":164,"meta":163,"style":163},"language-yaml shiki shiki-themes github-light","","yaml",[151,166,167],{"__ignoreMap":163},[168,169],"span",{"class":170,"line":171},"line",1,[173,174,175],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":163,"searchDepth":177,"depth":177,"links":178},2,[179,180,181],{"id":37,"depth":177,"text":38},{"id":80,"depth":177,"text":81},{"id":106,"depth":177,"text":107},"product","2022-10-19","We're working hard on reducing noise. Here's what you need to know about the status of our browser-based DAST offering today.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749682466/Blog/Hero%20Images/vek-labs-e8ofKlNHdsg-unsplash.jpg",{},true,"/en-us/blog/browser-based-dast-feature-announcement",{"title":5,"description":184,"ogTitle":5,"ogDescription":184,"noIndex":187,"ogImage":188,"ogUrl":193,"ogSiteName":194,"ogType":195,"canonicalUrls":193},"https://about.gitlab.com/blog/browser-based-dast-feature-announcement","https://about.gitlab.com","article","browser-based-dast-feature-announcement","en-us/blog/browser-based-dast-feature-announcement",[199,200,201],"testing","features","code review","BlogPost","7iszWDI9s_CAW4J8q1XNxArx48gwsY26ejvsRyw-Zus",{"logo":205,"freeTrial":210,"sales":215,"login":220,"items":225,"search":552,"minimal":583,"duo":602,"switchNav":611,"pricingDeployment":622},{"config":206},{"href":207,"dataGaName":208,"dataGaLocation":209},"/","gitlab logo","header",{"text":211,"config":212},"Get free trial",{"href":213,"dataGaName":214,"dataGaLocation":209},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":216,"config":217},"Request a demo",{"href":218,"dataGaName":219,"dataGaLocation":209},"/sales/?contact-topic=request-demo","sales",{"text":221,"config":222},"Sign in",{"href":223,"dataGaName":224,"dataGaLocation":209},"https://gitlab.com/users/sign_in/","sign in",[226,255,355,360,474,530],{"text":227,"config":228,"menu":230},"Platform",{"dataNavLevelOne":229},"platform",{"type":231,"columns":232},"cards",[233,239,247],{"title":227,"description":234,"link":235},"The intelligent orchestration platform for DevSecOps",{"text":236,"config":237},"Explore our Platform",{"href":238,"dataGaName":229,"dataGaLocation":209},"/platform/",{"title":240,"description":241,"link":242},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":243,"config":244},"Meet GitLab Duo",{"href":245,"dataGaName":246,"dataGaLocation":209},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":248,"description":249,"link":250},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":251,"config":252},"Learn more",{"href":253,"dataGaName":254,"dataGaLocation":209},"/why-gitlab/","why gitlab",{"text":256,"left":190,"config":257,"menu":259},"Product",{"dataNavLevelOne":258},"solutions",{"type":260,"link":261,"columns":265,"feature":334},"lists",{"text":262,"config":263},"View all Solutions",{"href":264,"dataGaName":258,"dataGaLocation":209},"/solutions/",[266,290,313],{"title":267,"description":268,"link":269,"items":274},"Automation","CI/CD and automation to accelerate deployment",{"config":270},{"icon":271,"href":272,"dataGaName":273,"dataGaLocation":209},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[275,279,282,286],{"text":276,"config":277},"CI/CD",{"href":278,"dataGaLocation":209,"dataGaName":276},"/solutions/continuous-integration/",{"text":240,"config":280},{"href":245,"dataGaLocation":209,"dataGaName":281},"gitlab duo agent platform - product menu",{"text":283,"config":284},"Source Code Management",{"href":285,"dataGaLocation":209,"dataGaName":283},"/solutions/source-code-management/",{"text":287,"config":288},"Automated Software Delivery",{"href":272,"dataGaLocation":209,"dataGaName":289},"Automated software delivery",{"title":291,"description":292,"link":293,"items":298},"Security","Deliver code faster without compromising security",{"config":294},{"href":295,"dataGaName":296,"dataGaLocation":209,"icon":297},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[299,303,308],{"text":300,"config":301},"Application Security Testing",{"href":295,"dataGaName":302,"dataGaLocation":209},"Application security testing",{"text":304,"config":305},"Software Supply Chain Security",{"href":306,"dataGaLocation":209,"dataGaName":307},"/solutions/supply-chain/","Software supply chain security",{"text":309,"config":310},"Software Compliance",{"href":311,"dataGaName":312,"dataGaLocation":209},"/solutions/software-compliance/","software compliance",{"title":314,"link":315,"items":320},"Measurement",{"config":316},{"icon":317,"href":318,"dataGaName":319,"dataGaLocation":209},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[321,325,329],{"text":322,"config":323},"Visibility & Measurement",{"href":318,"dataGaLocation":209,"dataGaName":324},"Visibility and Measurement",{"text":326,"config":327},"Value Stream Management",{"href":328,"dataGaLocation":209,"dataGaName":326},"/solutions/value-stream-management/",{"text":330,"config":331},"Analytics & Insights",{"href":332,"dataGaLocation":209,"dataGaName":333},"/solutions/analytics-and-insights/","Analytics and insights",{"title":335,"type":260,"items":336},"GitLab for",[337,343,349],{"text":338,"config":339},"Enterprise",{"icon":340,"href":341,"dataGaLocation":209,"dataGaName":342},"Building","/enterprise/","enterprise",{"text":344,"config":345},"Small Business",{"icon":346,"href":347,"dataGaLocation":209,"dataGaName":348},"Work","/small-business/","small business",{"text":350,"config":351},"Public Sector",{"icon":352,"href":353,"dataGaLocation":209,"dataGaName":354},"Organization","/solutions/public-sector/","public sector",{"text":356,"config":357},"Pricing",{"href":358,"dataGaName":359,"dataGaLocation":209,"dataNavLevelOne":359},"/pricing/","pricing",{"text":361,"config":362,"menu":364},"Resources",{"dataNavLevelOne":363},"resources",{"type":260,"link":365,"columns":369,"feature":463},{"text":366,"config":367},"View all resources",{"href":368,"dataGaName":363,"dataGaLocation":209},"/resources/",[370,403,430],{"title":371,"items":372},"Getting started",[373,378,383,388,393,398],{"text":374,"config":375},"Install",{"href":376,"dataGaName":377,"dataGaLocation":209},"/install/","install",{"text":379,"config":380},"Quick start guides",{"href":381,"dataGaName":382,"dataGaLocation":209},"/get-started/","quick setup checklists",{"text":384,"config":385},"Learn",{"href":386,"dataGaLocation":209,"dataGaName":387},"https://university.gitlab.com/","learn",{"text":389,"config":390},"Product documentation",{"href":391,"dataGaName":392,"dataGaLocation":209},"https://docs.gitlab.com/","product documentation",{"text":394,"config":395},"Best practice videos",{"href":396,"dataGaName":397,"dataGaLocation":209},"/getting-started-videos/","best practice videos",{"text":399,"config":400},"Integrations",{"href":401,"dataGaName":402,"dataGaLocation":209},"/integrations/","integrations",{"title":404,"items":405},"Discover",[406,411,416,421,425],{"text":407,"config":408},"Customer success stories",{"href":409,"dataGaName":410,"dataGaLocation":209},"/customers/","customer success stories",{"text":412,"config":413},"Blog",{"href":414,"dataGaName":415,"dataGaLocation":209},"/blog/","blog",{"text":417,"config":418},"Demo Hub",{"href":419,"dataGaName":420,"dataGaLocation":209},"/demo-hub/","demo hub",{"text":422,"config":423},"The Source",{"href":424,"dataGaName":415,"dataGaLocation":209},"/the-source/",{"text":426,"config":427},"Remote",{"href":428,"dataGaName":429,"dataGaLocation":209},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":431,"items":432},"Connect",[433,438,443,448,453,458],{"text":434,"config":435},"GitLab Services",{"href":436,"dataGaName":437,"dataGaLocation":209},"/services/","services",{"text":439,"config":440},"Contribute",{"href":441,"dataGaName":442,"dataGaLocation":209},"https://contributors.gitlab.com","contribute",{"text":444,"config":445},"Community",{"href":446,"dataGaName":447,"dataGaLocation":209},"/community/","community",{"text":449,"config":450},"Forum",{"href":451,"dataGaName":452,"dataGaLocation":209},"https://forum.gitlab.com/","forum",{"text":454,"config":455},"Events",{"href":456,"dataGaName":457,"dataGaLocation":209},"/events/","events",{"text":459,"config":460},"Partners",{"href":461,"dataGaName":462,"dataGaLocation":209},"/partners/","partners",{"config":464,"title":467,"text":468,"link":469},{"background":465,"textColor":466},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":470,"config":471},"Read the latest",{"href":472,"dataGaName":473,"dataGaLocation":209},"/whats-new/","whats new",{"text":475,"config":476,"menu":478},"Company",{"dataNavLevelOne":477},"company",{"type":260,"columns":479},[480],{"items":481},[482,487,493,495,500,505,510,515,520,525],{"text":483,"config":484},"About",{"href":485,"dataGaName":486,"dataGaLocation":209},"/company/","about",{"text":488,"config":489,"footerGa":492},"Jobs",{"href":490,"dataGaName":491,"dataGaLocation":209},"/jobs/","jobs",{"dataGaName":491},{"text":454,"config":494},{"href":456,"dataGaName":457,"dataGaLocation":209},{"text":496,"config":497},"Leadership",{"href":498,"dataGaName":499,"dataGaLocation":209},"/company/team/e-group/","leadership",{"text":501,"config":502},"Handbook",{"href":503,"dataGaName":504,"dataGaLocation":209},"https://handbook.gitlab.com/","handbook",{"text":506,"config":507},"Investor relations",{"href":508,"dataGaName":509,"dataGaLocation":209},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":511,"config":512},"Trust Center",{"href":513,"dataGaName":514,"dataGaLocation":209},"/security/","trust center",{"text":516,"config":517},"AI Transparency Center",{"href":518,"dataGaName":519,"dataGaLocation":209},"/ai-transparency-center/","ai transparency center",{"text":521,"config":522},"Newsletter",{"href":523,"dataGaName":524,"dataGaLocation":209},"/company/contact/#contact-forms","newsletter",{"text":526,"config":527},"Press",{"href":528,"dataGaName":529,"dataGaLocation":209},"/press/","press",{"text":531,"config":532,"menu":533},"Contact us",{"dataNavLevelOne":477},{"type":260,"columns":534},[535],{"items":536},[537,542,547],{"text":538,"config":539},"Talk to sales",{"href":540,"dataGaName":541,"dataGaLocation":209},"/sales/","talk to sales",{"text":543,"config":544},"Support portal",{"href":545,"dataGaName":546,"dataGaLocation":209},"https://support.gitlab.com/hc/en-us","support portal",{"text":548,"config":549},"Customer portal",{"href":550,"dataGaName":551,"dataGaLocation":209},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":553,"login":554,"suggestions":561},"Close",{"text":555,"link":556},"To search repositories and projects, login to",{"text":557,"config":558},"gitlab.com",{"href":223,"dataGaName":559,"dataGaLocation":560},"search login","search",{"text":562,"default":563},"Suggestions",[564,566,570,572,576,580],{"text":240,"config":565},{"href":245,"dataGaName":240,"dataGaLocation":560},{"text":567,"config":568},"Code Suggestions (AI)",{"href":569,"dataGaName":567,"dataGaLocation":560},"/solutions/code-suggestions/",{"text":276,"config":571},{"href":278,"dataGaName":276,"dataGaLocation":560},{"text":573,"config":574},"GitLab on AWS",{"href":575,"dataGaName":573,"dataGaLocation":560},"/partners/technology-partners/aws/",{"text":577,"config":578},"GitLab on Google Cloud",{"href":579,"dataGaName":577,"dataGaLocation":560},"/partners/technology-partners/google-cloud-platform/",{"text":581,"config":582},"Why GitLab?",{"href":253,"dataGaName":581,"dataGaLocation":560},{"freeTrial":584,"mobileIcon":589,"desktopIcon":594,"secondaryButton":597},{"text":585,"config":586},"Start free trial",{"href":587,"dataGaName":214,"dataGaLocation":588},"https://gitlab.com/-/trials/new/","nav",{"altText":590,"config":591},"Gitlab Icon",{"src":592,"dataGaName":593,"dataGaLocation":588},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":590,"config":595},{"src":596,"dataGaName":593,"dataGaLocation":588},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":598,"config":599},"Get Started",{"href":600,"dataGaName":601,"dataGaLocation":588},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":603,"mobileIcon":607,"desktopIcon":609},{"text":604,"config":605},"Learn more about GitLab Duo",{"href":245,"dataGaName":606,"dataGaLocation":588},"gitlab duo",{"altText":590,"config":608},{"src":592,"dataGaName":593,"dataGaLocation":588},{"altText":590,"config":610},{"src":596,"dataGaName":593,"dataGaLocation":588},{"button":612,"mobileIcon":617,"desktopIcon":619},{"text":613,"config":614},"/switch",{"href":615,"dataGaName":616,"dataGaLocation":588},"#contact","switch",{"altText":590,"config":618},{"src":592,"dataGaName":593,"dataGaLocation":588},{"altText":590,"config":620},{"src":621,"dataGaName":593,"dataGaLocation":588},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":623,"mobileIcon":628,"desktopIcon":630},{"text":624,"config":625},"Back to pricing",{"href":358,"dataGaName":626,"dataGaLocation":588,"icon":627},"back to pricing","GoBack",{"altText":590,"config":629},{"src":592,"dataGaName":593,"dataGaLocation":588},{"altText":590,"config":631},{"src":596,"dataGaName":593,"dataGaLocation":588},{"title":633,"titleMobile":634,"button":635,"config":640},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":251,"config":636},{"href":637,"dataGaName":638,"dataGaLocation":639},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":641,"disabled":187},"release",{"data":643},{"text":644,"source":645,"edit":651,"contribute":656,"config":661,"items":666,"minimal":876},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":646,"config":647},"View page source",{"href":648,"dataGaName":649,"dataGaLocation":650},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":652,"config":653},"Edit this page",{"href":654,"dataGaName":655,"dataGaLocation":650},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":657,"config":658},"Please contribute",{"href":659,"dataGaName":660,"dataGaLocation":650},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":662,"facebook":663,"youtube":664,"linkedin":665},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[667,714,768,812,844],{"title":356,"links":668,"subMenu":683},[669,673,678],{"text":670,"config":671},"View plans",{"href":358,"dataGaName":672,"dataGaLocation":650},"view plans",{"text":674,"config":675},"Why Premium?",{"href":676,"dataGaName":677,"dataGaLocation":650},"/pricing/premium/","why premium",{"text":679,"config":680},"Why Ultimate?",{"href":681,"dataGaName":682,"dataGaLocation":650},"/pricing/ultimate/","why ultimate",[684],{"title":685,"links":686},"Contact Us",[687,690,692,694,699,704,709],{"text":688,"config":689},"Contact sales",{"href":540,"dataGaName":219,"dataGaLocation":650},{"text":543,"config":691},{"href":545,"dataGaName":546,"dataGaLocation":650},{"text":548,"config":693},{"href":550,"dataGaName":551,"dataGaLocation":650},{"text":695,"config":696},"Status",{"href":697,"dataGaName":698,"dataGaLocation":650},"https://status.gitlab.com/","status",{"text":700,"config":701},"Terms of use",{"href":702,"dataGaName":703,"dataGaLocation":650},"/terms/","terms of use",{"text":705,"config":706},"Privacy statement",{"href":707,"dataGaName":708,"dataGaLocation":650},"/privacy/","privacy statement",{"text":710,"config":711},"Cookie preferences",{"dataGaName":712,"dataGaLocation":650,"id":713,"isOneTrustButton":190},"cookie preferences","ot-sdk-btn",{"title":256,"links":715,"subMenu":724},[716,720],{"text":717,"config":718},"DevSecOps platform",{"href":238,"dataGaName":719,"dataGaLocation":650},"devsecops platform",{"text":721,"config":722},"AI-Assisted Development",{"href":245,"dataGaName":723,"dataGaLocation":650},"ai-assisted development",[725],{"title":726,"links":727},"Topics",[728,733,738,743,748,753,758,763],{"text":729,"config":730},"CICD",{"href":731,"dataGaName":732,"dataGaLocation":650},"/topics/ci-cd/","cicd",{"text":734,"config":735},"GitOps",{"href":736,"dataGaName":737,"dataGaLocation":650},"/topics/gitops/","gitops",{"text":739,"config":740},"DevOps",{"href":741,"dataGaName":742,"dataGaLocation":650},"/topics/devops/","devops",{"text":744,"config":745},"Version Control",{"href":746,"dataGaName":747,"dataGaLocation":650},"/topics/version-control/","version control",{"text":749,"config":750},"DevSecOps",{"href":751,"dataGaName":752,"dataGaLocation":650},"/topics/devsecops/","devsecops",{"text":754,"config":755},"Cloud Native",{"href":756,"dataGaName":757,"dataGaLocation":650},"/topics/cloud-native/","cloud native",{"text":759,"config":760},"AI for Coding",{"href":761,"dataGaName":762,"dataGaLocation":650},"/topics/devops/ai-for-coding/","ai for coding",{"text":764,"config":765},"Agentic AI",{"href":766,"dataGaName":767,"dataGaLocation":650},"/topics/agentic-ai/","agentic ai",{"title":769,"links":770},"Solutions",[771,773,775,780,784,787,791,794,796,799,802,807],{"text":300,"config":772},{"href":295,"dataGaName":300,"dataGaLocation":650},{"text":289,"config":774},{"href":272,"dataGaName":273,"dataGaLocation":650},{"text":776,"config":777},"Agile development",{"href":778,"dataGaName":779,"dataGaLocation":650},"/solutions/agile-delivery/","agile delivery",{"text":781,"config":782},"SCM",{"href":285,"dataGaName":783,"dataGaLocation":650},"source code management",{"text":729,"config":785},{"href":278,"dataGaName":786,"dataGaLocation":650},"continuous integration & delivery",{"text":788,"config":789},"Value stream management",{"href":328,"dataGaName":790,"dataGaLocation":650},"value stream management",{"text":734,"config":792},{"href":793,"dataGaName":737,"dataGaLocation":650},"/solutions/gitops/",{"text":338,"config":795},{"href":341,"dataGaName":342,"dataGaLocation":650},{"text":797,"config":798},"Small business",{"href":347,"dataGaName":348,"dataGaLocation":650},{"text":800,"config":801},"Public sector",{"href":353,"dataGaName":354,"dataGaLocation":650},{"text":803,"config":804},"Education",{"href":805,"dataGaName":806,"dataGaLocation":650},"/solutions/education/","education",{"text":808,"config":809},"Financial services",{"href":810,"dataGaName":811,"dataGaLocation":650},"/solutions/finance/","financial services",{"title":361,"links":813},[814,816,818,820,823,825,828,830,832,834,836,838,840,842],{"text":374,"config":815},{"href":376,"dataGaName":377,"dataGaLocation":650},{"text":379,"config":817},{"href":381,"dataGaName":382,"dataGaLocation":650},{"text":384,"config":819},{"href":386,"dataGaName":387,"dataGaLocation":650},{"text":389,"config":821},{"href":391,"dataGaName":822,"dataGaLocation":650},"docs",{"text":412,"config":824},{"href":414,"dataGaName":415,"dataGaLocation":650},{"text":826,"config":827},"What's new",{"href":472,"dataGaName":473,"dataGaLocation":650},{"text":407,"config":829},{"href":409,"dataGaName":410,"dataGaLocation":650},{"text":426,"config":831},{"href":428,"dataGaName":429,"dataGaLocation":650},{"text":434,"config":833},{"href":436,"dataGaName":437,"dataGaLocation":650},{"text":439,"config":835},{"href":441,"dataGaName":442,"dataGaLocation":650},{"text":444,"config":837},{"href":446,"dataGaName":447,"dataGaLocation":650},{"text":449,"config":839},{"href":451,"dataGaName":452,"dataGaLocation":650},{"text":454,"config":841},{"href":456,"dataGaName":457,"dataGaLocation":650},{"text":459,"config":843},{"href":461,"dataGaName":462,"dataGaLocation":650},{"title":475,"links":845},[846,848,850,852,854,856,860,865,867,869,871],{"text":483,"config":847},{"href":485,"dataGaName":477,"dataGaLocation":650},{"text":488,"config":849},{"href":490,"dataGaName":491,"dataGaLocation":650},{"text":496,"config":851},{"href":498,"dataGaName":499,"dataGaLocation":650},{"text":501,"config":853},{"href":503,"dataGaName":504,"dataGaLocation":650},{"text":506,"config":855},{"href":508,"dataGaName":509,"dataGaLocation":650},{"text":857,"config":858},"Sustainability",{"href":859,"dataGaName":857,"dataGaLocation":650},"/sustainability/",{"text":861,"config":862},"Diversity, inclusion and belonging (DIB)",{"href":863,"dataGaName":864,"dataGaLocation":650},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":511,"config":866},{"href":513,"dataGaName":514,"dataGaLocation":650},{"text":521,"config":868},{"href":523,"dataGaName":524,"dataGaLocation":650},{"text":526,"config":870},{"href":528,"dataGaName":529,"dataGaLocation":650},{"text":872,"config":873},"Modern Slavery Transparency Statement",{"href":874,"dataGaName":875,"dataGaLocation":650},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":877},[878,881,884],{"text":879,"config":880},"Terms",{"href":702,"dataGaName":703,"dataGaLocation":650},{"text":882,"config":883},"Cookies",{"dataGaName":712,"dataGaLocation":650,"id":713,"isOneTrustButton":190},{"text":885,"config":886},"Privacy",{"href":707,"dataGaName":708,"dataGaLocation":650},[888],{"id":889,"title":7,"body":186,"config":890,"content":892,"description":186,"extension":896,"meta":897,"navigation":190,"path":898,"seo":899,"stem":900,"__hash__":901},"blogAuthors/en-us/blog/authors/isaac-dawson.yml",{"template":891},"BlogAuthor",{"name":7,"config":893},{"headshot":894,"ctfId":895},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669814/Blog/Author%20Headshots/idawson-headshot.jpg","idawson","yml",{},"/en-us/blog/authors/isaac-dawson",{},"en-us/blog/authors/isaac-dawson","UpCqyNOSlM21joWN2Eu9Z_uC29MGdlJWAYDQImap3w8",[903,909,913],{"title":904,"description":905,"heroImage":906,"category":182,"date":907,"authors":186,"slug":186,"externalUrl":908},"GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6","Learn about this latest patch release for Community Edition and Enterprise Edition.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749661926/Blog/Hero%20Images/security-patch-blog-image-r2-0506-700x400-fy25_2x.jpg","2026-08-12","https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/",{"title":910,"description":905,"heroImage":906,"category":182,"date":911,"authors":186,"slug":186,"externalUrl":912}," GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5","2026-07-29","https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/",{"title":914,"description":915,"heroImage":916,"category":182,"date":917,"authors":918,"slug":920,"externalUrl":186},"Automate work item assignment with a \"Work item created\" trigger","Our step-by-step guide walks through this AI capability, which enables instant, scalable triage without manual intervention.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773866173/vte9qh8rriznvyclhkes.png","2026-07-20",[919],"Cesar Saavedra","how-to-use-a-work-item-created-trigger",{"promotions":922},[923,937,948,960],{"id":924,"categories":925,"header":927,"text":928,"button":929,"image":934},"ai-modernization",[926],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":930,"config":931},"Get your AI maturity score",{"href":932,"dataGaName":933,"dataGaLocation":415},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":935},{"src":936},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":938,"categories":939,"header":940,"text":928,"button":941,"image":945},"devops-modernization",[182,752],"Are you just managing tools or shipping innovation?",{"text":942,"config":943},"Get your DevOps maturity score",{"href":944,"dataGaName":933,"dataGaLocation":415},"/assessments/devops-modernization-assessment/",{"config":946},{"src":947},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":949,"categories":950,"header":952,"text":928,"button":953,"image":957},"security-modernization",[951],"security","Are you trading speed for security?",{"text":954,"config":955},"Get your security maturity score",{"href":956,"dataGaName":933,"dataGaLocation":415},"/assessments/security-modernization-assessment/",{"config":958},{"src":959},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":961,"paths":962,"header":965,"text":966,"button":967,"image":972},"github-azure-migration",[963,964],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":968,"config":969},"See how GitLab compares to GitHub",{"href":970,"dataGaName":971,"dataGaLocation":415},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":973},{"src":947},{"header":975,"blurb":976,"button":977,"secondaryButton":982},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":978,"config":979},"Get your free trial",{"href":980,"dataGaName":214,"dataGaLocation":981},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":688,"config":983},{"href":540,"dataGaName":219,"dataGaLocation":981},1786803747846]