[{"data":1,"prerenderedAt":1128},["ShallowReactive",2],{"/blog/building-gitlab-with-gitlab-expanding-our-security-certification-portfolio":3,"navigation-en-us":342,"banner-en-us":769,"footer-en-us":779,"blog-post-authors-en-us-Madeline Lake":1024,"blog-related-posts-en-us-building-gitlab-with-gitlab-expanding-our-security-certification-portfolio":1039,"blog-promotions-en-us":1065,"next-steps-en-us":1118},{"id":4,"title":5,"authors":6,"body":8,"category":321,"date":322,"description":323,"extension":324,"externalUrl":325,"faq":325,"featured":326,"heroImage":327,"meta":328,"navigation":329,"path":330,"seo":331,"slug":335,"stem":336,"tags":337,"template":340,"updatedDate":325,"__hash__":341},"blogPosts/en-us/blog/building-gitlab-with-gitlab-expanding-our-security-certification-portfolio.md","Building GitLab with GitLab: Expanding our security certification portfolio",[7],"Madeline Lake",{"type":9,"value":10,"toc":313},"minimark",[11,46,49,61,66,74,127,130,134,137,140,143,259,263,266,269,279,283],[12,13,14,15,21,22,27,28,33,34,39,40,45],"p",{},"We recently expanded ",[16,17,20],"a",{"href":18,"rel":19},"https://about.gitlab.com/security/",[],"our compliance certification portfolio"," to include the automotive industry's ",[16,23,26],{"href":24,"rel":25},"https://about.gitlab.com/blog/gitlab-drives-automotive-industry-information-security-with-tisax/",[],"TISAX"," and to support the issuance of the first ",[16,29,32],{"href":30,"rel":31},"https://about.gitlab.com/dedicated/",[],"GitLab Dedicated"," ",[16,35,38],{"href":36,"rel":37},"https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2",[],"SOC 2 Type 2",". GitLab's Security Compliance team is a proponent of ",[16,41,44],{"href":42,"rel":43},"https://handbook.gitlab.com/handbook/values/#dogfooding",[],"dogfooding"," our platform, including our integrated project management and security features, so we accomplished this expansion using the GitLab DevSecOps Platform.",[12,47,48],{},"In this blog, we'll share the details of how we successfully leveraged GitLab's native features to implement security controls, enabling us to scale our compliance efforts and deliver results faster. You'll also learn how you can put these features to work in your own organization.",[50,51,52],"blockquote",{},[12,53,54,55,60],{},"Start using GitLab for compliance today with ",[16,56,59],{"href":57,"rel":58},"https://gitlab.com/-/trials/",[],"a free trial",".",[62,63,65],"h2",{"id":64},"agile-planning","Agile planning",[12,67,68,69,73],{},"Our security certifications structure is built upon GitLab's ",[16,70,65],{"href":71,"rel":72},"https://about.gitlab.com/solutions/agile-delivery/",[]," features, allowing us to deliver results faster by managing requirements centrally and streamlining our workflows. Using Agile planning features also enables end-to-end visibility throughout compliance audits.",[75,76,77,101,112],"ol",{},[78,79,80,100],"li",{},[81,82,83,88,89,94,95,60],"strong",{},[16,84,87],{"href":85,"rel":86},"https://docs.gitlab.com/user/group/epics/",[],"Epics",", ",[16,90,93],{"href":91,"rel":92},"https://docs.gitlab.com/user/project/issues/",[],"issues",", and ",[16,96,99],{"href":97,"rel":98},"https://docs.gitlab.com/user/project/labels/",[],"labels"," We leverage a parent epic to outline all the external certifications that are ongoing, and child epics for each individual certification. Each child epic contains issues for each work stream related to the certification, as well as evidence requests from the external auditor. Parent and child epics allow for project management and visibility across the organization on the audit cycle's current status.",[78,102,103,106,107,60],{},[81,104,105],{},"Recurring issues."," Every audit has standard request items and tasks that need to be performed. Therefore, to increase efficiency, we have a variety of recurring issues that are automatically created for each audit cycle that populate the task and/or request details, assignee, and due date. Recurring issues can be configured in a ",[16,108,111],{"href":109,"rel":110},"https://docs.gitlab.com/ci/pipelines/schedules/",[],"CI pipeline",[78,113,114,126],{},[81,115,116,120,121,60],{},[16,117,119],{"href":97,"rel":118},[],"Labels"," and ",[16,122,125],{"href":123,"rel":124},"https://docs.gitlab.com/user/project/issue_board/",[],"issue boards"," Labels and issue boards are used to plan, organize, and visualize workflows. The Security Compliance team leverages issue boards to not only track status, but also to track and group identified deficiencies relating to our compliance requirements. Issue boards allow for visibility of all issues related to a given program by their risk classification and current remediation status.",[12,128,129],{},"These Agile planning features ensure that compliance teams are able to leverage the same platform as their engineers, promoting transparency and efficient delivery of results.",[62,131,133],{"id":132},"security","Security",[12,135,136],{},"Each of GitLab’s security certifications has security and compliance requirements that must be operating effectively to achieve certification.",[12,138,139],{},"GitLab offers native features within the platform that enable security and the achievement of industry-standard requirements.",[12,141,142],{},"We leveraged these key security features for our certifications and you can, too:",[75,144,145,181,198,217,246],{},[78,146,147,154,155],{},[81,148,149,60],{},[16,150,153],{"href":151,"rel":152},"https://docs.gitlab.com/user/project/merge_requests/approvals/settings/",[],"Merge request approval settings"," These settings can be configured to limit merge request approvals, enforce segregation of duties responsibilities, and force password authentication. For our certifications, merge request approval settings were inspected for relevant projects to support the following requirements:",[156,157,158,166,174],"ul",{},[78,159,160,165],{},[16,161,164],{"href":162,"rel":163},"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022",[],"AICPA Trust Service Critieria (TSC)"," CC8.1",[78,167,168,173],{},[16,169,172],{"href":170,"rel":171},"https://www.iso.org/standard/27001",[],"ISO 27001:2022"," 5.3, 8.32",[78,175,176,180],{},[16,177,26],{"href":178,"rel":179},"https://portal.enx.com/en-us/tisax/",[]," 5.2.1",[78,182,183,186,187],{},[81,184,185],{},"Protected branch settings."," These configuration settings allow administrators to set branch protections and limit what users can do based on their configured permissions. For our certifications, protected branches were inspected for relevant projects to support the following requirements:",[156,188,189,192,195],{},[78,190,191],{},"AICPA TSC CC8.1",[78,193,194],{},"ISO 27001:2022 8.32",[78,196,197],{},"TISAX 5.2.1, 5.2.2",[78,199,200,207,208],{},[81,201,202,60],{},[16,203,206],{"href":204,"rel":205},"https://docs.gitlab.com/user/project/codeowners/",[],"Code owners"," This feature specifies the users or groups responsible for specific files and directories in a repository. The CODEOWNERS file can be enabled to identify owners of a file or directory and require owners to approve changes. Code owners can be implemented in conjunction with your approval rules. For our certifications, CODEOWNERS files were inspected for relevant projects to support the following requirements:",[156,209,210,212,214],{},[78,211,191],{},[78,213,194],{},[78,215,216],{},"TISAX 5.2.1",[78,218,219,234,235],{},[81,220,221,222,227,228,233],{},"Static application security testing (",[16,223,226],{"href":224,"rel":225},"https://docs.gitlab.com/user/application_security/sast/",[],"SAST",")/dynamic application security testing (",[16,229,232],{"href":230,"rel":231},"https://docs.gitlab.com/user/application_security/dast/",[],"DAST",")."," A part of using GitLab CI/CD, SAST and DAST are available to check your source code for known vulnerabilities. For our certifications, We leveraged SAST/DAST to support the following requirements:",[156,236,237,240,243],{},[78,238,239],{},"AICPA TSC CC3.2, CC7.1, CC9.2",[78,241,242],{},"ISO 27001:2022 8.28, 8.29",[78,244,245],{},"TISAX 5.2.5",[78,247,248,249],{},"Audit events. This feature is used to track important events, including who performed what action and when. Audit events can be used to support the following requirements:",[156,250,251,253,256],{},[78,252,191],{},[78,254,255],{},"ISO 27001:2022 8.15, 8.16",[78,257,258],{},"TISAX 5.2.4",[62,260,262],{"id":261},"get-started-today","Get started today",[12,264,265],{},"GitLab makes compliance easier than ever. Agile planning enables end-to-end visibility throughout the audit. and security is integrated into the design of the product, leading to faster, more comprehensive achievement of compliance requirements.",[12,267,268],{},"Here at GitLab we are always pursuing the expansion of our security certification portfolio to give our customers and community additional assurance as well as additional transparency into our information security practices.",[50,270,271],{},[12,272,273,274,278],{},"Have a certification you’d like to see us work towards? Have questions about how your organization can set up your GitLab instance to utilize our compliance features? Drop us a line by emailing ",[16,275,277],{"href":276},"mailto:customer-assurance@gitlab.com","customer-assurance@gitlab.com",", we’d love to hear from you!",[62,280,282],{"id":281},"more-building-gitlab-with-gitlab","More Building GitLab with GitLab",[156,284,285,292,299,306],{},[78,286,287],{},[16,288,291],{"href":289,"rel":290},"https://about.gitlab.com/blog/building-gitlab-with-gitlabcom-how-gitlab-inspired-dedicated/",[],"Building GitLab with GitLab: How GitLab.com inspired Dedicated",[78,293,294],{},[16,295,298],{"href":296,"rel":297},"https://about.gitlab.com/blog/building-gitlab-with-gitlab-api-fuzzing-workflow/",[],"Building GitLab with GitLab: Web API Fuzz Testing",[78,300,301],{},[16,302,305],{"href":303,"rel":304},"https://about.gitlab.com/blog/there-is-no-mlops-without-devsecops/",[],"Building GitLab with GitLab: Why there is no MLOps without DevSecOps",[78,307,308],{},[16,309,312],{"href":310,"rel":311},"https://about.gitlab.com/blog/building-gitlab-with-gitlab-stress-testing-product-analytics/",[],"Building GitLab with GitLab: Stress-testing Product Analytics",{"title":314,"searchDepth":315,"depth":315,"links":316},"",2,[317,318,319,320],{"id":64,"depth":315,"text":65},{"id":132,"depth":315,"text":133},{"id":261,"depth":315,"text":262},{"id":281,"depth":315,"text":282},"security-labs","2024-04-04","Learn how the Security Compliance team uses the Agile planning and security features in the GitLab DevSecOps Platform to manage the certification process.\n\n","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659740/Blog/Hero%20Images/building-gitlab-with-gitlab-no-type.png",{},true,"/en-us/blog/building-gitlab-with-gitlab-expanding-our-security-certification-portfolio",{"title":5,"description":323,"ogTitle":5,"ogDescription":323,"noIndex":326,"ogImage":327,"ogUrl":332,"ogSiteName":333,"ogType":334,"canonicalUrls":332},"https://about.gitlab.com/blog/building-gitlab-with-gitlab-expanding-our-security-certification-portfolio","https://about.gitlab.com","article","building-gitlab-with-gitlab-expanding-our-security-certification-portfolio","en-us/blog/building-gitlab-with-gitlab-expanding-our-security-certification-portfolio",[338,132,339],"agile","embedded DevOps","BlogPost","Nwf0ophz2dmhw3dv8wD54BSIM4eRmXyIZTVM4ogqMJ4",{"logo":343,"freeTrial":348,"sales":353,"login":358,"items":363,"search":689,"minimal":720,"duo":739,"switchNav":748,"pricingDeployment":759},{"config":344},{"href":345,"dataGaName":346,"dataGaLocation":347},"/","gitlab logo","header",{"text":349,"config":350},"Get free trial",{"href":351,"dataGaName":352,"dataGaLocation":347},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":354,"config":355},"Request a demo",{"href":356,"dataGaName":357,"dataGaLocation":347},"/sales/?contact-topic=request-demo","sales",{"text":359,"config":360},"Sign in",{"href":361,"dataGaName":362,"dataGaLocation":347},"https://gitlab.com/users/sign_in/","sign in",[364,393,492,497,611,667],{"text":365,"config":366,"menu":368},"Platform",{"dataNavLevelOne":367},"platform",{"type":369,"columns":370},"cards",[371,377,385],{"title":365,"description":372,"link":373},"The intelligent orchestration platform for DevSecOps",{"text":374,"config":375},"Explore our Platform",{"href":376,"dataGaName":367,"dataGaLocation":347},"/platform/",{"title":378,"description":379,"link":380},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":381,"config":382},"Meet GitLab Duo",{"href":383,"dataGaName":384,"dataGaLocation":347},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":386,"description":387,"link":388},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":389,"config":390},"Learn more",{"href":391,"dataGaName":392,"dataGaLocation":347},"/why-gitlab/","why gitlab",{"text":394,"left":329,"config":395,"menu":397},"Product",{"dataNavLevelOne":396},"solutions",{"type":398,"link":399,"columns":403,"feature":471},"lists",{"text":400,"config":401},"View all Solutions",{"href":402,"dataGaName":396,"dataGaLocation":347},"/solutions/",[404,428,450],{"title":405,"description":406,"link":407,"items":412},"Automation","CI/CD and automation to accelerate deployment",{"config":408},{"icon":409,"href":410,"dataGaName":411,"dataGaLocation":347},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[413,417,420,424],{"text":414,"config":415},"CI/CD",{"href":416,"dataGaLocation":347,"dataGaName":414},"/solutions/continuous-integration/",{"text":378,"config":418},{"href":383,"dataGaLocation":347,"dataGaName":419},"gitlab duo agent platform - product menu",{"text":421,"config":422},"Source Code Management",{"href":423,"dataGaLocation":347,"dataGaName":421},"/solutions/source-code-management/",{"text":425,"config":426},"Automated Software Delivery",{"href":410,"dataGaLocation":347,"dataGaName":427},"Automated software delivery",{"title":133,"description":429,"link":430,"items":435},"Deliver code faster without compromising security",{"config":431},{"href":432,"dataGaName":433,"dataGaLocation":347,"icon":434},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[436,440,445],{"text":437,"config":438},"Application Security Testing",{"href":432,"dataGaName":439,"dataGaLocation":347},"Application security testing",{"text":441,"config":442},"Software Supply Chain Security",{"href":443,"dataGaLocation":347,"dataGaName":444},"/solutions/supply-chain/","Software supply chain security",{"text":446,"config":447},"Software Compliance",{"href":448,"dataGaName":449,"dataGaLocation":347},"/solutions/software-compliance/","software compliance",{"title":451,"link":452,"items":457},"Measurement",{"config":453},{"icon":454,"href":455,"dataGaName":456,"dataGaLocation":347},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[458,462,466],{"text":459,"config":460},"Visibility & Measurement",{"href":455,"dataGaLocation":347,"dataGaName":461},"Visibility and Measurement",{"text":463,"config":464},"Value Stream Management",{"href":465,"dataGaLocation":347,"dataGaName":463},"/solutions/value-stream-management/",{"text":467,"config":468},"Analytics & Insights",{"href":469,"dataGaLocation":347,"dataGaName":470},"/solutions/analytics-and-insights/","Analytics and insights",{"title":472,"type":398,"items":473},"GitLab for",[474,480,486],{"text":475,"config":476},"Enterprise",{"icon":477,"href":478,"dataGaLocation":347,"dataGaName":479},"Building","/enterprise/","enterprise",{"text":481,"config":482},"Small Business",{"icon":483,"href":484,"dataGaLocation":347,"dataGaName":485},"Work","/small-business/","small business",{"text":487,"config":488},"Public Sector",{"icon":489,"href":490,"dataGaLocation":347,"dataGaName":491},"Organization","/solutions/public-sector/","public sector",{"text":493,"config":494},"Pricing",{"href":495,"dataGaName":496,"dataGaLocation":347,"dataNavLevelOne":496},"/pricing/","pricing",{"text":498,"config":499,"menu":501},"Resources",{"dataNavLevelOne":500},"resources",{"type":398,"link":502,"columns":506,"feature":600},{"text":503,"config":504},"View all resources",{"href":505,"dataGaName":500,"dataGaLocation":347},"/resources/",[507,540,567],{"title":508,"items":509},"Getting started",[510,515,520,525,530,535],{"text":511,"config":512},"Install",{"href":513,"dataGaName":514,"dataGaLocation":347},"/install/","install",{"text":516,"config":517},"Quick start guides",{"href":518,"dataGaName":519,"dataGaLocation":347},"/get-started/","quick setup checklists",{"text":521,"config":522},"Learn",{"href":523,"dataGaLocation":347,"dataGaName":524},"https://university.gitlab.com/","learn",{"text":526,"config":527},"Product documentation",{"href":528,"dataGaName":529,"dataGaLocation":347},"https://docs.gitlab.com/","product documentation",{"text":531,"config":532},"Best practice videos",{"href":533,"dataGaName":534,"dataGaLocation":347},"/getting-started-videos/","best practice videos",{"text":536,"config":537},"Integrations",{"href":538,"dataGaName":539,"dataGaLocation":347},"/integrations/","integrations",{"title":541,"items":542},"Discover",[543,548,553,558,562],{"text":544,"config":545},"Customer success stories",{"href":546,"dataGaName":547,"dataGaLocation":347},"/customers/","customer success stories",{"text":549,"config":550},"Blog",{"href":551,"dataGaName":552,"dataGaLocation":347},"/blog/","blog",{"text":554,"config":555},"Demo Hub",{"href":556,"dataGaName":557,"dataGaLocation":347},"/demo-hub/","demo hub",{"text":559,"config":560},"The Source",{"href":561,"dataGaName":552,"dataGaLocation":347},"/the-source/",{"text":563,"config":564},"Remote",{"href":565,"dataGaName":566,"dataGaLocation":347},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":568,"items":569},"Connect",[570,575,580,585,590,595],{"text":571,"config":572},"GitLab Services",{"href":573,"dataGaName":574,"dataGaLocation":347},"/services/","services",{"text":576,"config":577},"Contribute",{"href":578,"dataGaName":579,"dataGaLocation":347},"https://contributors.gitlab.com","contribute",{"text":581,"config":582},"Community",{"href":583,"dataGaName":584,"dataGaLocation":347},"/community/","community",{"text":586,"config":587},"Forum",{"href":588,"dataGaName":589,"dataGaLocation":347},"https://forum.gitlab.com/","forum",{"text":591,"config":592},"Events",{"href":593,"dataGaName":594,"dataGaLocation":347},"/events/","events",{"text":596,"config":597},"Partners",{"href":598,"dataGaName":599,"dataGaLocation":347},"/partners/","partners",{"config":601,"title":604,"text":605,"link":606},{"background":602,"textColor":603},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":607,"config":608},"Read the latest",{"href":609,"dataGaName":610,"dataGaLocation":347},"/whats-new/","whats new",{"text":612,"config":613,"menu":615},"Company",{"dataNavLevelOne":614},"company",{"type":398,"columns":616},[617],{"items":618},[619,624,630,632,637,642,647,652,657,662],{"text":620,"config":621},"About",{"href":622,"dataGaName":623,"dataGaLocation":347},"/company/","about",{"text":625,"config":626,"footerGa":629},"Jobs",{"href":627,"dataGaName":628,"dataGaLocation":347},"/jobs/","jobs",{"dataGaName":628},{"text":591,"config":631},{"href":593,"dataGaName":594,"dataGaLocation":347},{"text":633,"config":634},"Leadership",{"href":635,"dataGaName":636,"dataGaLocation":347},"/company/team/e-group/","leadership",{"text":638,"config":639},"Handbook",{"href":640,"dataGaName":641,"dataGaLocation":347},"https://handbook.gitlab.com/","handbook",{"text":643,"config":644},"Investor relations",{"href":645,"dataGaName":646,"dataGaLocation":347},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":648,"config":649},"Trust Center",{"href":650,"dataGaName":651,"dataGaLocation":347},"/security/","trust center",{"text":653,"config":654},"AI Transparency Center",{"href":655,"dataGaName":656,"dataGaLocation":347},"/ai-transparency-center/","ai transparency center",{"text":658,"config":659},"Newsletter",{"href":660,"dataGaName":661,"dataGaLocation":347},"/company/contact/#contact-forms","newsletter",{"text":663,"config":664},"Press",{"href":665,"dataGaName":666,"dataGaLocation":347},"/press/","press",{"text":668,"config":669,"menu":670},"Contact us",{"dataNavLevelOne":614},{"type":398,"columns":671},[672],{"items":673},[674,679,684],{"text":675,"config":676},"Talk to sales",{"href":677,"dataGaName":678,"dataGaLocation":347},"/sales/","talk to sales",{"text":680,"config":681},"Support portal",{"href":682,"dataGaName":683,"dataGaLocation":347},"https://support.gitlab.com/hc/en-us","support portal",{"text":685,"config":686},"Customer portal",{"href":687,"dataGaName":688,"dataGaLocation":347},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":690,"login":691,"suggestions":698},"Close",{"text":692,"link":693},"To search repositories and projects, login to",{"text":694,"config":695},"gitlab.com",{"href":361,"dataGaName":696,"dataGaLocation":697},"search login","search",{"text":699,"default":700},"Suggestions",[701,703,707,709,713,717],{"text":378,"config":702},{"href":383,"dataGaName":378,"dataGaLocation":697},{"text":704,"config":705},"Code Suggestions (AI)",{"href":706,"dataGaName":704,"dataGaLocation":697},"/solutions/code-suggestions/",{"text":414,"config":708},{"href":416,"dataGaName":414,"dataGaLocation":697},{"text":710,"config":711},"GitLab on AWS",{"href":712,"dataGaName":710,"dataGaLocation":697},"/partners/technology-partners/aws/",{"text":714,"config":715},"GitLab on Google Cloud",{"href":716,"dataGaName":714,"dataGaLocation":697},"/partners/technology-partners/google-cloud-platform/",{"text":718,"config":719},"Why GitLab?",{"href":391,"dataGaName":718,"dataGaLocation":697},{"freeTrial":721,"mobileIcon":726,"desktopIcon":731,"secondaryButton":734},{"text":722,"config":723},"Start free trial",{"href":724,"dataGaName":352,"dataGaLocation":725},"https://gitlab.com/-/trials/new/","nav",{"altText":727,"config":728},"Gitlab Icon",{"src":729,"dataGaName":730,"dataGaLocation":725},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":727,"config":732},{"src":733,"dataGaName":730,"dataGaLocation":725},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":735,"config":736},"Get Started",{"href":737,"dataGaName":738,"dataGaLocation":725},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":740,"mobileIcon":744,"desktopIcon":746},{"text":741,"config":742},"Learn more about GitLab Duo",{"href":383,"dataGaName":743,"dataGaLocation":725},"gitlab duo",{"altText":727,"config":745},{"src":729,"dataGaName":730,"dataGaLocation":725},{"altText":727,"config":747},{"src":733,"dataGaName":730,"dataGaLocation":725},{"button":749,"mobileIcon":754,"desktopIcon":756},{"text":750,"config":751},"/switch",{"href":752,"dataGaName":753,"dataGaLocation":725},"#contact","switch",{"altText":727,"config":755},{"src":729,"dataGaName":730,"dataGaLocation":725},{"altText":727,"config":757},{"src":758,"dataGaName":730,"dataGaLocation":725},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":760,"mobileIcon":765,"desktopIcon":767},{"text":761,"config":762},"Back to pricing",{"href":495,"dataGaName":763,"dataGaLocation":725,"icon":764},"back to pricing","GoBack",{"altText":727,"config":766},{"src":729,"dataGaName":730,"dataGaLocation":725},{"altText":727,"config":768},{"src":733,"dataGaName":730,"dataGaLocation":725},{"title":770,"titleMobile":771,"button":772,"config":777},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":389,"config":773},{"href":774,"dataGaName":775,"dataGaLocation":776},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":778,"disabled":326},"release",{"data":780},{"text":781,"source":782,"edit":788,"contribute":793,"config":798,"items":803,"minimal":1013},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":783,"config":784},"View page source",{"href":785,"dataGaName":786,"dataGaLocation":787},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":789,"config":790},"Edit this page",{"href":791,"dataGaName":792,"dataGaLocation":787},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":794,"config":795},"Please contribute",{"href":796,"dataGaName":797,"dataGaLocation":787},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":799,"facebook":800,"youtube":801,"linkedin":802},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[804,851,905,949,981],{"title":493,"links":805,"subMenu":820},[806,810,815],{"text":807,"config":808},"View plans",{"href":495,"dataGaName":809,"dataGaLocation":787},"view plans",{"text":811,"config":812},"Why Premium?",{"href":813,"dataGaName":814,"dataGaLocation":787},"/pricing/premium/","why premium",{"text":816,"config":817},"Why Ultimate?",{"href":818,"dataGaName":819,"dataGaLocation":787},"/pricing/ultimate/","why ultimate",[821],{"title":822,"links":823},"Contact Us",[824,827,829,831,836,841,846],{"text":825,"config":826},"Contact sales",{"href":677,"dataGaName":357,"dataGaLocation":787},{"text":680,"config":828},{"href":682,"dataGaName":683,"dataGaLocation":787},{"text":685,"config":830},{"href":687,"dataGaName":688,"dataGaLocation":787},{"text":832,"config":833},"Status",{"href":834,"dataGaName":835,"dataGaLocation":787},"https://status.gitlab.com/","status",{"text":837,"config":838},"Terms of use",{"href":839,"dataGaName":840,"dataGaLocation":787},"/terms/","terms of use",{"text":842,"config":843},"Privacy statement",{"href":844,"dataGaName":845,"dataGaLocation":787},"/privacy/","privacy statement",{"text":847,"config":848},"Cookie preferences",{"dataGaName":849,"dataGaLocation":787,"id":850,"isOneTrustButton":329},"cookie preferences","ot-sdk-btn",{"title":394,"links":852,"subMenu":861},[853,857],{"text":854,"config":855},"DevSecOps platform",{"href":376,"dataGaName":856,"dataGaLocation":787},"devsecops platform",{"text":858,"config":859},"AI-Assisted Development",{"href":383,"dataGaName":860,"dataGaLocation":787},"ai-assisted development",[862],{"title":863,"links":864},"Topics",[865,870,875,880,885,890,895,900],{"text":866,"config":867},"CICD",{"href":868,"dataGaName":869,"dataGaLocation":787},"/topics/ci-cd/","cicd",{"text":871,"config":872},"GitOps",{"href":873,"dataGaName":874,"dataGaLocation":787},"/topics/gitops/","gitops",{"text":876,"config":877},"DevOps",{"href":878,"dataGaName":879,"dataGaLocation":787},"/topics/devops/","devops",{"text":881,"config":882},"Version Control",{"href":883,"dataGaName":884,"dataGaLocation":787},"/topics/version-control/","version control",{"text":886,"config":887},"DevSecOps",{"href":888,"dataGaName":889,"dataGaLocation":787},"/topics/devsecops/","devsecops",{"text":891,"config":892},"Cloud Native",{"href":893,"dataGaName":894,"dataGaLocation":787},"/topics/cloud-native/","cloud native",{"text":896,"config":897},"AI for Coding",{"href":898,"dataGaName":899,"dataGaLocation":787},"/topics/devops/ai-for-coding/","ai for coding",{"text":901,"config":902},"Agentic AI",{"href":903,"dataGaName":904,"dataGaLocation":787},"/topics/agentic-ai/","agentic ai",{"title":906,"links":907},"Solutions",[908,910,912,917,921,924,928,931,933,936,939,944],{"text":437,"config":909},{"href":432,"dataGaName":437,"dataGaLocation":787},{"text":427,"config":911},{"href":410,"dataGaName":411,"dataGaLocation":787},{"text":913,"config":914},"Agile development",{"href":915,"dataGaName":916,"dataGaLocation":787},"/solutions/agile-delivery/","agile delivery",{"text":918,"config":919},"SCM",{"href":423,"dataGaName":920,"dataGaLocation":787},"source code management",{"text":866,"config":922},{"href":416,"dataGaName":923,"dataGaLocation":787},"continuous integration & delivery",{"text":925,"config":926},"Value stream management",{"href":465,"dataGaName":927,"dataGaLocation":787},"value stream management",{"text":871,"config":929},{"href":930,"dataGaName":874,"dataGaLocation":787},"/solutions/gitops/",{"text":475,"config":932},{"href":478,"dataGaName":479,"dataGaLocation":787},{"text":934,"config":935},"Small business",{"href":484,"dataGaName":485,"dataGaLocation":787},{"text":937,"config":938},"Public sector",{"href":490,"dataGaName":491,"dataGaLocation":787},{"text":940,"config":941},"Education",{"href":942,"dataGaName":943,"dataGaLocation":787},"/solutions/education/","education",{"text":945,"config":946},"Financial services",{"href":947,"dataGaName":948,"dataGaLocation":787},"/solutions/finance/","financial services",{"title":498,"links":950},[951,953,955,957,960,962,965,967,969,971,973,975,977,979],{"text":511,"config":952},{"href":513,"dataGaName":514,"dataGaLocation":787},{"text":516,"config":954},{"href":518,"dataGaName":519,"dataGaLocation":787},{"text":521,"config":956},{"href":523,"dataGaName":524,"dataGaLocation":787},{"text":526,"config":958},{"href":528,"dataGaName":959,"dataGaLocation":787},"docs",{"text":549,"config":961},{"href":551,"dataGaName":552,"dataGaLocation":787},{"text":963,"config":964},"What's new",{"href":609,"dataGaName":610,"dataGaLocation":787},{"text":544,"config":966},{"href":546,"dataGaName":547,"dataGaLocation":787},{"text":563,"config":968},{"href":565,"dataGaName":566,"dataGaLocation":787},{"text":571,"config":970},{"href":573,"dataGaName":574,"dataGaLocation":787},{"text":576,"config":972},{"href":578,"dataGaName":579,"dataGaLocation":787},{"text":581,"config":974},{"href":583,"dataGaName":584,"dataGaLocation":787},{"text":586,"config":976},{"href":588,"dataGaName":589,"dataGaLocation":787},{"text":591,"config":978},{"href":593,"dataGaName":594,"dataGaLocation":787},{"text":596,"config":980},{"href":598,"dataGaName":599,"dataGaLocation":787},{"title":612,"links":982},[983,985,987,989,991,993,997,1002,1004,1006,1008],{"text":620,"config":984},{"href":622,"dataGaName":614,"dataGaLocation":787},{"text":625,"config":986},{"href":627,"dataGaName":628,"dataGaLocation":787},{"text":633,"config":988},{"href":635,"dataGaName":636,"dataGaLocation":787},{"text":638,"config":990},{"href":640,"dataGaName":641,"dataGaLocation":787},{"text":643,"config":992},{"href":645,"dataGaName":646,"dataGaLocation":787},{"text":994,"config":995},"Sustainability",{"href":996,"dataGaName":994,"dataGaLocation":787},"/sustainability/",{"text":998,"config":999},"Diversity, inclusion and belonging (DIB)",{"href":1000,"dataGaName":1001,"dataGaLocation":787},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":648,"config":1003},{"href":650,"dataGaName":651,"dataGaLocation":787},{"text":658,"config":1005},{"href":660,"dataGaName":661,"dataGaLocation":787},{"text":663,"config":1007},{"href":665,"dataGaName":666,"dataGaLocation":787},{"text":1009,"config":1010},"Modern Slavery Transparency Statement",{"href":1011,"dataGaName":1012,"dataGaLocation":787},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1014},[1015,1018,1021],{"text":1016,"config":1017},"Terms",{"href":839,"dataGaName":840,"dataGaLocation":787},{"text":1019,"config":1020},"Cookies",{"dataGaName":849,"dataGaLocation":787,"id":850,"isOneTrustButton":329},{"text":1022,"config":1023},"Privacy",{"href":844,"dataGaName":845,"dataGaLocation":787},[1025],{"id":1026,"title":7,"body":325,"config":1027,"content":1029,"description":325,"extension":1033,"meta":1034,"navigation":329,"path":1035,"seo":1036,"stem":1037,"__hash__":1038},"blogAuthors/en-us/blog/authors/madeline-lake.yml",{"template":1028},"BlogAuthor",{"name":7,"config":1030},{"headshot":1031,"ctfId":1032},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659736/Blog/Author%20Headshots/madlake-headshot.jpg","madlake","yml",{},"/en-us/blog/authors/madeline-lake",{},"en-us/blog/authors/madeline-lake","wc1XeqlglUDVgKznqVDbvWqojsm8nt25Olw0crrDwxk",[1040,1048,1056],{"title":1041,"description":1042,"heroImage":1043,"category":321,"date":1044,"authors":1045,"slug":1047,"externalUrl":325},"A sandbox is only as closed as what an AI agent can reach","Stuck in an evaluation with no way out, an AI agent escaped in an hour through the one service on its allowlist. Here's the gap that opened.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1786468880/uxouffutvvwsbxzikhyc.png","2026-08-12",[1046],"Daniel Abeles","ai-agent-sandbox",{"title":1049,"description":1050,"heroImage":1051,"category":321,"date":1052,"authors":1053,"slug":1055,"externalUrl":325},"Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting","GitLab’s Vulnerability Research team has uncovered a new Python supply chain attack targeting PyPI, deploying the Shai-Hulud worm to steal credentials from CI/CD systems.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772630163/akp8ly2mrsfrhsb0liyb.png","2026-06-09",[1054,1046],"Dinesh Bolkensteyn","shai-hulud-copycat-campaign-targets-python-developers",{"title":1057,"description":1058,"heroImage":1059,"category":321,"date":1060,"authors":1061,"slug":1064,"externalUrl":325},"How to detect and prevent Contagious Interview IDE attacks","Learn how we built custom controls that detect and prevent malware campaigns like those used for Contagious Interview and how to deploy them in your environment.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774375772/kpaaaiqhokevxxeoxvu0.png","2026-05-04",[1062,1063],"Josh Feehs","Austin Bollinger","how-to-detect-and-prevent-contagious-interview-ide-attacks",{"promotions":1066},[1067,1081,1093,1104],{"id":1068,"categories":1069,"header":1071,"text":1072,"button":1073,"image":1078},"ai-modernization",[1070],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1074,"config":1075},"Get your AI maturity score",{"href":1076,"dataGaName":1077,"dataGaLocation":552},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1079},{"src":1080},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1082,"categories":1083,"header":1085,"text":1072,"button":1086,"image":1090},"devops-modernization",[1084,889],"product","Are you just managing tools or shipping innovation?",{"text":1087,"config":1088},"Get your DevOps maturity score",{"href":1089,"dataGaName":1077,"dataGaLocation":552},"/assessments/devops-modernization-assessment/",{"config":1091},{"src":1092},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1094,"categories":1095,"header":1096,"text":1072,"button":1097,"image":1101},"security-modernization",[132],"Are you trading speed for security?",{"text":1098,"config":1099},"Get your security maturity score",{"href":1100,"dataGaName":1077,"dataGaLocation":552},"/assessments/security-modernization-assessment/",{"config":1102},{"src":1103},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1105,"paths":1106,"header":1109,"text":1110,"button":1111,"image":1116},"github-azure-migration",[1107,1108],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1112,"config":1113},"See how GitLab compares to GitHub",{"href":1114,"dataGaName":1115,"dataGaLocation":552},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1117},{"src":1092},{"header":1119,"blurb":1120,"button":1121,"secondaryButton":1126},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1122,"config":1123},"Get your free trial",{"href":1124,"dataGaName":352,"dataGaLocation":1125},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":825,"config":1127},{"href":677,"dataGaName":357,"dataGaLocation":1125},1786803766941]