[{"data":1,"prerenderedAt":1426},["ShallowReactive",2],{"/blog/critical-rce-in-serena":3,"navigation-en-us":657,"banner-en-us":1089,"footer-en-us":1099,"blog-post-authors-en-us-Daniel Abeles|Abisheik Magesh":1360,"blog-related-posts-en-us-critical-rce-in-serena":1386,"blog-share-wrapper-en-us":1406,"next-steps-en-us":1416},{"id":4,"title":5,"authors":6,"body":9,"category":639,"date":640,"description":641,"extension":642,"externalUrl":643,"faq":643,"featured":262,"heroImage":644,"meta":645,"navigation":262,"path":646,"seo":647,"slug":650,"stem":651,"tags":652,"template":655,"updatedDate":643,"__hash__":656},"blogPosts/en-us/blog/critical-rce-in-serena.md","Critical remote code execution in Serena, a popular MCP coding agent",[7,8],"Daniel Abeles","Abisheik Magesh",{"type":10,"value":11,"toc":619},"minimark",[12,23,35,38,43,46,53,56,60,65,68,78,88,92,103,137,155,159,173,338,354,358,383,389,438,441,444,448,454,457,461,468,471,475,478,481,484,487,491,495,502,506,509,525,529,532,536,593,595,598,602,605,609,612,615],[13,14,15,16,22],"p",{},"Serena, one of the most widely used AI coding agents, ran attacker-supplied code the moment a developer opened a project. GitLab's Threat Research Group found a critical server-side template injection (",[17,18,21],"a",{"href":19,"rel":20},"https://github.com/oraios/serena/security/advisories/GHSA-pp25-4cg4-qcr9",[],"GHSA-pp25-4cg4-qcr9",", CVE pending) that executes arbitrary code in the Serena process. Anyone on serena-agent 1.6.1 or earlier should update to 1.7.0 now.",[13,24,25,26,30,31,34],{},"A threat actor can exploit this by hiding a malicious ",[27,28,29],"code",{},".serena/project.yml"," file into a repository it controls and getting a developer to open it via the Serena Model Context Protocol (MCP) server. The flaw bypasses ",[27,32,33],{},"trusted_project_path_patterns",", the control Serena built specifically to stop untrusted repositories from running code. We reported it privately on August 1, 2026, and the maintainers shipped a fix eight days later.",[13,36,37],{},"It is an early example of a risk class that will spread as MCP servers become embedded in the software development lifecycle.",[39,40,42],"h2",{"id":41},"why-mcp-servers-are-a-different-kind-of-attack-surface","Why MCP servers are a different kind of attack surface",[13,44,45],{},"Most developer tools touch a codebase in a narrow way: A linter reads files, a formatter writes them, and a test runner executes a specific harness. Conversely, MCP servers hand a large language model (LLM) a general-purpose interface to the developer's environment, covering file system access, shell execution, language server queries, and sometimes the network. The same reach that makes them useful makes compromising the server process severe.",[13,47,48,49,52],{},"CI/CD pipelines run in isolated environments with scoped credentials. MCP servers run on the developer's own machine, in the developer's own user context, with access to everything the developer can reach: SSH keys, cloud provider credentials, ",[27,50,51],{},".env"," files, browser sessions, and internal network resources. Compromise the server process and you compromise the developer's entire local environment.",[13,54,55],{},"Developers point these servers at repositories they did not write all the time: evaluating a new open-source library, triaging a bug report, or reviewing a contributor's branch. If the server processes anything from that repository before the developer inspects it, the attacker gets a window. Serena is explicit about this threat and ships a trust model to prevent untrusted repositories from executing code. The trust model had a gap.",[39,57,59],{"id":58},"how-the-vulnerability-works","How the vulnerability works",[61,62,64],"h3",{"id":63},"what-serena-is","What Serena is",[13,66,67],{},"Serena describes itself as \"the IDE for your agent.\" It connects Claude, Cursor, Copilot, and other AI assistants to a local codebase over MCP, providing semantic code navigation, refactoring, and editing tools that go beyond what a raw file system gives an LLM. Developers run it as a local MCP server and point their assistant at it:",[69,70,75],"pre",{"className":71,"code":73,"language":74},[72],"language-text","serena start-mcp-server --project /path/to/repo\n","text",[27,76,73],{"__ignoreMap":77},"",[13,79,80,81,83,84,87],{},"Because Serena operates on arbitrary local repositories with the user's full OS privileges, it ships a trust gate. ",[27,82,33],{}," controls which project paths count as trusted, and only trusted projects can use privileged features like ",[27,85,86],{},"activation_command",", which runs a shell command on project open. The intended guarantee: opening an untrusted repository is safe.",[61,89,91],{"id":90},"the-sink-an-unsandboxed-template-engine","The sink: An unsandboxed template engine",[13,93,94,95,98,99,102],{},"Serena lets each project define custom modes, named configurations with a ",[27,96,97],{},"prompt"," field that gets injected into the LLM's system prompt when the project is active. Serena renders these prompts as Jinja2 templates, and the rendering is the problem. In ",[27,100,101],{},"src/interprompt/jinja_template.py",":",[69,104,108],{"className":105,"code":106,"language":107,"meta":77,"style":77},"language-py shiki shiki-themes github-light","# line 22\nself._env = jinja2.Environment()\n","py",[27,109,110,119],{"__ignoreMap":77},[111,112,115],"span",{"class":113,"line":114},"line",1,[111,116,118],{"class":117},"sAwPA","# line 22\n",[111,120,122,126,130,134],{"class":113,"line":121},2,[111,123,125],{"class":124},"sYu0t","self",[111,127,129],{"class":128},"sgsFI","._env ",[111,131,133],{"class":132},"sD7c4","=",[111,135,136],{"class":128}," jinja2.Environment()\n",[13,138,139,142,143,146,147,150,151,154],{},[27,140,141],{},"jinja2.Environment()"," is a plain, unsandboxed environment. It exposes built-in globals whose attributes chain up through Python's object graph to ",[27,144,145],{},"os"," and ",[27,148,149],{},"subprocess",". The techniques for reaching arbitrary code execution from that starting point are well documented and require no specialized knowledge. Jinja2 ships a ",[27,152,153],{},"SandboxedEnvironment"," for exactly this reason, but it was not used here.",[61,156,158],{"id":157},"the-delivery-project-configuration-as-untrusted-input","The delivery: Project configuration as untrusted input",[13,160,161,162,164,165,168,169,172],{},"A project's ",[27,163,29],{}," supports an ",[27,166,167],{},"added_modes"," field, listing additional modes to activate when the project opens. Serena's mode loader treats any name containing a path separator or ending in ",[27,170,171],{},".yml"," as a filesystem path to load directly:",[69,174,176],{"className":105,"code":175,"language":107,"meta":77,"style":77},"# context_mode.py, lines 29-30\ndef looks_like_yaml_path(s: str) -> bool:\n    return os.sep in s or (os.altsep and os.altsep in s) or s.lower().endswith((\".yml\", \".yaml\"))\n\n# context_mode.py, lines 130-135\n@classmethod\ndef load(cls, name_or_path: str | Path) -> Self:\n    if isinstance(name_or_path, Path) or looks_like_yaml_path(str(name_or_path)):\n        return cls.from_yaml(name_or_path)\n    ...\n",[27,177,178,183,207,257,264,270,279,298,320,332],{"__ignoreMap":77},[111,179,180],{"class":113,"line":114},[111,181,182],{"class":117},"# context_mode.py, lines 29-30\n",[111,184,185,188,192,195,198,201,204],{"class":113,"line":121},[111,186,187],{"class":132},"def",[111,189,191],{"class":190},"s7eDp"," looks_like_yaml_path",[111,193,194],{"class":128},"(s: ",[111,196,197],{"class":124},"str",[111,199,200],{"class":128},") -> ",[111,202,203],{"class":124},"bool",[111,205,206],{"class":128},":\n",[111,208,210,213,216,219,222,225,228,231,234,236,239,241,244,248,251,254],{"class":113,"line":209},3,[111,211,212],{"class":132},"    return",[111,214,215],{"class":128}," os.sep ",[111,217,218],{"class":132},"in",[111,220,221],{"class":128}," s ",[111,223,224],{"class":132},"or",[111,226,227],{"class":128}," (os.altsep ",[111,229,230],{"class":132},"and",[111,232,233],{"class":128}," os.altsep ",[111,235,218],{"class":132},[111,237,238],{"class":128}," s) ",[111,240,224],{"class":132},[111,242,243],{"class":128}," s.lower().endswith((",[111,245,247],{"class":246},"sYBdl","\".yml\"",[111,249,250],{"class":128},", ",[111,252,253],{"class":246},"\".yaml\"",[111,255,256],{"class":128},"))\n",[111,258,260],{"class":113,"line":259},4,[111,261,263],{"emptyLinePlaceholder":262},true,"\n",[111,265,267],{"class":113,"line":266},5,[111,268,269],{"class":117},"# context_mode.py, lines 130-135\n",[111,271,273,276],{"class":113,"line":272},6,[111,274,275],{"class":190},"@",[111,277,278],{"class":124},"classmethod\n",[111,280,282,284,287,290,292,295],{"class":113,"line":281},7,[111,283,187],{"class":132},[111,285,286],{"class":190}," load",[111,288,289],{"class":128},"(cls, name_or_path: ",[111,291,197],{"class":124},[111,293,294],{"class":132}," |",[111,296,297],{"class":128}," Path) -> Self:\n",[111,299,301,304,307,310,312,315,317],{"class":113,"line":300},8,[111,302,303],{"class":132},"    if",[111,305,306],{"class":124}," isinstance",[111,308,309],{"class":128},"(name_or_path, Path) ",[111,311,224],{"class":132},[111,313,314],{"class":128}," looks_like_yaml_path(",[111,316,197],{"class":124},[111,318,319],{"class":128},"(name_or_path)):\n",[111,321,323,326,329],{"class":113,"line":322},9,[111,324,325],{"class":132},"        return",[111,327,328],{"class":124}," cls",[111,330,331],{"class":128},".from_yaml(name_or_path)\n",[111,333,335],{"class":113,"line":334},10,[111,336,337],{"class":124},"    ...\n",[13,339,340,341,343,344,346,347,350,351,353],{},"A path-like entry in ",[27,342,167],{}," causes Serena to load that file from the repository, read its ",[27,345,97],{}," field verbatim, and pass it to the unsandboxed renderer. ",[27,348,349],{},"yaml.safe_load"," is used correctly and blocks YAML deserialization gadgets, but it has no bearing on a plain string inside the ",[27,352,97],{}," field. The YAML parser sees harmless text. The injection happens later, when that string is compiled as a Jinja2 template.",[61,355,357],{"id":356},"the-trust-control-bypass","The trust control bypass",[13,359,360,363,364,366,367,370,371,373,374,376,377,379,380,382],{},[27,361,362],{},"is_trusted()",", Serena's mechanism for preventing untrusted projects from executing code, gates two features: ",[27,365,86],{},", the shell command run on project open, and ",[27,368,369],{},"ls_specific_settings",", project-scoped tool overrides. The mode-loading and prompt-rendering path is never checked against ",[27,372,362],{},". The ",[27,375,167],{}," list from a project's ",[27,378,29],{}," is processed without validation, and the mode loader applies no allowlist and no trust check before it loads the file and hands the ",[27,381,97],{}," field to the template engine.",[13,384,385,386,388],{},"We confirmed the bypass empirically. We ran the same end-to-end test with ",[27,387,33],{}," set to empty, so no project counts as trusted, stricter than any default configuration. Two things happened:",[390,391,392,409],"table",{},[393,394,395],"thead",{},[396,397,398,403,406],"tr",{},[399,400,402],"th",{"align":401},"left","Feature",[399,404,405],{"align":401},"Trust-gated",[399,407,408],{"align":401},"Result on untrusted project",[410,411,412,425],"tbody",{},[396,413,414,419,422],{},[415,416,417],"td",{"align":401},[27,418,86],{},[415,420,421],{"align":401},"Yes",[415,423,424],{"align":401},"Blocked",[396,426,427,432,435],{},[415,428,429,430],{"align":401},"Template injection via ",[27,431,167],{},[415,433,434],{"align":401},"No",[415,436,437],{"align":401},"Executes",[439,440],"br",{},[13,442,443],{},"The feature whose entire purpose is to run a shell command is blocked. The template injection reaches the same outcome through a different path and runs freely. That makes it a protection mechanism failure (CWE-693). The trust model exists to prevent an untrusted repository from executing code, and this path defeats it while looking like ordinary project loading.",[61,445,447],{"id":446},"the-full-call-chain","The full call chain",[69,449,452],{"className":450,"code":451,"language":74},[72],".serena/project.yml  (attacker-controlled, ships with the repo)\n  added_modes: [\"./path/to/attacker-mode.yml\"]\n        |\n        v\nSerenaAgentMode.load()            context_mode.py:130-135\n  from_yaml(name_or_path)\n  prompt = \u003Cattacker-controlled string>\n        |\n        v\nSerenaAgent._update_active_modes()    agent.py:1063\n        |\n        v\ncreate_system_prompt()                agent.py:996\n  _format_prompt(mode.prompt)\n  JinjaTemplate(prompt).render()      arbitrary code execution\n",[27,453,451],{"__ignoreMap":77},[13,455,456],{},"Code runs as a side effect of the ordinary project-open flow, before Serena serves its first request to the LLM.",[61,458,460],{"id":459},"exposure","Exposure",[13,462,463,464,467],{},"Serena's reach in the developer ecosystem is substantial. The repository has 27.8k GitHub stars and 1.8k forks, and the ",[27,465,466],{},"serena-agent"," package records roughly 136,000 downloads per month on PyPI. It integrates with Claude Code, Cursor, VS Code, JetBrains IDEs, Claude Desktop, and OpenWebUI, covering the range of AI-assisted development environments in common use.",[13,469,470],{},"A realistic attack needs no infrastructure and no social engineering beyond the repository. An attacker publishes a library, a sample project, a CTF challenge, or a seemingly useful tool. A developer clones it, opens it with Serena, and the code runs. Given everything a developer's machine can reach, the payoff for the attacker is immediate. In a CI/CD setup where Serena processes submitted repositories automatically, no human interaction is required at all.",[39,472,474],{"id":473},"why-new-tools-inherit-old-bugs","Why new tools inherit old bugs",[13,476,477],{},"None of the patterns behind this bug are unique to Serena.",[13,479,480],{},"User-supplied data flowed into a template engine without sandboxing. Template injection is one of the oldest vulnerability classes in web security, and most template engines ship a sandbox or restricted mode to address it. In a young ecosystem, developers building configuration-driven templating features often reach for the plain variant by default. The pattern will show up in other MCP tools.",[13,482,483],{},"Project configuration files were treated as trusted input. A repository's configuration files are authored by the repository owner. In any threat model where the repository may be untrusted, those files are attacker-controlled input. The distinction is easy to overlook when you build a tool and the configuration files feel like part of the tool itself.",[13,485,486],{},"Trust gates covered some code paths but not others. Serena's trust model was designed correctly: The gate exists, it is implemented, and the features it covers are clearly identified. The gap was a code path added without being brought under the same gate. Keeping trust coverage complete as a codebase evolves takes deliberate review of every new path that processes project-supplied input, not only the paths that are obviously privileged.",[39,488,490],{"id":489},"what-this-means-for-you","What this means for you",[61,492,494],{"id":493},"if-you-use-serena","If you use Serena",[13,496,497,498,501],{},"Update to serena-agent 1.7.0 now. The fix switches the template engine to ",[27,499,500],{},"jinja2.sandbox.SandboxedEnvironment",", which closes the injection path. On Versions 1.6.1 and earlier, avoid opening repositories from untrusted sources.",[61,503,505],{"id":504},"if-you-build-mcp-servers-or-ai-coding-tools","If you build MCP servers or AI coding tools",[13,507,508],{},"These practices should apply to any tool that reads a project directory for an LLM.",[510,511,512,516,519,522],"ul",{},[513,514,515],"li",{},"Treat project configuration files as input from a possibly hostile repository owner. Validate them like an HTTP request body: check the structure and reject anything off-schema.",[513,517,518],{},"Map every place a string becomes code or a command: template rendering, subprocess calls, plugin loading, dynamic imports. For each, know whether project input can reach it and what stops it.",[513,520,521],{},"Make your trust gate cover every path, not one feature. Review it whenever you add a feature that reads project input.",[513,523,524],{},"Test against a hostile repository before you ship. Build the most aggressive config you can, confirm nothing runs on open, and automate it.",[61,526,528],{"id":527},"if-you-lead-a-security-team","If you lead a security team",[13,530,531],{},"MCP servers are a new class of local attack surface running with your developers' full user context, so treat them like any other privileged tooling on those machines. Start by finding out which MCP servers are running in your environment and where. At scale, this may call for tooling and policy. From there, apply the same scrutiny to MCP server updates that you apply elsewhere: a vulnerability in an MCP server is a vulnerability on every machine that runs it. When you evaluate new MCP tools, ask the vendor about their trust model and how they test it against untrusted project inputs.",[39,533,535],{"id":534},"disclosure-timeline","Disclosure timeline",[390,537,538,548],{},[393,539,540],{},[396,541,542,545],{},[399,543,544],{"align":401},"Date",[399,546,547],{"align":401},"Event",[410,549,550,558,565,573,585],{},[396,551,552,555],{},[415,553,554],{"align":401},"2026-08-01",[415,556,557],{"align":401},"Vulnerability identified during research into AI coding agent attack surfaces",[396,559,560,562],{},[415,561,554],{"align":401},[415,563,564],{"align":401},"Full advisory and proof of concept submitted to maintainers via GitHub private security advisory",[396,566,567,570],{},[415,568,569],{"align":401},"2026-08-05",[415,571,572],{"align":401},"Report accepted by maintainers",[396,574,575,578],{},[415,576,577],{"align":401},"2026-08-09",[415,579,580,581,584],{"align":401},"Fix shipped in serena-agent 1.7.0; public advisory published (",[17,582,21],{"href":19,"rel":583},[],")",[396,586,587,590],{},[415,588,589],{"align":401},"2026-08-10",[415,591,592],{"align":401},"CVE requested with the GitHub CNA by the maintainers",[439,594],{},[13,596,597],{},"We thank the Serena maintainers for their prompt and collaborative handling of the report.",[39,599,601],{"id":600},"how-gitlab-can-help","How GitLab can help",[13,603,604],{},"GitLab Duo Security Agent can help you audit your codebase for the same patterns. Questions like \"does this project render user-controlled strings through a template engine?\" or \"are there configuration files in this repository that get passed to an execution context?\" are a practical starting point.",[39,606,608],{"id":607},"looking-ahead","Looking ahead",[13,610,611],{},"The MCP ecosystem sits roughly where the npm ecosystem sat a decade ago: growing fast, adoption outpacing security scrutiny, and trust assumptions left implicit. The Serena finding is ordinary, and that is the point. It is the kind of issue that appears whenever a new technology matures faster than the security patterns around it, and MCP is maturing fast. We expect more of the same as MCP servers become standard developer infrastructure.",[13,613,614],{},"GitLab's Threat Research Group will keep assessing AI developer tooling and sharing findings as they are responsibly disclosed. We encourage researchers to apply the same scrutiny to MCP servers that the security community has long applied to browser extensions, IDE plugins, and CI/CD integrations: tools that run with significant privilege on developer machines and handle data from sources they do not fully control.",[616,617,618],"style",{},"html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}",{"title":77,"searchDepth":121,"depth":121,"links":620},[621,622,630,631,636,637,638],{"id":41,"depth":121,"text":42},{"id":58,"depth":121,"text":59,"children":623},[624,625,626,627,628,629],{"id":63,"depth":209,"text":64},{"id":90,"depth":209,"text":91},{"id":157,"depth":209,"text":158},{"id":356,"depth":209,"text":357},{"id":446,"depth":209,"text":447},{"id":459,"depth":209,"text":460},{"id":473,"depth":121,"text":474},{"id":489,"depth":121,"text":490,"children":632},[633,634,635],{"id":493,"depth":209,"text":494},{"id":504,"depth":209,"text":505},{"id":527,"depth":209,"text":528},{"id":534,"depth":121,"text":535},{"id":600,"depth":121,"text":601},{"id":607,"depth":121,"text":608},"security-labs","2026-08-17","GitLab's Threat Research Group found a critical template injection in Serena that runs attacker code the moment a developer opens a repository.","md",null,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782237704/cj50chkvprjthczevmog.png",{},"/en-us/blog/critical-rce-in-serena",{"config":648,"title":5,"description":641},{"noIndex":649},false,"critical-rce-in-serena","en-us/blog/critical-rce-in-serena",[653,654],"security","security research","BlogPost","qw71HhA5j7MOZJaGfjCttTQFrEtVodq0f8ozQ_Nw-do",{"logo":658,"freeTrial":663,"sales":668,"login":673,"items":678,"search":1009,"minimal":1040,"duo":1059,"switchNav":1068,"pricingDeployment":1079},{"config":659},{"href":660,"dataGaName":661,"dataGaLocation":662},"/","gitlab logo","header",{"text":664,"config":665},"Get free trial",{"href":666,"dataGaName":667,"dataGaLocation":662},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":669,"config":670},"Request a demo",{"href":671,"dataGaName":672,"dataGaLocation":662},"/request-a-demo/","sales",{"text":674,"config":675},"Sign in",{"href":676,"dataGaName":677,"dataGaLocation":662},"https://gitlab.com/users/sign_in/","sign in",[679,765,853,858,933,987],{"text":680,"left":262,"config":681,"menu":683},"Platform",{"dataNavLevelOne":682},"platform",{"type":684,"link":685,"columns":689,"feature":754},"lists",{"text":686,"config":687},"Explore the Platform",{"href":688,"dataGaName":682,"dataGaLocation":662},"/platform/",[690,713,736],{"title":691,"items":692},"Execution & Workflows",[693,698,703,708],{"text":694,"config":695},"CI/CD",{"href":696,"dataGaLocation":662,"dataGaName":697},"/solutions/continuous-integration/","ci/cd",{"text":699,"config":700},"Source Code Management",{"href":701,"dataGaLocation":662,"dataGaName":702},"/solutions/source-code-management/","source code management",{"text":704,"config":705},"Agile Delivery",{"href":706,"dataGaLocation":662,"dataGaName":707},"/solutions/agile-delivery/","agile delivery",{"text":709,"config":710},"Artifact Management",{"href":711,"dataGaLocation":662,"dataGaName":712},"/artifact-central/","artifact management",{"title":714,"items":715},"Security & Governance",[716,721,726,731],{"text":717,"config":718},"Application Security Testing",{"href":719,"dataGaLocation":662,"dataGaName":720},"/solutions/application-security-testing/","application security testing",{"text":722,"config":723},"Governance & Compliance",{"href":724,"dataGaLocation":662,"dataGaName":725},"/solutions/software-compliance/","governance and compliance",{"text":727,"config":728},"Secrets Management",{"href":729,"dataGaLocation":662,"dataGaName":730},"/gitlab-secrets-manager/","secrets management",{"text":732,"config":733},"Supply Chain Security",{"href":734,"dataGaLocation":662,"dataGaName":735},"/solutions/supply-chain/","supply chain security",{"title":737,"items":738},"Context & AI",[739,744,749],{"text":740,"config":741},"Agentic Orchestration",{"href":742,"dataGaLocation":662,"dataGaName":743},"/gitlab-duo-agent-platform/","agentic orchestration",{"text":745,"config":746},"Context Graph",{"href":747,"dataGaLocation":662,"dataGaName":748},"/gitlab-orbit/","context graph",{"text":750,"config":751},"Visibility & Measurement",{"href":752,"dataGaLocation":662,"dataGaName":753},"/solutions/visibility-measurement/","visibility and measurement",{"config":755,"title":758,"text":759,"link":760},{"background":756,"textColor":757},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","Why GitLab","One platform for speed with control across your software lifecycle.",{"text":761,"config":762},"Learn more",{"href":763,"dataGaName":764,"dataGaLocation":662},"/why-gitlab/","why gitlab",{"text":766,"left":262,"config":767,"menu":769},"Solutions",{"dataNavLevelOne":768},"solutions",{"type":684,"link":770,"columns":774,"feature":844},{"text":771,"config":772},"View all Solutions",{"href":773,"dataGaName":768,"dataGaLocation":662},"/solutions/",[775,793,811],{"title":776,"items":777},"Outcomes",[778,783,788],{"text":779,"config":780},"DevOps Modernization",{"href":781,"dataGaLocation":662,"dataGaName":782},"/assessments/devops-modernization-assessment/","devops modernization",{"text":784,"config":785},"Security Modernization",{"href":786,"dataGaLocation":662,"dataGaName":787},"/assessments/security-modernization-assessment/","security modernization",{"text":789,"config":790},"AI Modernization",{"href":791,"dataGaLocation":662,"dataGaName":792},"/assessments/ai-modernization-assessment/","ai modernization",{"title":794,"items":795},"By size",[796,801,806],{"text":797,"config":798},"Enterprise",{"href":799,"dataGaLocation":662,"dataGaName":800},"/enterprise/","enterprise",{"text":802,"config":803},"Small Business",{"href":804,"dataGaLocation":662,"dataGaName":805},"/small-business/","small business",{"text":807,"config":808},"Startups",{"href":809,"dataGaLocation":662,"dataGaName":810},"/solutions/startups/","startups",{"title":812,"items":813},"Industries",[814,819,824,829,834,839],{"text":815,"config":816},"Financial Services",{"href":817,"dataGaLocation":662,"dataGaName":818},"/solutions/finance/","financial services",{"text":820,"config":821},"Public Sector",{"href":822,"dataGaLocation":662,"dataGaName":823},"/solutions/public-sector/","public sector",{"text":825,"config":826},"Telecommunications",{"href":827,"dataGaLocation":662,"dataGaName":828},"/solutions/telecommunications/","telecommunications",{"text":830,"config":831},"Automotive",{"href":832,"dataGaLocation":662,"dataGaName":833},"/solutions/automotive/","automotive",{"text":835,"config":836},"Education",{"href":837,"dataGaLocation":662,"dataGaName":838},"/solutions/education/","education",{"text":840,"config":841},"Aerospace",{"href":842,"dataGaLocation":662,"dataGaName":843},"/solutions/aerospace/","aerospace",{"config":845,"title":846,"text":847,"link":848},{"background":756,"textColor":757},"GitLab Security Standard","Learn how to harden your software factory and let AI agents earn autonomy, without trading away security.",{"text":849,"config":850},"Explore the standard",{"href":851,"dataGaName":852,"dataGaLocation":662},"/gitlab-security-standard/","gitlab security standard",{"text":854,"config":855},"Pricing",{"href":856,"dataGaName":857,"dataGaLocation":662,"dataNavLevelOne":857},"/pricing/","pricing",{"text":859,"config":860,"menu":862},"Resources",{"dataNavLevelOne":861},"resources",{"type":684,"link":863,"columns":867,"feature":924},{"text":864,"config":865},"View all resources",{"href":866,"dataGaName":861,"dataGaLocation":662},"/resources/",[868,896],{"title":869,"items":870},"Discover",[871,876,881,886,891],{"text":872,"config":873},"Docs",{"href":874,"dataGaName":875,"dataGaLocation":662},"https://docs.gitlab.com/","docs",{"text":877,"config":878},"University",{"href":879,"dataGaName":880,"dataGaLocation":662},"https://university.gitlab.com/","university",{"text":882,"config":883},"Demo Series",{"href":884,"dataGaName":885,"dataGaLocation":662},"/gitlab-technical-demo-series/","demo series",{"text":887,"config":888},"Demo Hub",{"href":889,"dataGaName":890,"dataGaLocation":662},"/demo-hub/","demo hub",{"text":892,"config":893},"Services",{"href":894,"dataGaName":895,"dataGaLocation":662},"/services/","services",{"title":897,"items":898},"Connect",[899,904,909,914,919],{"text":900,"config":901},"Blog",{"href":902,"dataGaName":903,"dataGaLocation":662},"/blog/","blog",{"text":905,"config":906},"Community",{"href":907,"dataGaName":908,"dataGaLocation":662},"/community/","community",{"text":910,"config":911},"Customers",{"href":912,"dataGaName":913,"dataGaLocation":662},"/customers/","customers",{"text":915,"config":916},"Partners",{"href":917,"dataGaName":918,"dataGaLocation":662},"/partners/","partners",{"text":920,"config":921},"Events",{"href":922,"dataGaName":923,"dataGaLocation":662},"/events/","events",{"config":925,"title":926,"text":927,"link":928},{"background":756,"textColor":757},"What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":929,"config":930},"Read the latest",{"href":931,"dataGaName":932,"dataGaLocation":662},"/whats-new/","whats new",{"text":934,"config":935,"menu":937},"Company",{"dataNavLevelOne":936},"company",{"type":684,"columns":938},[939],{"items":940},[941,946,952,957,962,967,972,977,982],{"text":942,"config":943},"About",{"href":944,"dataGaName":945,"dataGaLocation":662},"/company/","about",{"text":947,"config":948,"footerGa":951},"Jobs",{"href":949,"dataGaName":950,"dataGaLocation":662},"/jobs/","jobs",{"dataGaName":950},{"text":953,"config":954},"Press",{"href":955,"dataGaName":956,"dataGaLocation":662},"/press/","press",{"text":958,"config":959},"Handbook",{"href":960,"dataGaName":961,"dataGaLocation":662},"https://handbook.gitlab.com/","handbook",{"text":963,"config":964},"Leadership",{"href":965,"dataGaName":966,"dataGaLocation":662},"/company/team/e-group/","leadership",{"text":968,"config":969},"Investor relations",{"href":970,"dataGaName":971,"dataGaLocation":662},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":973,"config":974},"Trust Center",{"href":975,"dataGaName":976,"dataGaLocation":662},"/security/","trust center",{"text":978,"config":979},"AI Transparency Center",{"href":980,"dataGaName":981,"dataGaLocation":662},"/ai-transparency-center/","ai transparency center",{"text":983,"config":984},"Newsletter",{"href":985,"dataGaName":986,"dataGaLocation":662},"/company/contact/#contact-forms","newsletter",{"text":988,"config":989,"menu":990},"Contact us",{"dataNavLevelOne":936},{"type":684,"columns":991},[992],{"items":993},[994,999,1004],{"text":995,"config":996},"Talk to sales",{"href":997,"dataGaName":998,"dataGaLocation":662},"/sales/","talk to sales",{"text":1000,"config":1001},"Support portal",{"href":1002,"dataGaName":1003,"dataGaLocation":662},"https://support.gitlab.com/hc/en-us","support portal",{"text":1005,"config":1006},"Customer portal",{"href":1007,"dataGaName":1008,"dataGaLocation":662},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1010,"login":1011,"suggestions":1018},"Close",{"text":1012,"link":1013},"To search repositories and projects, login to",{"text":1014,"config":1015},"gitlab.com",{"href":676,"dataGaName":1016,"dataGaLocation":1017},"search login","search",{"text":1019,"default":1020},"Suggestions",[1021,1024,1027,1029,1033,1037],{"text":1022,"config":1023},"GitLab Duo Agent Platform",{"href":742,"dataGaName":1022,"dataGaLocation":1017},{"text":1025,"config":1026},"Code Suggestions (AI)",{"href":742,"dataGaName":1025,"dataGaLocation":1017},{"text":694,"config":1028},{"href":696,"dataGaName":694,"dataGaLocation":1017},{"text":1030,"config":1031},"GitLab on AWS",{"href":1032,"dataGaName":1030,"dataGaLocation":1017},"/partners/technology-partners/aws/",{"text":1034,"config":1035},"GitLab on Google Cloud",{"href":1036,"dataGaName":1034,"dataGaLocation":1017},"/partners/technology-partners/google-cloud-platform/",{"text":1038,"config":1039},"Why GitLab?",{"href":763,"dataGaName":1038,"dataGaLocation":1017},{"freeTrial":1041,"mobileIcon":1046,"desktopIcon":1051,"secondaryButton":1054},{"text":1042,"config":1043},"Start free trial",{"href":1044,"dataGaName":667,"dataGaLocation":1045},"https://gitlab.com/-/trials/new/","nav",{"altText":1047,"config":1048},"Gitlab Icon",{"src":1049,"dataGaName":1050,"dataGaLocation":1045},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1047,"config":1052},{"src":1053,"dataGaName":1050,"dataGaLocation":1045},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1055,"config":1056},"Get Started",{"href":1057,"dataGaName":1058,"dataGaLocation":1045},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1060,"mobileIcon":1064,"desktopIcon":1066},{"text":1061,"config":1062},"Learn more about GitLab Duo",{"href":742,"dataGaName":1063,"dataGaLocation":1045},"gitlab duo",{"altText":1047,"config":1065},{"src":1049,"dataGaName":1050,"dataGaLocation":1045},{"altText":1047,"config":1067},{"src":1053,"dataGaName":1050,"dataGaLocation":1045},{"button":1069,"mobileIcon":1074,"desktopIcon":1076},{"text":1070,"config":1071},"/switch",{"href":1072,"dataGaName":1073,"dataGaLocation":1045},"#contact","switch",{"altText":1047,"config":1075},{"src":1049,"dataGaName":1050,"dataGaLocation":1045},{"altText":1047,"config":1077},{"src":1078,"dataGaName":1050,"dataGaLocation":1045},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1080,"mobileIcon":1085,"desktopIcon":1087},{"text":1081,"config":1082},"Back to pricing",{"href":856,"dataGaName":1083,"dataGaLocation":1045,"icon":1084},"back to pricing","GoBack",{"altText":1047,"config":1086},{"src":1049,"dataGaName":1050,"dataGaLocation":1045},{"altText":1047,"config":1088},{"src":1053,"dataGaName":1050,"dataGaLocation":1045},{"title":1090,"button":1091,"config":1097},"Ship at agent speed. Prove every step. Transcend is here.",{"text":1092,"config":1093},"Watch now",{"href":1094,"dataGaName":1095,"dataGaLocation":1096},"/events/transcend/virtual/#watch-gitlab-transcend","transcend-october-2026-banner","global-banner",{"layout":1098,"disabled":649},"release",{"data":1100},{"text":1101,"source":1102,"edit":1108,"contribute":1113,"config":1118,"items":1123,"minimal":1349},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1103,"config":1104},"View page source",{"href":1105,"dataGaName":1106,"dataGaLocation":1107},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1109,"config":1110},"Edit this page",{"href":1111,"dataGaName":1112,"dataGaLocation":1107},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1114,"config":1115},"Please contribute",{"href":1116,"dataGaName":1117,"dataGaLocation":1107},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1119,"facebook":1120,"youtube":1121,"linkedin":1122},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1124,1171,1229,1276,1317],{"title":854,"links":1125,"subMenu":1140},[1126,1130,1135],{"text":1127,"config":1128},"View plans",{"href":856,"dataGaName":1129,"dataGaLocation":1107},"view plans",{"text":1131,"config":1132},"Why Premium?",{"href":1133,"dataGaName":1134,"dataGaLocation":1107},"/pricing/premium/","why premium",{"text":1136,"config":1137},"Why Ultimate?",{"href":1138,"dataGaName":1139,"dataGaLocation":1107},"/pricing/ultimate/","why ultimate",[1141],{"title":1142,"links":1143},"Contact Us",[1144,1147,1149,1151,1156,1161,1166],{"text":1145,"config":1146},"Contact sales",{"href":997,"dataGaName":672,"dataGaLocation":1107},{"text":1000,"config":1148},{"href":1002,"dataGaName":1003,"dataGaLocation":1107},{"text":1005,"config":1150},{"href":1007,"dataGaName":1008,"dataGaLocation":1107},{"text":1152,"config":1153},"Status",{"href":1154,"dataGaName":1155,"dataGaLocation":1107},"https://status.gitlab.com/","status",{"text":1157,"config":1158},"Terms of use",{"href":1159,"dataGaName":1160,"dataGaLocation":1107},"/terms/","terms of use",{"text":1162,"config":1163},"Privacy statement",{"href":1164,"dataGaName":1165,"dataGaLocation":1107},"/privacy/","privacy statement",{"text":1167,"config":1168},"Cookie preferences",{"dataGaName":1169,"dataGaLocation":1107,"id":1170,"isOneTrustButton":262},"cookie preferences","ot-sdk-btn",{"title":680,"links":1172,"subMenu":1186},[1173,1176,1178,1180,1182,1184],{"text":1174,"config":1175},"Explore the platform",{"href":688,"dataGaName":682,"dataGaLocation":1107},{"text":740,"config":1177},{"href":742,"dataGaName":743,"dataGaLocation":1107},{"text":694,"config":1179},{"href":696,"dataGaName":697,"dataGaLocation":1107},{"text":745,"config":1181},{"href":747,"dataGaName":748,"dataGaLocation":1107},{"text":727,"config":1183},{"href":729,"dataGaName":730,"dataGaLocation":1107},{"text":758,"config":1185},{"href":763,"dataGaName":764,"dataGaLocation":1107},[1187],{"title":1188,"links":1189},"Topics",[1190,1194,1199,1204,1209,1214,1219,1224],{"text":694,"config":1191},{"href":1192,"dataGaName":1193,"dataGaLocation":1107},"/topics/ci-cd/","cicd",{"text":1195,"config":1196},"GitOps",{"href":1197,"dataGaName":1198,"dataGaLocation":1107},"/topics/gitops/","gitops",{"text":1200,"config":1201},"DevOps",{"href":1202,"dataGaName":1203,"dataGaLocation":1107},"/topics/devops/","devops",{"text":1205,"config":1206},"Version Control",{"href":1207,"dataGaName":1208,"dataGaLocation":1107},"/topics/version-control/","version control",{"text":1210,"config":1211},"DevSecOps",{"href":1212,"dataGaName":1213,"dataGaLocation":1107},"/topics/devsecops/","devsecops",{"text":1215,"config":1216},"Cloud Native",{"href":1217,"dataGaName":1218,"dataGaLocation":1107},"/topics/cloud-native/","cloud native",{"text":1220,"config":1221},"AI for Coding",{"href":1222,"dataGaName":1223,"dataGaLocation":1107},"/topics/devops/ai-for-coding/","ai for coding",{"text":1225,"config":1226},"Agentic AI",{"href":1227,"dataGaName":1228,"dataGaLocation":1107},"/topics/agentic-ai/","agentic ai",{"title":766,"links":1230},[1231,1234,1237,1240,1243,1246,1248,1250,1252,1254,1256,1259,1261,1264,1268,1272],{"text":1232,"config":1233},"DevOps modernization",{"href":781,"dataGaName":782,"dataGaLocation":1107},{"text":1235,"config":1236},"Security modernization",{"href":786,"dataGaName":787,"dataGaLocation":1107},{"text":1238,"config":1239},"AI modernization",{"href":791,"dataGaName":792,"dataGaLocation":1107},{"text":1241,"config":1242},"Financial services",{"href":817,"dataGaName":818,"dataGaLocation":1107},{"text":1244,"config":1245},"Public sector",{"href":822,"dataGaName":823,"dataGaLocation":1107},{"text":825,"config":1247},{"href":827,"dataGaName":828,"dataGaLocation":1107},{"text":830,"config":1249},{"href":832,"dataGaName":833,"dataGaLocation":1107},{"text":835,"config":1251},{"href":837,"dataGaName":838,"dataGaLocation":1107},{"text":840,"config":1253},{"href":842,"dataGaName":843,"dataGaLocation":1107},{"text":797,"config":1255},{"href":799,"dataGaName":800,"dataGaLocation":1107},{"text":1257,"config":1258},"Small business",{"href":804,"dataGaName":805,"dataGaLocation":1107},{"text":807,"config":1260},{"href":809,"dataGaName":810,"dataGaLocation":1107},{"text":1195,"config":1262},{"href":1263,"dataGaName":1198,"dataGaLocation":1107},"/solutions/gitops/",{"text":1265,"config":1266},"Software composition analysis",{"href":734,"dataGaName":1267,"dataGaLocation":1107},"software composition analysis",{"text":1269,"config":1270},"Value stream management",{"href":752,"dataGaName":1271,"dataGaLocation":1107},"value stream management",{"text":1273,"config":1274},"All solutions",{"href":773,"dataGaName":1275,"dataGaLocation":1107},"all solutions",{"title":859,"links":1277},[1278,1283,1288,1290,1292,1294,1296,1298,1300,1302,1304,1306,1308,1310,1313],{"text":1279,"config":1280},"Install",{"href":1281,"dataGaName":1282,"dataGaLocation":1107},"/install/","install",{"text":1284,"config":1285},"Quick start guides",{"href":1286,"dataGaName":1287,"dataGaLocation":1107},"/get-started/","quick setup checklists",{"text":872,"config":1289},{"href":874,"dataGaName":875,"dataGaLocation":1107},{"text":877,"config":1291},{"href":879,"dataGaName":880,"dataGaLocation":1107},{"text":882,"config":1293},{"href":884,"dataGaName":885,"dataGaLocation":1107},{"text":887,"config":1295},{"href":889,"dataGaName":890,"dataGaLocation":1107},{"text":892,"config":1297},{"href":894,"dataGaName":895,"dataGaLocation":1107},{"text":900,"config":1299},{"href":902,"dataGaName":903,"dataGaLocation":1107},{"text":905,"config":1301},{"href":907,"dataGaName":908,"dataGaLocation":1107},{"text":910,"config":1303},{"href":912,"dataGaName":913,"dataGaLocation":1107},{"text":915,"config":1305},{"href":917,"dataGaName":918,"dataGaLocation":1107},{"text":920,"config":1307},{"href":922,"dataGaName":923,"dataGaLocation":1107},{"text":983,"config":1309},{"href":985,"dataGaName":986,"dataGaLocation":1107},{"text":1311,"config":1312},"What's new",{"href":931,"dataGaName":932,"dataGaLocation":1107},{"text":1314,"config":1315},"All resources",{"href":866,"dataGaName":1316,"dataGaLocation":1107},"all resources",{"title":934,"links":1318},[1319,1321,1323,1325,1327,1329,1331,1333,1335,1339,1344],{"text":942,"config":1320},{"href":944,"dataGaName":936,"dataGaLocation":1107},{"text":947,"config":1322},{"href":949,"dataGaName":950,"dataGaLocation":1107},{"text":953,"config":1324},{"href":955,"dataGaName":956,"dataGaLocation":1107},{"text":958,"config":1326},{"href":960,"dataGaName":961,"dataGaLocation":1107},{"text":963,"config":1328},{"href":965,"dataGaName":966,"dataGaLocation":1107},{"text":968,"config":1330},{"href":970,"dataGaName":971,"dataGaLocation":1107},{"text":973,"config":1332},{"href":975,"dataGaName":976,"dataGaLocation":1107},{"text":978,"config":1334},{"href":980,"dataGaName":981,"dataGaLocation":1107},{"text":1336,"config":1337},"Sustainability",{"href":1338,"dataGaName":1336,"dataGaLocation":1107},"/sustainability/",{"text":1340,"config":1341},"Diversity, inclusion and belonging (DIB)",{"href":1342,"dataGaName":1343,"dataGaLocation":1107},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1345,"config":1346},"Modern Slavery Transparency Statement",{"href":1347,"dataGaName":1348,"dataGaLocation":1107},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1350},[1351,1354,1357],{"text":1352,"config":1353},"Terms",{"href":1159,"dataGaName":1160,"dataGaLocation":1107},{"text":1355,"config":1356},"Cookies",{"dataGaName":1169,"dataGaLocation":1107,"id":1170,"isOneTrustButton":262},{"text":1358,"config":1359},"Privacy",{"href":1164,"dataGaName":1165,"dataGaLocation":1107},[1361,1375],{"id":1362,"title":7,"body":643,"config":1363,"content":1366,"description":643,"extension":1369,"meta":1370,"navigation":262,"path":1371,"seo":1372,"stem":1373,"__hash__":1374},"blogAuthors/en-us/blog/authors/daniel-abeles.yml",{"template":1364,"gitlabHandle":1365},"BlogAuthor","dabeles",{"name":7,"config":1367},{"headshot":1368},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786473980/kjzctsiwvfc6afimsdtc.jpg","yml",{},"/en-us/blog/authors/daniel-abeles",{},"en-us/blog/authors/daniel-abeles","9j7gS6WI8857OrOR0VcnHZiFLXpZpnKFA3tgPdDU5hw",{"id":1376,"title":8,"body":643,"config":1377,"content":1378,"description":643,"extension":1369,"meta":1381,"navigation":262,"path":1382,"seo":1383,"stem":1384,"__hash__":1385},"blogAuthors/en-us/blog/authors/abisheik-magesh.yml",{"template":1364},{"name":8,"config":1379},{"headshot":1380},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1787000354/gmgyvfesrvwdlvt52gdw.png",{},"/en-us/blog/authors/abisheik-magesh",{},"en-us/blog/authors/abisheik-magesh","kPev_Acm8MB5tgKMnU_Rkfq1sl42e8DixU6iNMXXfxI",[1387,1393,1399],{"title":1388,"description":1389,"heroImage":644,"category":639,"date":1390,"authors":1391,"slug":1392,"externalUrl":643},"DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agent","GitLab's Threat Research Group found a flaw, ConfigPoisoning, that runs attacker code when a developer views a file's diff in DeepSeek-Reasonix.","2026-10-02",[8,7],"deepseek-reasonix-vulnerability-discovered",{"title":1394,"description":1395,"heroImage":644,"category":639,"date":1396,"authors":1397,"slug":1398,"externalUrl":643},"Critical remote code execution in vm2, a widely used Node.js sandbox library","GitLab's Threat Research Group found a critical sandbox escape in vm2 that runs attacker code using the library's own documented configuration.","2026-09-02",[8,7],"critical-remote-code-execution-in-vm2",{"title":1400,"description":1401,"heroImage":1402,"category":639,"date":1403,"authors":1404,"slug":1405,"externalUrl":643},"A sandbox is only as closed as what an AI agent can reach","Stuck in an evaluation with no way out, an AI agent escaped in an hour through the one service on its allowlist. Here's the gap that opened.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1786468880/uxouffutvvwsbxzikhyc.png","2026-08-12",[7],"ai-agent-sandbox",{"header":1407,"text":1408,"button":1412,"disclaimer":1415},"Start your free\n\n30-day GitLab trial\n",[1409,1410,1411],"GitLab Duo Agent Platform access","Try our most advanced features","Automate complex tasks with AI",{"text":664,"config":1413},{"href":1414,"dataGaName":667,"dataGaLocation":903},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/blog/","No credit card required.",{"header":1417,"blurb":1418,"button":1419,"secondaryButton":1424},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1420,"config":1421},"Get your free trial",{"href":1422,"dataGaName":667,"dataGaLocation":1423},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1145,"config":1425},{"href":997,"dataGaName":672,"dataGaLocation":1423},1791944922618]