[{"data":1,"prerenderedAt":1361},["ShallowReactive",2],{"/blog/dast-release-first-gitlab-active-check":3,"navigation-en-us":577,"banner-en-us":1005,"footer-en-us":1015,"blog-post-authors-en-us-Cameron Swords":1259,"blog-related-posts-en-us-dast-release-first-gitlab-active-check":1274,"blog-promotions-en-us":1299,"next-steps-en-us":1351},{"id":4,"title":5,"authors":6,"body":8,"category":554,"date":555,"description":556,"extension":557,"externalUrl":558,"faq":558,"featured":559,"heroImage":560,"meta":561,"navigation":562,"path":563,"seo":564,"slug":568,"stem":569,"tags":570,"template":575,"updatedDate":558,"__hash__":576},"blogPosts/en-us/blog/dast-release-first-gitlab-active-check.md","Introducing GitLab browser-based active checks in DAST",[7],"Cameron Swords",{"type":9,"value":10,"toc":542},"minimark",[11,34,37,40,45,48,55,59,68,72,75,86,89,93,96,101,108,111,115,122,125,129,139,147,151,159,474,478,485,493,507,510,516,522,528,535,538],[12,13,14,15,21,22,27,28,33],"p",{},"GitLab's ",[16,17,20],"a",{"href":18,"rel":19},"https://docs.gitlab.com/user/application_security/dast/",[],"DAST"," and ",[16,23,26],{"href":24,"rel":25},"https://handbook.gitlab.com/handbook/engineering/development/sec/secure/vulnerability-research/",[],"Vulnerability Research"," teams released the first GitLab active check in browser-based dynamic application security testing. This continues our work to integrate passive checks into browser-based DAST. As of GitLab 16.4, or DAST 4.0.9, browser-based DAST active scans will search for path traversal vulnerabilities using the GitLab check 22.1 instead of the ZAP alert ",[16,29,32],{"href":30,"rel":31},"https://www.zaproxy.org/docs/alerts/6/",[],"6",".",[12,35,36],{},"Replacing ZAP alerts with GitLab active checks enables developers and security teams to detect vulnerabilities in modern-day web applications more effectively. Going forward, we anticipate replacing more ZAP alerts with GitLab active checks. If you are interested in using the browser-based DAST analyzer, please see: How to configure a browser-based DAST scan documentation.",[12,38,39],{},"Below is an explanation of how active checks work, different types of attacks, and worked examples of browser-based attacks.",[41,42,44],"h2",{"id":43},"how-to-use-gitlab-active-checks","How to use GitLab active checks",[12,46,47],{},"Customers who run active scans (full scans) will automatically run GitLab active checks as they are tested and released by the DAST team. Each corresponding ZAP alert will be turned off at this time.",[12,49,50,51,33],{},"Customers can opt out of these changes, disabling the GitLab active checks and re-enabling the ZAP alerts by adding the CI/CD variable ",[52,53,54],"code",{},"DAST_FF_BROWSER_BASED_ACTIVE_ATTACK: \"false\"",[41,56,58],{"id":57},"what-is-an-active-check","What is an active check?",[12,60,61,62,67],{},"An active check defines a series of attacks that, when run against the target web application, identify susceptibility to specific kinds of weakness (",[16,63,66],{"href":64,"rel":65},"https://cwe.mitre.org/",[],"CWE","). Active checks are run during the active scan (full scan) phase of a DAST scan.",[41,69,71],{"id":70},"what-does-an-active-check-attack-do","What does an active check attack do?",[12,73,74],{},"In-scope HTTP requests recorded during the crawl phase of the DAST scan are searched for injection locations, places in the request where an attack payload can be injected. Example injection locations include cookie values, request paths, query parameters, headers, JSON string values, XML, and inputs submitted with a form.",[12,76,77,78,81,82,85],{},"Each attack defines payloads, which are text or binary content to inject into an HTTP request. Payloads can have prefixes (e.g. ",[52,79,80],{},"c:\\",") or affixes (e.g. ",[52,83,84],{},".exe","). Payloads can be an extension of the value originally submitted with the HTTP request.",[12,87,88],{},"Every active check attack will be run against every crawled HTTP request's injection locations. Each injection location may have multiple attack payloads injected into it by each attack. Each unique payload injected into an injection location becomes a new HTTP request to send to the target web application. HTTP responses to these requests are used to determine if the attack succeeded.",[41,90,92],{"id":91},"types-of-attacks","Types of attacks",[12,94,95],{},"Different types of attacks are necessary to detect different kinds of weaknesses.",[97,98,100],"h3",{"id":99},"match-response-attacks","Match response attacks",[12,102,103,104,107],{},"Match response attacks send an attack payload with the HTTP request and search the HTTP response body for unintentionally exposed content. For example, a path traversal attack that uses a payload of ",[52,105,106],{},"/etc/passwd"," might look for evidence of that file in the HTTP response body.",[12,109,110],{},"Most attacks are match response attacks.",[97,112,114],{"id":113},"timing-attacks","Timing attacks",[12,116,117,118,121],{},"Timing attacks are useful for blind injection payloads where the success of the attack is determined by how long the target web application took to return the HTTP response. For example, a SQL injection attack might use a payload containing ",[52,119,120],{},"sleep(15)"," to ask the database to pause for 15 seconds and determine attack success if the target web application took longer than 15 seconds to return the HTTP response.",[12,123,124],{},"Naive timing attacks are prone to false positives due to unpredictable timing delays introduced by factors such as variable internet speeds and cached content. To mitigate this, each DAST timing attack uses multiple payloads with individual success conditions, and each timing attack must succeed three times in a row to register as a weakness. Timing attacks run one at a time to prevent one attack from skewing the results of other attacks.",[97,126,128],{"id":127},"callback-attacks","Callback attacks",[12,130,131,132,135,136,33],{},"Callback attacks are useful to determine if the target web application unintentionally allows data to be exposed to an external entity. For example, a URL in a website query parameter could be injected with the callback server ",[52,133,134],{},"https://site.com/login?redirect-to=https://callback-server.dast/123456789",". DAST determines if the target web application unintentionally made an HTTP request to an untrusted source by asking the callback server if it received a request with ID ",[52,137,138],{},"123456789",[12,140,141,142,33],{},"The initial priority for DAST browser-based attacks is on match response and timing attacks. For callback attacks, see ",[16,143,146],{"href":144,"rel":145},"https://docs.gitlab.com/user/application_security/",[],"Breach and Attack Simulation",[41,148,150],{"id":149},"how-are-attacks-defined","How are attacks defined?",[12,152,153,154,158],{},"The ",[16,155,157],{"href":24,"rel":156},[],"Vulnerability Research team"," writes active checks in YAML to minimize the time required to update or add new checks. A simplified example of the 22.1 path traversal attack looks as follows:",[160,161,166],"pre",{"className":162,"code":163,"language":164,"meta":165,"style":165},"language-yaml shiki shiki-themes github-light","active_check:\n  attacks:\n    - id: 2\n      type: \"match_response\"\n      description: \"Inject /etc/passwd, report as vulnerable if the response body matches /etc/passwd file contents.\"\n      target_tech: [\"os:unix\"]\n      injection_locations_policy:\n        default:\n          locations:\n            - \"cookie_value\"\n            - \"request_parameter_value\"\n            - \"request_body_parameter_value\"\n            - \"json_value\"\n            - \"xml_value\"\n            - \"multipart_form_data_filename\"\n            - \"multipart_form_data_value\"\n      match_response_attack:\n        payloads: [\"/etc/passwd\"]\n        injections:\n          - template: \"{payload}\"\n          - template: \"{prefix payload suffix}\"\n            affixes:\n              - prefix: \"/../../../../../../../../../../../..\"\n                suffix: \"\"\n        matchers:\n          - description: \"Check the HTTP response body to see if it contains the /etc/passwd file contents\"\n            severity: \"High\"\n            match:\n              location: \"response_body\"\n              expression: \"root:.:0:0:\"\n\n","yaml","",[52,167,168,181,189,205,217,228,243,251,259,267,276,284,292,300,308,316,324,332,345,353,367,379,387,401,412,420,433,444,452,463],{"__ignoreMap":165},[169,170,173,177],"span",{"class":171,"line":172},"line",1,[169,174,176],{"class":175},"shJU0","active_check",[169,178,180],{"class":179},"sgsFI",":\n",[169,182,184,187],{"class":171,"line":183},2,[169,185,186],{"class":175},"  attacks",[169,188,180],{"class":179},[169,190,192,195,198,201],{"class":171,"line":191},3,[169,193,194],{"class":179},"    - ",[169,196,197],{"class":175},"id",[169,199,200],{"class":179},": ",[169,202,204],{"class":203},"sYu0t","2\n",[169,206,208,211,213],{"class":171,"line":207},4,[169,209,210],{"class":175},"      type",[169,212,200],{"class":179},[169,214,216],{"class":215},"sYBdl","\"match_response\"\n",[169,218,220,223,225],{"class":171,"line":219},5,[169,221,222],{"class":175},"      description",[169,224,200],{"class":179},[169,226,227],{"class":215},"\"Inject /etc/passwd, report as vulnerable if the response body matches /etc/passwd file contents.\"\n",[169,229,231,234,237,240],{"class":171,"line":230},6,[169,232,233],{"class":175},"      target_tech",[169,235,236],{"class":179},": [",[169,238,239],{"class":215},"\"os:unix\"",[169,241,242],{"class":179},"]\n",[169,244,246,249],{"class":171,"line":245},7,[169,247,248],{"class":175},"      injection_locations_policy",[169,250,180],{"class":179},[169,252,254,257],{"class":171,"line":253},8,[169,255,256],{"class":175},"        default",[169,258,180],{"class":179},[169,260,262,265],{"class":171,"line":261},9,[169,263,264],{"class":175},"          locations",[169,266,180],{"class":179},[169,268,270,273],{"class":171,"line":269},10,[169,271,272],{"class":179},"            - ",[169,274,275],{"class":215},"\"cookie_value\"\n",[169,277,279,281],{"class":171,"line":278},11,[169,280,272],{"class":179},[169,282,283],{"class":215},"\"request_parameter_value\"\n",[169,285,287,289],{"class":171,"line":286},12,[169,288,272],{"class":179},[169,290,291],{"class":215},"\"request_body_parameter_value\"\n",[169,293,295,297],{"class":171,"line":294},13,[169,296,272],{"class":179},[169,298,299],{"class":215},"\"json_value\"\n",[169,301,303,305],{"class":171,"line":302},14,[169,304,272],{"class":179},[169,306,307],{"class":215},"\"xml_value\"\n",[169,309,311,313],{"class":171,"line":310},15,[169,312,272],{"class":179},[169,314,315],{"class":215},"\"multipart_form_data_filename\"\n",[169,317,319,321],{"class":171,"line":318},16,[169,320,272],{"class":179},[169,322,323],{"class":215},"\"multipart_form_data_value\"\n",[169,325,327,330],{"class":171,"line":326},17,[169,328,329],{"class":175},"      match_response_attack",[169,331,180],{"class":179},[169,333,335,338,340,343],{"class":171,"line":334},18,[169,336,337],{"class":175},"        payloads",[169,339,236],{"class":179},[169,341,342],{"class":215},"\"/etc/passwd\"",[169,344,242],{"class":179},[169,346,348,351],{"class":171,"line":347},19,[169,349,350],{"class":175},"        injections",[169,352,180],{"class":179},[169,354,356,359,362,364],{"class":171,"line":355},20,[169,357,358],{"class":179},"          - ",[169,360,361],{"class":175},"template",[169,363,200],{"class":179},[169,365,366],{"class":215},"\"{payload}\"\n",[169,368,370,372,374,376],{"class":171,"line":369},21,[169,371,358],{"class":179},[169,373,361],{"class":175},[169,375,200],{"class":179},[169,377,378],{"class":215},"\"{prefix payload suffix}\"\n",[169,380,382,385],{"class":171,"line":381},22,[169,383,384],{"class":175},"            affixes",[169,386,180],{"class":179},[169,388,390,393,396,398],{"class":171,"line":389},23,[169,391,392],{"class":179},"              - ",[169,394,395],{"class":175},"prefix",[169,397,200],{"class":179},[169,399,400],{"class":215},"\"/../../../../../../../../../../../..\"\n",[169,402,404,407,409],{"class":171,"line":403},24,[169,405,406],{"class":175},"                suffix",[169,408,200],{"class":179},[169,410,411],{"class":215},"\"\"\n",[169,413,415,418],{"class":171,"line":414},25,[169,416,417],{"class":175},"        matchers",[169,419,180],{"class":179},[169,421,423,425,428,430],{"class":171,"line":422},26,[169,424,358],{"class":179},[169,426,427],{"class":175},"description",[169,429,200],{"class":179},[169,431,432],{"class":215},"\"Check the HTTP response body to see if it contains the /etc/passwd file contents\"\n",[169,434,436,439,441],{"class":171,"line":435},27,[169,437,438],{"class":175},"            severity",[169,440,200],{"class":179},[169,442,443],{"class":215},"\"High\"\n",[169,445,447,450],{"class":171,"line":446},28,[169,448,449],{"class":175},"            match",[169,451,180],{"class":179},[169,453,455,458,460],{"class":171,"line":454},29,[169,456,457],{"class":175},"              location",[169,459,200],{"class":179},[169,461,462],{"class":215},"\"response_body\"\n",[169,464,466,469,471],{"class":171,"line":465},30,[169,467,468],{"class":175},"              expression",[169,470,200],{"class":179},[169,472,473],{"class":215},"\"root:.:0:0:\"\n",[41,475,477],{"id":476},"worked-example","Worked example",[12,479,480,481,484],{},"During the DAST crawl phase, DAST submits a form with an input field named ",[52,482,483],{},"file_name"," (headers simplified for brevity).",[160,486,491],{"className":487,"code":489,"language":490,"meta":165},[488],"language-text","POST /read-file HTTP/1.1\nAccept: text/html\nContent-Length: 20\nContent-Type: application/x-www-form-urlencoded\nHost: site.com\n\nfile_name=browserker\n","text",[52,492,489],{"__ignoreMap":165},[12,494,495,496,499,500,503,504,506],{},"During the active scan phase, DAST creates attacks from crawled HTTP requests. From the above request, injection locations are found for each of the four header values, the request path ",[52,497,498],{},"/read-file"," and the form input value ",[52,501,502],{},"browserker",". For a path traversal attack with payload ",[52,505,106],{},", six attack HTTP requests will be made to the target web application, each with the payload injected into the according injection location.",[12,508,509],{},"The attack on the form input value injection location HTTP would be:",[160,511,514],{"className":512,"code":513,"language":490,"meta":165},[488],"POST /read-file HTTP/1.1\nAccept: text/html\nContent-Length: 20\nContent-Type: application/x-www-form-urlencoded\nHost: site.com\n\nfile_name=/etc/passwd\n",[52,515,513],{"__ignoreMap":165},[12,517,518,519,521],{},"Assuming the target web application is vulnerable to a path traversal in the form input, it might read the contents of ",[52,520,106],{}," and return it in the HTTP response, such as:",[160,523,526],{"className":524,"code":525,"language":490,"meta":165},[488],"HTTP/1.1 200 OK\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate\nContent-Length: 229\nContent-Type: text/html; charset=utf-8\nDate: Mon, 25 Sep 2023 14:55:20 GMT\n\n\u003Chtml>\n\u003Cbody>\n  \u003Cdiv id=\"content\">\n    root:x:0:0:root:/root:/bin/bash\n    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n    bin:x:2:2:bin:/bin:/usr/sbin/nologin\n    sys:x:3:3:sys:/dev:/usr/sbin/nologin\n  \u003C/div>\n\u003C/body>\n\u003C/html>\n",[52,527,525],{"__ignoreMap":165},[12,529,530,531,534],{},"The DAST path traversal attack regular expression ",[52,532,533],{},"root:.:0:0:"," matches against the HTTP response body, so the attack is successful and a new finding is created.",[12,536,537],{},"Try GitLab's browser-based DAST scanning.",[539,540,541],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":165,"searchDepth":183,"depth":183,"links":543},[544,545,546,547,552,553],{"id":43,"depth":183,"text":44},{"id":57,"depth":183,"text":58},{"id":70,"depth":183,"text":71},{"id":91,"depth":183,"text":92,"children":548},[549,550,551],{"id":99,"depth":191,"text":100},{"id":113,"depth":191,"text":114},{"id":127,"depth":191,"text":128},{"id":149,"depth":183,"text":150},{"id":476,"depth":183,"text":477},"security","2023-10-10","As of GitLab 16.4, or DAST 4.0.9, browser-based DAST active scans will search for path traversal vulnerabilities using the GitLab check 22.1 instead of the ZAP alert 6.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749664638/Blog/Hero%20Images/applicationsecurity.png",{},true,"/en-us/blog/dast-release-first-gitlab-active-check",{"title":5,"description":556,"ogTitle":5,"ogDescription":556,"noIndex":559,"ogImage":560,"ogUrl":565,"ogSiteName":566,"ogType":567,"canonicalUrls":565},"https://about.gitlab.com/blog/dast-release-first-gitlab-active-check","https://about.gitlab.com","article","dast-release-first-gitlab-active-check","en-us/blog/dast-release-first-gitlab-active-check",[571,572,573,574,554],"DevSecOps","product","testing","features","BlogPost","F0vctBnC1mBAGxNTNrTNYxCP3mOK_0zPeTyHaOtrpyU",{"logo":578,"freeTrial":583,"sales":588,"login":593,"items":598,"search":925,"minimal":956,"duo":975,"switchNav":984,"pricingDeployment":995},{"config":579},{"href":580,"dataGaName":581,"dataGaLocation":582},"/","gitlab logo","header",{"text":584,"config":585},"Get free trial",{"href":586,"dataGaName":587,"dataGaLocation":582},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":589,"config":590},"Request a demo",{"href":591,"dataGaName":592,"dataGaLocation":582},"/sales/?contact-topic=request-demo","sales",{"text":594,"config":595},"Sign in",{"href":596,"dataGaName":597,"dataGaLocation":582},"https://gitlab.com/users/sign_in/","sign in",[599,628,728,733,847,903],{"text":600,"config":601,"menu":603},"Platform",{"dataNavLevelOne":602},"platform",{"type":604,"columns":605},"cards",[606,612,620],{"title":600,"description":607,"link":608},"The intelligent orchestration platform for DevSecOps",{"text":609,"config":610},"Explore our Platform",{"href":611,"dataGaName":602,"dataGaLocation":582},"/platform/",{"title":613,"description":614,"link":615},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":616,"config":617},"Meet GitLab Duo",{"href":618,"dataGaName":619,"dataGaLocation":582},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":621,"description":622,"link":623},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":624,"config":625},"Learn more",{"href":626,"dataGaName":627,"dataGaLocation":582},"/why-gitlab/","why gitlab",{"text":629,"left":562,"config":630,"menu":632},"Product",{"dataNavLevelOne":631},"solutions",{"type":633,"link":634,"columns":638,"feature":707},"lists",{"text":635,"config":636},"View all Solutions",{"href":637,"dataGaName":631,"dataGaLocation":582},"/solutions/",[639,663,686],{"title":640,"description":641,"link":642,"items":647},"Automation","CI/CD and automation to accelerate deployment",{"config":643},{"icon":644,"href":645,"dataGaName":646,"dataGaLocation":582},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[648,652,655,659],{"text":649,"config":650},"CI/CD",{"href":651,"dataGaLocation":582,"dataGaName":649},"/solutions/continuous-integration/",{"text":613,"config":653},{"href":618,"dataGaLocation":582,"dataGaName":654},"gitlab duo agent platform - product menu",{"text":656,"config":657},"Source Code Management",{"href":658,"dataGaLocation":582,"dataGaName":656},"/solutions/source-code-management/",{"text":660,"config":661},"Automated Software Delivery",{"href":645,"dataGaLocation":582,"dataGaName":662},"Automated software delivery",{"title":664,"description":665,"link":666,"items":671},"Security","Deliver code faster without compromising security",{"config":667},{"href":668,"dataGaName":669,"dataGaLocation":582,"icon":670},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[672,676,681],{"text":673,"config":674},"Application Security Testing",{"href":668,"dataGaName":675,"dataGaLocation":582},"Application security testing",{"text":677,"config":678},"Software Supply Chain Security",{"href":679,"dataGaLocation":582,"dataGaName":680},"/solutions/supply-chain/","Software supply chain security",{"text":682,"config":683},"Software Compliance",{"href":684,"dataGaName":685,"dataGaLocation":582},"/solutions/software-compliance/","software compliance",{"title":687,"link":688,"items":693},"Measurement",{"config":689},{"icon":690,"href":691,"dataGaName":692,"dataGaLocation":582},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[694,698,702],{"text":695,"config":696},"Visibility & Measurement",{"href":691,"dataGaLocation":582,"dataGaName":697},"Visibility and Measurement",{"text":699,"config":700},"Value Stream Management",{"href":701,"dataGaLocation":582,"dataGaName":699},"/solutions/value-stream-management/",{"text":703,"config":704},"Analytics & Insights",{"href":705,"dataGaLocation":582,"dataGaName":706},"/solutions/analytics-and-insights/","Analytics and insights",{"title":708,"type":633,"items":709},"GitLab for",[710,716,722],{"text":711,"config":712},"Enterprise",{"icon":713,"href":714,"dataGaLocation":582,"dataGaName":715},"Building","/enterprise/","enterprise",{"text":717,"config":718},"Small Business",{"icon":719,"href":720,"dataGaLocation":582,"dataGaName":721},"Work","/small-business/","small business",{"text":723,"config":724},"Public Sector",{"icon":725,"href":726,"dataGaLocation":582,"dataGaName":727},"Organization","/solutions/public-sector/","public sector",{"text":729,"config":730},"Pricing",{"href":731,"dataGaName":732,"dataGaLocation":582,"dataNavLevelOne":732},"/pricing/","pricing",{"text":734,"config":735,"menu":737},"Resources",{"dataNavLevelOne":736},"resources",{"type":633,"link":738,"columns":742,"feature":836},{"text":739,"config":740},"View all resources",{"href":741,"dataGaName":736,"dataGaLocation":582},"/resources/",[743,776,803],{"title":744,"items":745},"Getting started",[746,751,756,761,766,771],{"text":747,"config":748},"Install",{"href":749,"dataGaName":750,"dataGaLocation":582},"/install/","install",{"text":752,"config":753},"Quick start guides",{"href":754,"dataGaName":755,"dataGaLocation":582},"/get-started/","quick setup checklists",{"text":757,"config":758},"Learn",{"href":759,"dataGaLocation":582,"dataGaName":760},"https://university.gitlab.com/","learn",{"text":762,"config":763},"Product documentation",{"href":764,"dataGaName":765,"dataGaLocation":582},"https://docs.gitlab.com/","product documentation",{"text":767,"config":768},"Best practice videos",{"href":769,"dataGaName":770,"dataGaLocation":582},"/getting-started-videos/","best practice videos",{"text":772,"config":773},"Integrations",{"href":774,"dataGaName":775,"dataGaLocation":582},"/integrations/","integrations",{"title":777,"items":778},"Discover",[779,784,789,794,798],{"text":780,"config":781},"Customer success stories",{"href":782,"dataGaName":783,"dataGaLocation":582},"/customers/","customer success stories",{"text":785,"config":786},"Blog",{"href":787,"dataGaName":788,"dataGaLocation":582},"/blog/","blog",{"text":790,"config":791},"Demo Hub",{"href":792,"dataGaName":793,"dataGaLocation":582},"/demo-hub/","demo hub",{"text":795,"config":796},"The Source",{"href":797,"dataGaName":788,"dataGaLocation":582},"/the-source/",{"text":799,"config":800},"Remote",{"href":801,"dataGaName":802,"dataGaLocation":582},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":804,"items":805},"Connect",[806,811,816,821,826,831],{"text":807,"config":808},"GitLab Services",{"href":809,"dataGaName":810,"dataGaLocation":582},"/services/","services",{"text":812,"config":813},"Contribute",{"href":814,"dataGaName":815,"dataGaLocation":582},"https://contributors.gitlab.com","contribute",{"text":817,"config":818},"Community",{"href":819,"dataGaName":820,"dataGaLocation":582},"/community/","community",{"text":822,"config":823},"Forum",{"href":824,"dataGaName":825,"dataGaLocation":582},"https://forum.gitlab.com/","forum",{"text":827,"config":828},"Events",{"href":829,"dataGaName":830,"dataGaLocation":582},"/events/","events",{"text":832,"config":833},"Partners",{"href":834,"dataGaName":835,"dataGaLocation":582},"/partners/","partners",{"config":837,"title":840,"text":841,"link":842},{"background":838,"textColor":839},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":843,"config":844},"Read the latest",{"href":845,"dataGaName":846,"dataGaLocation":582},"/whats-new/","whats new",{"text":848,"config":849,"menu":851},"Company",{"dataNavLevelOne":850},"company",{"type":633,"columns":852},[853],{"items":854},[855,860,866,868,873,878,883,888,893,898],{"text":856,"config":857},"About",{"href":858,"dataGaName":859,"dataGaLocation":582},"/company/","about",{"text":861,"config":862,"footerGa":865},"Jobs",{"href":863,"dataGaName":864,"dataGaLocation":582},"/jobs/","jobs",{"dataGaName":864},{"text":827,"config":867},{"href":829,"dataGaName":830,"dataGaLocation":582},{"text":869,"config":870},"Leadership",{"href":871,"dataGaName":872,"dataGaLocation":582},"/company/team/e-group/","leadership",{"text":874,"config":875},"Handbook",{"href":876,"dataGaName":877,"dataGaLocation":582},"https://handbook.gitlab.com/","handbook",{"text":879,"config":880},"Investor relations",{"href":881,"dataGaName":882,"dataGaLocation":582},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":884,"config":885},"Trust Center",{"href":886,"dataGaName":887,"dataGaLocation":582},"/security/","trust center",{"text":889,"config":890},"AI Transparency Center",{"href":891,"dataGaName":892,"dataGaLocation":582},"/ai-transparency-center/","ai transparency center",{"text":894,"config":895},"Newsletter",{"href":896,"dataGaName":897,"dataGaLocation":582},"/company/contact/#contact-forms","newsletter",{"text":899,"config":900},"Press",{"href":901,"dataGaName":902,"dataGaLocation":582},"/press/","press",{"text":904,"config":905,"menu":906},"Contact us",{"dataNavLevelOne":850},{"type":633,"columns":907},[908],{"items":909},[910,915,920],{"text":911,"config":912},"Talk to sales",{"href":913,"dataGaName":914,"dataGaLocation":582},"/sales/","talk to sales",{"text":916,"config":917},"Support portal",{"href":918,"dataGaName":919,"dataGaLocation":582},"https://support.gitlab.com/hc/en-us","support portal",{"text":921,"config":922},"Customer portal",{"href":923,"dataGaName":924,"dataGaLocation":582},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":926,"login":927,"suggestions":934},"Close",{"text":928,"link":929},"To search repositories and projects, login to",{"text":930,"config":931},"gitlab.com",{"href":596,"dataGaName":932,"dataGaLocation":933},"search login","search",{"text":935,"default":936},"Suggestions",[937,939,943,945,949,953],{"text":613,"config":938},{"href":618,"dataGaName":613,"dataGaLocation":933},{"text":940,"config":941},"Code Suggestions (AI)",{"href":942,"dataGaName":940,"dataGaLocation":933},"/solutions/code-suggestions/",{"text":649,"config":944},{"href":651,"dataGaName":649,"dataGaLocation":933},{"text":946,"config":947},"GitLab on AWS",{"href":948,"dataGaName":946,"dataGaLocation":933},"/partners/technology-partners/aws/",{"text":950,"config":951},"GitLab on Google Cloud",{"href":952,"dataGaName":950,"dataGaLocation":933},"/partners/technology-partners/google-cloud-platform/",{"text":954,"config":955},"Why GitLab?",{"href":626,"dataGaName":954,"dataGaLocation":933},{"freeTrial":957,"mobileIcon":962,"desktopIcon":967,"secondaryButton":970},{"text":958,"config":959},"Start free trial",{"href":960,"dataGaName":587,"dataGaLocation":961},"https://gitlab.com/-/trials/new/","nav",{"altText":963,"config":964},"Gitlab Icon",{"src":965,"dataGaName":966,"dataGaLocation":961},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":963,"config":968},{"src":969,"dataGaName":966,"dataGaLocation":961},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":971,"config":972},"Get Started",{"href":973,"dataGaName":974,"dataGaLocation":961},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":976,"mobileIcon":980,"desktopIcon":982},{"text":977,"config":978},"Learn more about GitLab Duo",{"href":618,"dataGaName":979,"dataGaLocation":961},"gitlab duo",{"altText":963,"config":981},{"src":965,"dataGaName":966,"dataGaLocation":961},{"altText":963,"config":983},{"src":969,"dataGaName":966,"dataGaLocation":961},{"button":985,"mobileIcon":990,"desktopIcon":992},{"text":986,"config":987},"/switch",{"href":988,"dataGaName":989,"dataGaLocation":961},"#contact","switch",{"altText":963,"config":991},{"src":965,"dataGaName":966,"dataGaLocation":961},{"altText":963,"config":993},{"src":994,"dataGaName":966,"dataGaLocation":961},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":996,"mobileIcon":1001,"desktopIcon":1003},{"text":997,"config":998},"Back to pricing",{"href":731,"dataGaName":999,"dataGaLocation":961,"icon":1000},"back to pricing","GoBack",{"altText":963,"config":1002},{"src":965,"dataGaName":966,"dataGaLocation":961},{"altText":963,"config":1004},{"src":969,"dataGaName":966,"dataGaLocation":961},{"title":1006,"titleMobile":1007,"button":1008,"config":1013},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":624,"config":1009},{"href":1010,"dataGaName":1011,"dataGaLocation":1012},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1014,"disabled":559},"release",{"data":1016},{"text":1017,"source":1018,"edit":1024,"contribute":1029,"config":1034,"items":1039,"minimal":1248},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1019,"config":1020},"View page source",{"href":1021,"dataGaName":1022,"dataGaLocation":1023},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1025,"config":1026},"Edit this page",{"href":1027,"dataGaName":1028,"dataGaLocation":1023},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1030,"config":1031},"Please contribute",{"href":1032,"dataGaName":1033,"dataGaLocation":1023},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1035,"facebook":1036,"youtube":1037,"linkedin":1038},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1040,1087,1140,1184,1216],{"title":729,"links":1041,"subMenu":1056},[1042,1046,1051],{"text":1043,"config":1044},"View plans",{"href":731,"dataGaName":1045,"dataGaLocation":1023},"view plans",{"text":1047,"config":1048},"Why Premium?",{"href":1049,"dataGaName":1050,"dataGaLocation":1023},"/pricing/premium/","why premium",{"text":1052,"config":1053},"Why Ultimate?",{"href":1054,"dataGaName":1055,"dataGaLocation":1023},"/pricing/ultimate/","why ultimate",[1057],{"title":1058,"links":1059},"Contact Us",[1060,1063,1065,1067,1072,1077,1082],{"text":1061,"config":1062},"Contact sales",{"href":913,"dataGaName":592,"dataGaLocation":1023},{"text":916,"config":1064},{"href":918,"dataGaName":919,"dataGaLocation":1023},{"text":921,"config":1066},{"href":923,"dataGaName":924,"dataGaLocation":1023},{"text":1068,"config":1069},"Status",{"href":1070,"dataGaName":1071,"dataGaLocation":1023},"https://status.gitlab.com/","status",{"text":1073,"config":1074},"Terms of use",{"href":1075,"dataGaName":1076,"dataGaLocation":1023},"/terms/","terms of use",{"text":1078,"config":1079},"Privacy statement",{"href":1080,"dataGaName":1081,"dataGaLocation":1023},"/privacy/","privacy statement",{"text":1083,"config":1084},"Cookie preferences",{"dataGaName":1085,"dataGaLocation":1023,"id":1086,"isOneTrustButton":562},"cookie preferences","ot-sdk-btn",{"title":629,"links":1088,"subMenu":1097},[1089,1093],{"text":1090,"config":1091},"DevSecOps platform",{"href":611,"dataGaName":1092,"dataGaLocation":1023},"devsecops platform",{"text":1094,"config":1095},"AI-Assisted Development",{"href":618,"dataGaName":1096,"dataGaLocation":1023},"ai-assisted development",[1098],{"title":1099,"links":1100},"Topics",[1101,1106,1111,1116,1121,1125,1130,1135],{"text":1102,"config":1103},"CICD",{"href":1104,"dataGaName":1105,"dataGaLocation":1023},"/topics/ci-cd/","cicd",{"text":1107,"config":1108},"GitOps",{"href":1109,"dataGaName":1110,"dataGaLocation":1023},"/topics/gitops/","gitops",{"text":1112,"config":1113},"DevOps",{"href":1114,"dataGaName":1115,"dataGaLocation":1023},"/topics/devops/","devops",{"text":1117,"config":1118},"Version Control",{"href":1119,"dataGaName":1120,"dataGaLocation":1023},"/topics/version-control/","version control",{"text":571,"config":1122},{"href":1123,"dataGaName":1124,"dataGaLocation":1023},"/topics/devsecops/","devsecops",{"text":1126,"config":1127},"Cloud Native",{"href":1128,"dataGaName":1129,"dataGaLocation":1023},"/topics/cloud-native/","cloud native",{"text":1131,"config":1132},"AI for Coding",{"href":1133,"dataGaName":1134,"dataGaLocation":1023},"/topics/devops/ai-for-coding/","ai for coding",{"text":1136,"config":1137},"Agentic AI",{"href":1138,"dataGaName":1139,"dataGaLocation":1023},"/topics/agentic-ai/","agentic ai",{"title":1141,"links":1142},"Solutions",[1143,1145,1147,1152,1156,1159,1163,1166,1168,1171,1174,1179],{"text":673,"config":1144},{"href":668,"dataGaName":673,"dataGaLocation":1023},{"text":662,"config":1146},{"href":645,"dataGaName":646,"dataGaLocation":1023},{"text":1148,"config":1149},"Agile development",{"href":1150,"dataGaName":1151,"dataGaLocation":1023},"/solutions/agile-delivery/","agile delivery",{"text":1153,"config":1154},"SCM",{"href":658,"dataGaName":1155,"dataGaLocation":1023},"source code management",{"text":1102,"config":1157},{"href":651,"dataGaName":1158,"dataGaLocation":1023},"continuous integration & delivery",{"text":1160,"config":1161},"Value stream management",{"href":701,"dataGaName":1162,"dataGaLocation":1023},"value stream management",{"text":1107,"config":1164},{"href":1165,"dataGaName":1110,"dataGaLocation":1023},"/solutions/gitops/",{"text":711,"config":1167},{"href":714,"dataGaName":715,"dataGaLocation":1023},{"text":1169,"config":1170},"Small business",{"href":720,"dataGaName":721,"dataGaLocation":1023},{"text":1172,"config":1173},"Public sector",{"href":726,"dataGaName":727,"dataGaLocation":1023},{"text":1175,"config":1176},"Education",{"href":1177,"dataGaName":1178,"dataGaLocation":1023},"/solutions/education/","education",{"text":1180,"config":1181},"Financial services",{"href":1182,"dataGaName":1183,"dataGaLocation":1023},"/solutions/finance/","financial services",{"title":734,"links":1185},[1186,1188,1190,1192,1195,1197,1200,1202,1204,1206,1208,1210,1212,1214],{"text":747,"config":1187},{"href":749,"dataGaName":750,"dataGaLocation":1023},{"text":752,"config":1189},{"href":754,"dataGaName":755,"dataGaLocation":1023},{"text":757,"config":1191},{"href":759,"dataGaName":760,"dataGaLocation":1023},{"text":762,"config":1193},{"href":764,"dataGaName":1194,"dataGaLocation":1023},"docs",{"text":785,"config":1196},{"href":787,"dataGaName":788,"dataGaLocation":1023},{"text":1198,"config":1199},"What's new",{"href":845,"dataGaName":846,"dataGaLocation":1023},{"text":780,"config":1201},{"href":782,"dataGaName":783,"dataGaLocation":1023},{"text":799,"config":1203},{"href":801,"dataGaName":802,"dataGaLocation":1023},{"text":807,"config":1205},{"href":809,"dataGaName":810,"dataGaLocation":1023},{"text":812,"config":1207},{"href":814,"dataGaName":815,"dataGaLocation":1023},{"text":817,"config":1209},{"href":819,"dataGaName":820,"dataGaLocation":1023},{"text":822,"config":1211},{"href":824,"dataGaName":825,"dataGaLocation":1023},{"text":827,"config":1213},{"href":829,"dataGaName":830,"dataGaLocation":1023},{"text":832,"config":1215},{"href":834,"dataGaName":835,"dataGaLocation":1023},{"title":848,"links":1217},[1218,1220,1222,1224,1226,1228,1232,1237,1239,1241,1243],{"text":856,"config":1219},{"href":858,"dataGaName":850,"dataGaLocation":1023},{"text":861,"config":1221},{"href":863,"dataGaName":864,"dataGaLocation":1023},{"text":869,"config":1223},{"href":871,"dataGaName":872,"dataGaLocation":1023},{"text":874,"config":1225},{"href":876,"dataGaName":877,"dataGaLocation":1023},{"text":879,"config":1227},{"href":881,"dataGaName":882,"dataGaLocation":1023},{"text":1229,"config":1230},"Sustainability",{"href":1231,"dataGaName":1229,"dataGaLocation":1023},"/sustainability/",{"text":1233,"config":1234},"Diversity, inclusion and belonging (DIB)",{"href":1235,"dataGaName":1236,"dataGaLocation":1023},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":884,"config":1238},{"href":886,"dataGaName":887,"dataGaLocation":1023},{"text":894,"config":1240},{"href":896,"dataGaName":897,"dataGaLocation":1023},{"text":899,"config":1242},{"href":901,"dataGaName":902,"dataGaLocation":1023},{"text":1244,"config":1245},"Modern Slavery Transparency Statement",{"href":1246,"dataGaName":1247,"dataGaLocation":1023},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1249},[1250,1253,1256],{"text":1251,"config":1252},"Terms",{"href":1075,"dataGaName":1076,"dataGaLocation":1023},{"text":1254,"config":1255},"Cookies",{"dataGaName":1085,"dataGaLocation":1023,"id":1086,"isOneTrustButton":562},{"text":1257,"config":1258},"Privacy",{"href":1080,"dataGaName":1081,"dataGaLocation":1023},[1260],{"id":1261,"title":7,"body":558,"config":1262,"content":1264,"description":558,"extension":1268,"meta":1269,"navigation":562,"path":1270,"seo":1271,"stem":1272,"__hash__":1273},"blogAuthors/en-us/blog/authors/cameron-swords.yml",{"template":1263},"BlogAuthor",{"name":7,"config":1265},{"headshot":1266,"ctfId":1267},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749667598/Blog/Author%20Headshots/cam_swords-headshot.jpg","camswords","yml",{},"/en-us/blog/authors/cameron-swords",{},"en-us/blog/authors/cameron-swords","eF_1xyBgmxRNnOfqIzIXgJc-zPbXHpJXba-tDhQ-VOo",[1275,1283,1291],{"title":1276,"description":1277,"heroImage":1278,"category":554,"date":1279,"authors":1280,"slug":1282,"externalUrl":558},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1281],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1284,"description":1285,"heroImage":1278,"category":554,"date":1286,"authors":1287,"slug":1290,"externalUrl":558},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1288,1289],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1292,"description":1293,"heroImage":1294,"category":554,"date":1295,"authors":1296,"slug":1298,"externalUrl":558},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1297],"Alisa Ho","claude-security-and-gitlab",{"promotions":1300},[1301,1315,1326,1337],{"id":1302,"categories":1303,"header":1305,"text":1306,"button":1307,"image":1312},"ai-modernization",[1304],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1308,"config":1309},"Get your AI maturity score",{"href":1310,"dataGaName":1311,"dataGaLocation":788},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1313},{"src":1314},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1316,"categories":1317,"header":1318,"text":1306,"button":1319,"image":1323},"devops-modernization",[572,1124],"Are you just managing tools or shipping innovation?",{"text":1320,"config":1321},"Get your DevOps maturity score",{"href":1322,"dataGaName":1311,"dataGaLocation":788},"/assessments/devops-modernization-assessment/",{"config":1324},{"src":1325},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1327,"categories":1328,"header":1329,"text":1306,"button":1330,"image":1334},"security-modernization",[554],"Are you trading speed for security?",{"text":1331,"config":1332},"Get your security maturity score",{"href":1333,"dataGaName":1311,"dataGaLocation":788},"/assessments/security-modernization-assessment/",{"config":1335},{"src":1336},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1338,"paths":1339,"header":1342,"text":1343,"button":1344,"image":1349},"github-azure-migration",[1340,1341],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1345,"config":1346},"See how GitLab compares to GitHub",{"href":1347,"dataGaName":1348,"dataGaLocation":788},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1350},{"src":1325},{"header":1352,"blurb":1353,"button":1354,"secondaryButton":1359},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1355,"config":1356},"Get your free trial",{"href":1357,"dataGaName":587,"dataGaLocation":1358},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1061,"config":1360},{"href":913,"dataGaName":592,"dataGaLocation":1358},1786803765993]