[{"data":1,"prerenderedAt":1269},["ShallowReactive",2],{"/blog/fast-and-efficient-sbom-with-gitlab-and-rezilion":3,"navigation-en-us":486,"banner-en-us":912,"footer-en-us":922,"blog-post-authors-en-us-Fernando Diaz":1166,"blog-related-posts-en-us-fast-and-efficient-sbom-with-gitlab-and-rezilion":1181,"blog-promotions-en-us":1206,"next-steps-en-us":1259},{"id":4,"title":5,"authors":6,"body":8,"category":465,"date":466,"description":467,"extension":468,"externalUrl":469,"faq":469,"featured":470,"heroImage":471,"meta":472,"navigation":383,"path":473,"seo":474,"slug":479,"stem":480,"tags":481,"template":484,"updatedDate":469,"__hash__":485},"blogPosts/en-us/blog/fast-and-efficient-sbom-with-gitlab-and-rezilion.md","Meet the demand for SBOMs and supply chain security with GitLab and Rezilion",[7],"Fernando Diaz",{"type":9,"value":10,"toc":452},"minimark",[11,15,30,35,44,53,57,60,63,72,79,82,98,102,105,108,165,168,183,187,190,205,212,215,241,244,250,263,269,278,288,291,295,298,301,306,314,365,374,384,388,391,397,401,404,407,413,416,419,422,440],[12,13,14],"p",{},"Modern software development often takes advantage of code reuse. Instead of reinventing the wheel, developers can use a library that focuses on a particular\nfunction for use in an application. However, there is one caveat: These\ndependencies may be susceptible to security vulnerabilities, which may render\nyour whole application – and possibly your software supply chain – as vulnerable.",[12,16,17,18,24,25,29],{},"That is why DevOps teams must be able to generate a software bill of materials, or ",[19,20,23],"a",{"href":21,"rel":22},"https://docs.gitlab.com/user/application_security/dependency_list/",[],"SBOM",". GitLab has partnered with ",[19,26,28],{"href":27},"/partners/technology-partners/#rezilion","Rezilion"," to make this task easier.",[31,32,34],"h2",{"id":33},"the-need-for-sboms","The need for SBOMs",[12,36,37,38,43],{},"In 2020, the ",[19,39,42],{"href":40,"rel":41},"https://www.businessinsider.com/solarwinds-hack-explained-government-agencies-cyber-security-2020-12",[],"Solar Winds software supply chain attack happened",". Hackers used an easy-to-guess password to inject malicious\ncode into a software update and many users of the affected Solar Winds product\nOrion, including government agencies, had their data compromised.",[12,45,46,47,52],{},"This breach, along with other high-profile attacks, led Pres. Biden's administration to ",[19,48,51],{"href":49,"rel":50},"https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/",[],"require software vendors to deliver a software bill of materials (SBOM)"," with any software offer they make to federal agencies.",[31,54,56],{"id":55},"secure-your-software-and-manage-vulnerabilities","Secure your software and manage vulnerabilities",[12,58,59],{},"To get started with software supply chain security, you need to not only implement security scanning, but\nalso have a process in place to manage and effectively triage these vulnerabilities.",[12,61,62],{},"Below, you can see the typical software development lifecycle. It shows that security scans are run on a feature branch. A developer can view the presented vulnerabilities and continue to commit to the feature branch which re-runs the scans.",[12,64,65,66,71],{},"Once the vulnerabilities have been remediated the feature branch can be merged. If vulnerabilities are still present, approval by the security team can be required, and you can continue to keep track of the vulnerability with a ",[19,67,70],{"href":68,"rel":69},"https://docs.gitlab.com/user/project/issues/confidential_issues/",[],"confidential issue",".",[12,73,74],{},[75,76],"img",{"alt":77,"src":78},"","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398230/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/sdlc.png",[12,80,81],{},"Let's go over how to do the following:",[83,84,85,89,92,95],"ul",{},[86,87,88],"li",{},"Implement security scanners in GitLab with built-in templates",[86,90,91],{},"Manage vulnerabilities with the GitLab vulnerability report",[86,93,94],{},"Manage dependencies and generate an SBoM",[86,96,97],{},"Efficiently triage exploitable vulnerabilities with Rezilion",[31,99,101],{"id":100},"implement-security-scanners","Implement security scanners",[12,103,104],{},"The first step in securing your software supply chain is to implement security scanners into your CI/CD pipeline.\nThese scanners should be set up in a way, where they run on each code commit. When a vulnerability is detected, approval by a security team member should be required.",[12,106,107],{},"GitLab offers many different security scanners to get you started:",[83,109,110,117,124,131,138,145,152,159],{},[86,111,112],{},[19,113,116],{"href":114,"rel":115},"https://docs.gitlab.com/user/application_security/sast/",[],"Static Application Security Testing (SAST)",[86,118,119],{},[19,120,123],{"href":121,"rel":122},"https://docs.gitlab.com/user/application_security/dast/",[],"Dynamic Application Security Testing (DAST)",[86,125,126],{},[19,127,130],{"href":128,"rel":129},"https://docs.gitlab.com/user/application_security/iac_scanning/",[],"Infrastructure as Code (IaC) Scanning",[86,132,133],{},[19,134,137],{"href":135,"rel":136},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"Container Scanning",[86,139,140],{},[19,141,144],{"href":142,"rel":143},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency Scanning",[86,146,147],{},[19,148,151],{"href":149,"rel":150},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/",[],"Coverage-Guided Fuzzing",[86,153,154],{},[19,155,158],{"href":156,"rel":157},"https://docs.gitlab.com/user/application_security/api_fuzzing/",[],"Web-API Fuzzing",[86,160,161],{},[19,162,164],{"href":128,"rel":163},[],"Secret Detection",[12,166,167],{},"With the scanners running in a pipeline, static application source code is scanned, as well as dependencies and the\nrunning application itself.",[12,169,170,171,176,177,182],{},"These scanners can be implemented by simply adding templates to your ",[19,172,175],{"href":173,"rel":174},"https://docs.gitlab.com/user/application_security/sast/#configure-sast-manually",[],"GitLab CI YAML",". You can also use the ",[19,178,181],{"href":179,"rel":180},"https://docs.gitlab.com/user/application_security/sast/#configure-sast-in-the-ui-with-customizations",[],"Configuration UI","\nto set up and configure these security scanners. You can check out the set up instructions for each scanner in the GitLab appsec configuration documentation.",[31,184,186],{"id":185},"manage-vulnerabilities","Manage vulnerabilities",[12,188,189],{},"Next up, see how to use GitLab to manage vulnerabilities. GitLab provides a single source of truth that allows developers and\nappsec engineers to collaborate and address issues together. After the security scanners have been implemented, there are a\nfew ways to manage vulnerabilities.",[12,191,192,193,197,198,201,202,71],{},"Developers will use the MR view to see all the vulnerabilities present in the ",[194,195,196],"strong",{},"diff"," between the ",[194,199,200],{},"feature branch"," and the ",[194,203,204],{},"branch you are merging with",[12,206,207,208],{},"You can see below, that each vulnerability is presented in an easy-to-read view:\n",[75,209],{"alt":210,"src":211},"Life cycle illustration","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398229/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/mr-view.png",[12,213,214],{},"When you click on a vulnerability, you can see details such as:",[83,216,217,220,223,226,229,232,235,238],{},[86,218,219],{},"Status",[86,221,222],{},"Description",[86,224,225],{},"Evidence",[86,227,228],{},"Severity",[86,230,231],{},"Identifiers",[86,233,234],{},"Linked Issues",[86,236,237],{},"Solution",[86,239,240],{},"Security Training",[12,242,243],{},"The vulnerabilities are also actionable which means they can be dismissed or a confidential issue can be created to triage later.",[12,245,246],{},[75,247],{"alt":248,"src":249},"Screenshot of vulnerabilities","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398229/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/mr-view-2.png",[12,251,252,253,258,259,262],{},"Then there is the ",[19,254,257],{"href":255,"rel":256},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"vulnerability report"," which displays all the vulnerabilities detected within the ",[194,260,261],{},"main"," branch and allows for the\nsecurity team to triage and address vulnerabilities from a common interface, enabling collaboration.",[12,264,265],{},[75,266],{"alt":267,"src":268},"Detailed view of vulnerability","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398231/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/vr-1.png",[12,270,271,272,277],{},"Once you click on a vulnerability, you are provided with ",[19,273,276],{"href":274,"rel":275},"https://docs.gitlab.com/user/application_security/vulnerabilities/",[],"advanced details"," on the vulnerability as well as how to remediate it.",[12,279,280,284],{},[75,281],{"alt":282,"src":283},"Vulnerability report","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398231/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/vr-2.png",[75,285],{"alt":286,"src":287},"Remediation suggestions","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398232/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/vr-3.png",[12,289,290],{},"An appsec engineer can change the status, add additional information, and create confidential issues from this view.",[31,292,294],{"id":293},"manage-dependencies","Manage dependencies",[12,296,297],{},"Now that you have seen how to run security scans on your application, as well as manage vulnerabilities, let's explore managing our application's dependencies and understanding what is running on your system.",[12,299,300],{},"There are a few ways of managing dependencies and generating an SBoM. I'll go over\nthe GitLab Dependency List (SBoM) as well as the dynamic Rezilion SBoM.",[302,303,305],"h3",{"id":304},"gitlab-dependency-list-sbom","GitLab Dependency List (SBoM)",[12,307,308,309,313],{},"GitLab provides a ",[19,310,312],{"href":21,"rel":311},[],"Dependency List"," also known as an SBoM.\nThe dependency list contains your project’s dependencies and critical details about those dependencies, including their known vulnerabilities.  GitLab displays dependencies with the following information:",[315,316,317,329],"table",{},[318,319,320],"thead",{},[321,322,323,327],"tr",{},[324,325,326],"th",{},"Field",[324,328,222],{},[330,331,332,341,349,357],"tbody",{},[321,333,334,338],{},[335,336,337],"td",{},"Component",[335,339,340],{},"The dependency’s name and version.",[321,342,343,346],{},[335,344,345],{},"Packager",[335,347,348],{},"The packager used to install the dependency.",[321,350,351,354],{},[335,352,353],{},"Location",[335,355,356],{},"For system dependencies, this lists the image that was scanned. For application dependencies, this shows a link to the packager-specific lock file in your project that declared the dependency. It also shows the dependency path to a top-level dependency, if any, and if supported.",[321,358,359,362],{},[335,360,361],{},"License",[335,363,364],{},"Links to the dependencies' software licenses.",[12,366,367,368,373],{},"You can download your project’s full list of dependencies and their details in ",[19,369,372],{"href":370,"rel":371},"https://cyclonedx.org/",[],"CycloneDX"," JSON format. CycloneDX is a lightweight SBoM standard designed for use in application security contexts and supply chain component analysis. See it in action below:",[375,376],"iframe",{"width":377,"height":378,"src":379,"title":380,"frameBorder":381,"allow":382,"allowFullScreen":383},560,315,"https://www.youtube.com/embed/5a-_l1bqWhQ","YouTube video player","0","accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture",true,[302,385,387],{"id":386},"rezilion-sbom","Rezilion SBoM",[12,389,390],{},"Rezilion provides a dynamic SBoM directly within the GitLab UI. It displays all the software components your application uses, and determines their loaded/unloaded status for a quick risk assessment.",[12,392,393],{},[75,394],{"alt":395,"src":396},"Screenshot of SBoM","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398230/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/rezilion-sbom.png",[31,398,400],{"id":399},"easily-triage-exploitable-vulnerabilities","Easily triage exploitable vulnerabilities",[12,402,403],{},"Now that you have seen how to secure your application as well as its dependencies, you can make sure addressing security issues does not slow down development. What matters most in your\nenvironment is to help save developers time and deliver secure products in a swift manner.",[12,405,406],{},"Here is where GitLab + Rezilion comes into play: The integration reduces developers' patching efforts by enabling them to only display vulnerabilities that are exploitable. Rezilion will mark unexploitable vulnerabilities as false positives, which can then be sorted out. This can be done within the GitLab vulnerability report:",[12,408,409],{},[75,410],{"alt":411,"src":412},"Display of exploitable vulnerabilities","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782398230/blog/Content%20Images/fast-and-efficient-supply-chain-security-with-rezilion-and-gitlab/rezilion-exploitable.png",[12,414,415],{},"Check out the demo showing how GitLab and Rezilion work together:",[375,417],{"width":377,"height":378,"src":418,"title":380,"frameBorder":381,"allow":382,"allowFullScreen":383},"https://www.youtube.com/embed/FgNp7FQFniE",[12,420,421],{},"With these tools in hand, not only will you be able to secure your application's code before it makes its way to production, but you'll be able to do it in a fast and efficient manner.",[12,423,424,425,430,431,435,436,71],{},"To learn more about the GitLab + Rezilion integration check out this ",[19,426,429],{"href":427,"rel":428},"https://www.rezilion.com/wp-content/uploads/2022/03/Rezilion-GitLab-Solution-Overview.pdf",[],"whitepaper",". You can also sign up for a free trial of ",[19,432,434],{"href":433},"/free-trial/","GitLab Ultimate"," and ",[19,437,28],{"href":438,"rel":439},"https://rezilion.com/get-started",[],[12,441,442,443,447,448],{},"Photo by ",[19,444,446],{"href":445},"https://unsplash.com/es/@jessicalewiscreative?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText","Jessica Lewis"," on ",[19,449,451],{"href":450},"https://unsplash.com/s/photos/checklist?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText","Unsplash",{"title":77,"searchDepth":453,"depth":453,"links":454},2,[455,456,457,458,459,464],{"id":33,"depth":453,"text":34},{"id":55,"depth":453,"text":56},{"id":100,"depth":453,"text":101},{"id":185,"depth":453,"text":186},{"id":293,"depth":453,"text":294,"children":460},[461,463],{"id":304,"depth":462,"text":305},3,{"id":386,"depth":462,"text":387},{"id":399,"depth":453,"text":400},"security","2022-10-17","Learn the role of SBOMs in helping to secure your software supply chain and how to generate them with the GitLab + Rezilion integration.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749672849/Blog/Hero%20Images/jessica-lewis-fJXv46LT7Xk-unsplash.jpg",{},"/en-us/blog/fast-and-efficient-sbom-with-gitlab-and-rezilion",{"title":475,"description":467,"ogTitle":475,"ogDescription":467,"noIndex":470,"ogImage":471,"ogUrl":476,"ogSiteName":477,"ogType":478,"canonicalUrls":476},"Meet the demand for SBOMs with GitLab and Rezilion","https://about.gitlab.com/blog/fast-and-efficient-sbom-with-gitlab-and-rezilion","https://about.gitlab.com","article","fast-and-efficient-sbom-with-gitlab-and-rezilion","en-us/blog/fast-and-efficient-sbom-with-gitlab-and-rezilion",[465,482,483],"partners","integrations","BlogPost","2FF3dETFPMk3s4UwAkPrtmmP00y9pQcalZ_kYyai3K0",{"logo":487,"freeTrial":492,"sales":497,"login":502,"items":507,"search":832,"minimal":863,"duo":882,"switchNav":891,"pricingDeployment":902},{"config":488},{"href":489,"dataGaName":490,"dataGaLocation":491},"/","gitlab logo","header",{"text":493,"config":494},"Get free trial",{"href":495,"dataGaName":496,"dataGaLocation":491},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":498,"config":499},"Request a demo",{"href":500,"dataGaName":501,"dataGaLocation":491},"/sales/?contact-topic=request-demo","sales",{"text":503,"config":504},"Sign in",{"href":505,"dataGaName":506,"dataGaLocation":491},"https://gitlab.com/users/sign_in/","sign in",[508,537,637,642,754,810],{"text":509,"config":510,"menu":512},"Platform",{"dataNavLevelOne":511},"platform",{"type":513,"columns":514},"cards",[515,521,529],{"title":509,"description":516,"link":517},"The intelligent orchestration platform for DevSecOps",{"text":518,"config":519},"Explore our Platform",{"href":520,"dataGaName":511,"dataGaLocation":491},"/platform/",{"title":522,"description":523,"link":524},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":525,"config":526},"Meet GitLab Duo",{"href":527,"dataGaName":528,"dataGaLocation":491},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":530,"description":531,"link":532},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":533,"config":534},"Learn more",{"href":535,"dataGaName":536,"dataGaLocation":491},"/why-gitlab/","why gitlab",{"text":538,"left":383,"config":539,"menu":541},"Product",{"dataNavLevelOne":540},"solutions",{"type":542,"link":543,"columns":547,"feature":616},"lists",{"text":544,"config":545},"View all Solutions",{"href":546,"dataGaName":540,"dataGaLocation":491},"/solutions/",[548,572,595],{"title":549,"description":550,"link":551,"items":556},"Automation","CI/CD and automation to accelerate deployment",{"config":552},{"icon":553,"href":554,"dataGaName":555,"dataGaLocation":491},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[557,561,564,568],{"text":558,"config":559},"CI/CD",{"href":560,"dataGaLocation":491,"dataGaName":558},"/solutions/continuous-integration/",{"text":522,"config":562},{"href":527,"dataGaLocation":491,"dataGaName":563},"gitlab duo agent platform - product menu",{"text":565,"config":566},"Source Code Management",{"href":567,"dataGaLocation":491,"dataGaName":565},"/solutions/source-code-management/",{"text":569,"config":570},"Automated Software Delivery",{"href":554,"dataGaLocation":491,"dataGaName":571},"Automated software delivery",{"title":573,"description":574,"link":575,"items":580},"Security","Deliver code faster without compromising security",{"config":576},{"href":577,"dataGaName":578,"dataGaLocation":491,"icon":579},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[581,585,590],{"text":582,"config":583},"Application Security Testing",{"href":577,"dataGaName":584,"dataGaLocation":491},"Application security testing",{"text":586,"config":587},"Software Supply Chain Security",{"href":588,"dataGaLocation":491,"dataGaName":589},"/solutions/supply-chain/","Software supply chain security",{"text":591,"config":592},"Software Compliance",{"href":593,"dataGaName":594,"dataGaLocation":491},"/solutions/software-compliance/","software compliance",{"title":596,"link":597,"items":602},"Measurement",{"config":598},{"icon":599,"href":600,"dataGaName":601,"dataGaLocation":491},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[603,607,611],{"text":604,"config":605},"Visibility & Measurement",{"href":600,"dataGaLocation":491,"dataGaName":606},"Visibility and Measurement",{"text":608,"config":609},"Value Stream Management",{"href":610,"dataGaLocation":491,"dataGaName":608},"/solutions/value-stream-management/",{"text":612,"config":613},"Analytics & Insights",{"href":614,"dataGaLocation":491,"dataGaName":615},"/solutions/analytics-and-insights/","Analytics and insights",{"title":617,"type":542,"items":618},"GitLab for",[619,625,631],{"text":620,"config":621},"Enterprise",{"icon":622,"href":623,"dataGaLocation":491,"dataGaName":624},"Building","/enterprise/","enterprise",{"text":626,"config":627},"Small Business",{"icon":628,"href":629,"dataGaLocation":491,"dataGaName":630},"Work","/small-business/","small business",{"text":632,"config":633},"Public Sector",{"icon":634,"href":635,"dataGaLocation":491,"dataGaName":636},"Organization","/solutions/public-sector/","public sector",{"text":638,"config":639},"Pricing",{"href":640,"dataGaName":641,"dataGaLocation":491,"dataNavLevelOne":641},"/pricing/","pricing",{"text":643,"config":644,"menu":646},"Resources",{"dataNavLevelOne":645},"resources",{"type":542,"link":647,"columns":651,"feature":743},{"text":648,"config":649},"View all resources",{"href":650,"dataGaName":645,"dataGaLocation":491},"/resources/",[652,684,711],{"title":653,"items":654},"Getting started",[655,660,665,670,675,680],{"text":656,"config":657},"Install",{"href":658,"dataGaName":659,"dataGaLocation":491},"/install/","install",{"text":661,"config":662},"Quick start guides",{"href":663,"dataGaName":664,"dataGaLocation":491},"/get-started/","quick setup checklists",{"text":666,"config":667},"Learn",{"href":668,"dataGaLocation":491,"dataGaName":669},"https://university.gitlab.com/","learn",{"text":671,"config":672},"Product documentation",{"href":673,"dataGaName":674,"dataGaLocation":491},"https://docs.gitlab.com/","product documentation",{"text":676,"config":677},"Best practice videos",{"href":678,"dataGaName":679,"dataGaLocation":491},"/getting-started-videos/","best practice videos",{"text":681,"config":682},"Integrations",{"href":683,"dataGaName":483,"dataGaLocation":491},"/integrations/",{"title":685,"items":686},"Discover",[687,692,697,702,706],{"text":688,"config":689},"Customer success stories",{"href":690,"dataGaName":691,"dataGaLocation":491},"/customers/","customer success stories",{"text":693,"config":694},"Blog",{"href":695,"dataGaName":696,"dataGaLocation":491},"/blog/","blog",{"text":698,"config":699},"Demo Hub",{"href":700,"dataGaName":701,"dataGaLocation":491},"/demo-hub/","demo hub",{"text":703,"config":704},"The Source",{"href":705,"dataGaName":696,"dataGaLocation":491},"/the-source/",{"text":707,"config":708},"Remote",{"href":709,"dataGaName":710,"dataGaLocation":491},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":712,"items":713},"Connect",[714,719,724,729,734,739],{"text":715,"config":716},"GitLab Services",{"href":717,"dataGaName":718,"dataGaLocation":491},"/services/","services",{"text":720,"config":721},"Contribute",{"href":722,"dataGaName":723,"dataGaLocation":491},"https://contributors.gitlab.com","contribute",{"text":725,"config":726},"Community",{"href":727,"dataGaName":728,"dataGaLocation":491},"/community/","community",{"text":730,"config":731},"Forum",{"href":732,"dataGaName":733,"dataGaLocation":491},"https://forum.gitlab.com/","forum",{"text":735,"config":736},"Events",{"href":737,"dataGaName":738,"dataGaLocation":491},"/events/","events",{"text":740,"config":741},"Partners",{"href":742,"dataGaName":482,"dataGaLocation":491},"/partners/",{"config":744,"title":747,"text":748,"link":749},{"background":745,"textColor":746},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":750,"config":751},"Read the latest",{"href":752,"dataGaName":753,"dataGaLocation":491},"/whats-new/","whats new",{"text":755,"config":756,"menu":758},"Company",{"dataNavLevelOne":757},"company",{"type":542,"columns":759},[760],{"items":761},[762,767,773,775,780,785,790,795,800,805],{"text":763,"config":764},"About",{"href":765,"dataGaName":766,"dataGaLocation":491},"/company/","about",{"text":768,"config":769,"footerGa":772},"Jobs",{"href":770,"dataGaName":771,"dataGaLocation":491},"/jobs/","jobs",{"dataGaName":771},{"text":735,"config":774},{"href":737,"dataGaName":738,"dataGaLocation":491},{"text":776,"config":777},"Leadership",{"href":778,"dataGaName":779,"dataGaLocation":491},"/company/team/e-group/","leadership",{"text":781,"config":782},"Handbook",{"href":783,"dataGaName":784,"dataGaLocation":491},"https://handbook.gitlab.com/","handbook",{"text":786,"config":787},"Investor relations",{"href":788,"dataGaName":789,"dataGaLocation":491},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":791,"config":792},"Trust Center",{"href":793,"dataGaName":794,"dataGaLocation":491},"/security/","trust center",{"text":796,"config":797},"AI Transparency Center",{"href":798,"dataGaName":799,"dataGaLocation":491},"/ai-transparency-center/","ai transparency center",{"text":801,"config":802},"Newsletter",{"href":803,"dataGaName":804,"dataGaLocation":491},"/company/contact/#contact-forms","newsletter",{"text":806,"config":807},"Press",{"href":808,"dataGaName":809,"dataGaLocation":491},"/press/","press",{"text":811,"config":812,"menu":813},"Contact us",{"dataNavLevelOne":757},{"type":542,"columns":814},[815],{"items":816},[817,822,827],{"text":818,"config":819},"Talk to sales",{"href":820,"dataGaName":821,"dataGaLocation":491},"/sales/","talk to sales",{"text":823,"config":824},"Support portal",{"href":825,"dataGaName":826,"dataGaLocation":491},"https://support.gitlab.com/hc/en-us","support portal",{"text":828,"config":829},"Customer portal",{"href":830,"dataGaName":831,"dataGaLocation":491},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":833,"login":834,"suggestions":841},"Close",{"text":835,"link":836},"To search repositories and projects, login to",{"text":837,"config":838},"gitlab.com",{"href":505,"dataGaName":839,"dataGaLocation":840},"search login","search",{"text":842,"default":843},"Suggestions",[844,846,850,852,856,860],{"text":522,"config":845},{"href":527,"dataGaName":522,"dataGaLocation":840},{"text":847,"config":848},"Code Suggestions (AI)",{"href":849,"dataGaName":847,"dataGaLocation":840},"/solutions/code-suggestions/",{"text":558,"config":851},{"href":560,"dataGaName":558,"dataGaLocation":840},{"text":853,"config":854},"GitLab on AWS",{"href":855,"dataGaName":853,"dataGaLocation":840},"/partners/technology-partners/aws/",{"text":857,"config":858},"GitLab on Google Cloud",{"href":859,"dataGaName":857,"dataGaLocation":840},"/partners/technology-partners/google-cloud-platform/",{"text":861,"config":862},"Why GitLab?",{"href":535,"dataGaName":861,"dataGaLocation":840},{"freeTrial":864,"mobileIcon":869,"desktopIcon":874,"secondaryButton":877},{"text":865,"config":866},"Start free trial",{"href":867,"dataGaName":496,"dataGaLocation":868},"https://gitlab.com/-/trials/new/","nav",{"altText":870,"config":871},"Gitlab Icon",{"src":872,"dataGaName":873,"dataGaLocation":868},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":870,"config":875},{"src":876,"dataGaName":873,"dataGaLocation":868},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":878,"config":879},"Get Started",{"href":880,"dataGaName":881,"dataGaLocation":868},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":883,"mobileIcon":887,"desktopIcon":889},{"text":884,"config":885},"Learn more about GitLab Duo",{"href":527,"dataGaName":886,"dataGaLocation":868},"gitlab duo",{"altText":870,"config":888},{"src":872,"dataGaName":873,"dataGaLocation":868},{"altText":870,"config":890},{"src":876,"dataGaName":873,"dataGaLocation":868},{"button":892,"mobileIcon":897,"desktopIcon":899},{"text":893,"config":894},"/switch",{"href":895,"dataGaName":896,"dataGaLocation":868},"#contact","switch",{"altText":870,"config":898},{"src":872,"dataGaName":873,"dataGaLocation":868},{"altText":870,"config":900},{"src":901,"dataGaName":873,"dataGaLocation":868},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":903,"mobileIcon":908,"desktopIcon":910},{"text":904,"config":905},"Back to pricing",{"href":640,"dataGaName":906,"dataGaLocation":868,"icon":907},"back to pricing","GoBack",{"altText":870,"config":909},{"src":872,"dataGaName":873,"dataGaLocation":868},{"altText":870,"config":911},{"src":876,"dataGaName":873,"dataGaLocation":868},{"title":913,"titleMobile":914,"button":915,"config":920},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":533,"config":916},{"href":917,"dataGaName":918,"dataGaLocation":919},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":921,"disabled":470},"release",{"data":923},{"text":924,"source":925,"edit":931,"contribute":936,"config":941,"items":946,"minimal":1155},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":926,"config":927},"View page source",{"href":928,"dataGaName":929,"dataGaLocation":930},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":932,"config":933},"Edit this page",{"href":934,"dataGaName":935,"dataGaLocation":930},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":937,"config":938},"Please contribute",{"href":939,"dataGaName":940,"dataGaLocation":930},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":942,"facebook":943,"youtube":944,"linkedin":945},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[947,993,1047,1091,1123],{"title":638,"links":948,"subMenu":963},[949,953,958],{"text":950,"config":951},"View plans",{"href":640,"dataGaName":952,"dataGaLocation":930},"view plans",{"text":954,"config":955},"Why Premium?",{"href":956,"dataGaName":957,"dataGaLocation":930},"/pricing/premium/","why premium",{"text":959,"config":960},"Why Ultimate?",{"href":961,"dataGaName":962,"dataGaLocation":930},"/pricing/ultimate/","why ultimate",[964],{"title":965,"links":966},"Contact Us",[967,970,972,974,978,983,988],{"text":968,"config":969},"Contact sales",{"href":820,"dataGaName":501,"dataGaLocation":930},{"text":823,"config":971},{"href":825,"dataGaName":826,"dataGaLocation":930},{"text":828,"config":973},{"href":830,"dataGaName":831,"dataGaLocation":930},{"text":219,"config":975},{"href":976,"dataGaName":977,"dataGaLocation":930},"https://status.gitlab.com/","status",{"text":979,"config":980},"Terms of use",{"href":981,"dataGaName":982,"dataGaLocation":930},"/terms/","terms of use",{"text":984,"config":985},"Privacy statement",{"href":986,"dataGaName":987,"dataGaLocation":930},"/privacy/","privacy statement",{"text":989,"config":990},"Cookie preferences",{"dataGaName":991,"dataGaLocation":930,"id":992,"isOneTrustButton":383},"cookie preferences","ot-sdk-btn",{"title":538,"links":994,"subMenu":1003},[995,999],{"text":996,"config":997},"DevSecOps platform",{"href":520,"dataGaName":998,"dataGaLocation":930},"devsecops platform",{"text":1000,"config":1001},"AI-Assisted Development",{"href":527,"dataGaName":1002,"dataGaLocation":930},"ai-assisted development",[1004],{"title":1005,"links":1006},"Topics",[1007,1012,1017,1022,1027,1032,1037,1042],{"text":1008,"config":1009},"CICD",{"href":1010,"dataGaName":1011,"dataGaLocation":930},"/topics/ci-cd/","cicd",{"text":1013,"config":1014},"GitOps",{"href":1015,"dataGaName":1016,"dataGaLocation":930},"/topics/gitops/","gitops",{"text":1018,"config":1019},"DevOps",{"href":1020,"dataGaName":1021,"dataGaLocation":930},"/topics/devops/","devops",{"text":1023,"config":1024},"Version Control",{"href":1025,"dataGaName":1026,"dataGaLocation":930},"/topics/version-control/","version control",{"text":1028,"config":1029},"DevSecOps",{"href":1030,"dataGaName":1031,"dataGaLocation":930},"/topics/devsecops/","devsecops",{"text":1033,"config":1034},"Cloud Native",{"href":1035,"dataGaName":1036,"dataGaLocation":930},"/topics/cloud-native/","cloud native",{"text":1038,"config":1039},"AI for Coding",{"href":1040,"dataGaName":1041,"dataGaLocation":930},"/topics/devops/ai-for-coding/","ai for coding",{"text":1043,"config":1044},"Agentic AI",{"href":1045,"dataGaName":1046,"dataGaLocation":930},"/topics/agentic-ai/","agentic ai",{"title":1048,"links":1049},"Solutions",[1050,1052,1054,1059,1063,1066,1070,1073,1075,1078,1081,1086],{"text":582,"config":1051},{"href":577,"dataGaName":582,"dataGaLocation":930},{"text":571,"config":1053},{"href":554,"dataGaName":555,"dataGaLocation":930},{"text":1055,"config":1056},"Agile development",{"href":1057,"dataGaName":1058,"dataGaLocation":930},"/solutions/agile-delivery/","agile delivery",{"text":1060,"config":1061},"SCM",{"href":567,"dataGaName":1062,"dataGaLocation":930},"source code management",{"text":1008,"config":1064},{"href":560,"dataGaName":1065,"dataGaLocation":930},"continuous integration & delivery",{"text":1067,"config":1068},"Value stream management",{"href":610,"dataGaName":1069,"dataGaLocation":930},"value stream management",{"text":1013,"config":1071},{"href":1072,"dataGaName":1016,"dataGaLocation":930},"/solutions/gitops/",{"text":620,"config":1074},{"href":623,"dataGaName":624,"dataGaLocation":930},{"text":1076,"config":1077},"Small business",{"href":629,"dataGaName":630,"dataGaLocation":930},{"text":1079,"config":1080},"Public sector",{"href":635,"dataGaName":636,"dataGaLocation":930},{"text":1082,"config":1083},"Education",{"href":1084,"dataGaName":1085,"dataGaLocation":930},"/solutions/education/","education",{"text":1087,"config":1088},"Financial services",{"href":1089,"dataGaName":1090,"dataGaLocation":930},"/solutions/finance/","financial services",{"title":643,"links":1092},[1093,1095,1097,1099,1102,1104,1107,1109,1111,1113,1115,1117,1119,1121],{"text":656,"config":1094},{"href":658,"dataGaName":659,"dataGaLocation":930},{"text":661,"config":1096},{"href":663,"dataGaName":664,"dataGaLocation":930},{"text":666,"config":1098},{"href":668,"dataGaName":669,"dataGaLocation":930},{"text":671,"config":1100},{"href":673,"dataGaName":1101,"dataGaLocation":930},"docs",{"text":693,"config":1103},{"href":695,"dataGaName":696,"dataGaLocation":930},{"text":1105,"config":1106},"What's new",{"href":752,"dataGaName":753,"dataGaLocation":930},{"text":688,"config":1108},{"href":690,"dataGaName":691,"dataGaLocation":930},{"text":707,"config":1110},{"href":709,"dataGaName":710,"dataGaLocation":930},{"text":715,"config":1112},{"href":717,"dataGaName":718,"dataGaLocation":930},{"text":720,"config":1114},{"href":722,"dataGaName":723,"dataGaLocation":930},{"text":725,"config":1116},{"href":727,"dataGaName":728,"dataGaLocation":930},{"text":730,"config":1118},{"href":732,"dataGaName":733,"dataGaLocation":930},{"text":735,"config":1120},{"href":737,"dataGaName":738,"dataGaLocation":930},{"text":740,"config":1122},{"href":742,"dataGaName":482,"dataGaLocation":930},{"title":755,"links":1124},[1125,1127,1129,1131,1133,1135,1139,1144,1146,1148,1150],{"text":763,"config":1126},{"href":765,"dataGaName":757,"dataGaLocation":930},{"text":768,"config":1128},{"href":770,"dataGaName":771,"dataGaLocation":930},{"text":776,"config":1130},{"href":778,"dataGaName":779,"dataGaLocation":930},{"text":781,"config":1132},{"href":783,"dataGaName":784,"dataGaLocation":930},{"text":786,"config":1134},{"href":788,"dataGaName":789,"dataGaLocation":930},{"text":1136,"config":1137},"Sustainability",{"href":1138,"dataGaName":1136,"dataGaLocation":930},"/sustainability/",{"text":1140,"config":1141},"Diversity, inclusion and belonging (DIB)",{"href":1142,"dataGaName":1143,"dataGaLocation":930},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":791,"config":1145},{"href":793,"dataGaName":794,"dataGaLocation":930},{"text":801,"config":1147},{"href":803,"dataGaName":804,"dataGaLocation":930},{"text":806,"config":1149},{"href":808,"dataGaName":809,"dataGaLocation":930},{"text":1151,"config":1152},"Modern Slavery Transparency Statement",{"href":1153,"dataGaName":1154,"dataGaLocation":930},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1156},[1157,1160,1163],{"text":1158,"config":1159},"Terms",{"href":981,"dataGaName":982,"dataGaLocation":930},{"text":1161,"config":1162},"Cookies",{"dataGaName":991,"dataGaLocation":930,"id":992,"isOneTrustButton":383},{"text":1164,"config":1165},"Privacy",{"href":986,"dataGaName":987,"dataGaLocation":930},[1167],{"id":1168,"title":7,"body":469,"config":1169,"content":1171,"description":469,"extension":1175,"meta":1176,"navigation":383,"path":1177,"seo":1178,"stem":1179,"__hash__":1180},"blogAuthors/en-us/blog/authors/fernando-diaz.yml",{"template":1170},"BlogAuthor",{"name":7,"config":1172},{"headshot":1173,"ctfId":1174},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659556/Blog/Author%20Headshots/fern_diaz.png","fjdiaz","yml",{},"/en-us/blog/authors/fernando-diaz",{},"en-us/blog/authors/fernando-diaz","lxRJIOydP4_yzYZvsPcuQevP9AYAKREF7i8QmmdnOWc",[1182,1190,1198],{"title":1183,"description":1184,"heroImage":1185,"category":465,"date":1186,"authors":1187,"slug":1189,"externalUrl":469},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1188],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1191,"description":1192,"heroImage":1185,"category":465,"date":1193,"authors":1194,"slug":1197,"externalUrl":469},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1195,1196],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1199,"description":1200,"heroImage":1201,"category":465,"date":1202,"authors":1203,"slug":1205,"externalUrl":469},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1204],"Alisa Ho","claude-security-and-gitlab",{"promotions":1207},[1208,1222,1234,1245],{"id":1209,"categories":1210,"header":1212,"text":1213,"button":1214,"image":1219},"ai-modernization",[1211],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1215,"config":1216},"Get your AI maturity score",{"href":1217,"dataGaName":1218,"dataGaLocation":696},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1220},{"src":1221},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1223,"categories":1224,"header":1226,"text":1213,"button":1227,"image":1231},"devops-modernization",[1225,1031],"product","Are you just managing tools or shipping innovation?",{"text":1228,"config":1229},"Get your DevOps maturity score",{"href":1230,"dataGaName":1218,"dataGaLocation":696},"/assessments/devops-modernization-assessment/",{"config":1232},{"src":1233},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1235,"categories":1236,"header":1237,"text":1213,"button":1238,"image":1242},"security-modernization",[465],"Are you trading speed for security?",{"text":1239,"config":1240},"Get your security maturity score",{"href":1241,"dataGaName":1218,"dataGaLocation":696},"/assessments/security-modernization-assessment/",{"config":1243},{"src":1244},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1246,"paths":1247,"header":1250,"text":1251,"button":1252,"image":1257},"github-azure-migration",[1248,1249],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1253,"config":1254},"See how GitLab compares to GitHub",{"href":1255,"dataGaName":1256,"dataGaLocation":696},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1258},{"src":1233},{"header":1260,"blurb":1261,"button":1262,"secondaryButton":1267},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1263,"config":1264},"Get your free trial",{"href":1265,"dataGaName":496,"dataGaLocation":1266},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":968,"config":1268},{"href":820,"dataGaName":501,"dataGaLocation":1266},1786803749317]