[{"data":1,"prerenderedAt":1411},["ShallowReactive",2],{"/blog/getting-started-with-gitlab-application-security":3,"navigation-en-us":613,"banner-en-us":1041,"footer-en-us":1051,"blog-post-authors-en-us-Victor Hernandez|Julie Byrne":1295,"blog-related-posts-en-us-getting-started-with-gitlab-application-security":1322,"blog-promotions-en-us":1348,"next-steps-en-us":1401},{"id":4,"title":5,"authors":6,"body":9,"category":591,"date":592,"description":593,"extension":594,"externalUrl":595,"faq":595,"featured":596,"heroImage":597,"meta":598,"navigation":343,"path":599,"seo":600,"slug":604,"stem":605,"tags":606,"template":611,"updatedDate":595,"__hash__":612},"blogPosts/en-us/blog/getting-started-with-gitlab-application-security.md","Getting started with GitLab application security",[7,8],"Victor Hernandez","Julie Byrne",{"type":10,"value":11,"toc":581},"minimark",[12,16,19,22,27,30,48,52,55,60,63,263,266,269,273,281,296,303,312,402,414,421,432,442,450,453,458,462,465,470,473,478,491,497,503,508,514,518,521,538,547,551,577],[13,14,15],"p",{},"As software security becomes increasingly important, many companies want to\nintroduce standard code scanning processes into development workflows to\nfind and remediate security vulnerabilities before they get to production.",[13,17,18],{},"GitLab's DevSecOps Platform allows users to perform security scans in CI/CD pipelines, which can easily be enabled to check applications for security vulnerabilities such as unauthorized access, data leaks, and denial of service (DoS) attacks.",[13,20,21],{},"While most of what is covered in this blog will pertain to Ultimate features, there are some features available for free and\nPremium tier users as well. By the end of this blog, you will have a solid starting point for adopting GitLab security scans, with any tier license, and understand the steps to take next to mature your DevSecOps practices.",[23,24,26],"h2",{"id":25},"prerequisites","Prerequisites",[13,28,29],{},"To enable security scanning for a project, you must have the following:",[31,32,33,37,45],"ul",{},[34,35,36],"li",{},"a GitLab project that meets the requirements of the security scan you\nchoose to enable, with CI enabled",[34,38,39,40,44],{},"a ",[41,42,43],"code",{},".gitlab-ci.yml"," file for the project that has at least a build job\ndefined",[34,46,47],{},"a Linux-based GitLab Runner with the Docker or Kubernetes executor",[23,49,51],{"id":50},"get-started-add-a-scan-template-to-your-pipeline","Get started: Add a scan template to your pipeline",[13,53,54],{},"Here are the first steps to introduce security scanning.",[56,57,59],"h3",{"id":58},"available-security-scans","Available security scans",[13,61,62],{},"GitLab provides a variety of security scanners, each with its own set of criteria for adoption:",[64,65,66,84],"table",{},[67,68,69],"thead",{},[70,71,72,76,79,81],"tr",{},[73,74,75],"th",{},"Scan type",[73,77,78],{},"Minimum tier",[73,80,26],{},[73,82,83],{},"Application requirements",[85,86,87,112,127,154,174,197,222,243],"tbody",{},[70,88,89,98,101,104],{},[90,91,92],"td",{},[93,94,97],"a",{"href":95,"rel":96},"https://docs.gitlab.com/user/application_security/sast/",[],"Static application security testing (SAST)",[90,99,100],{},"Free",[90,102,103],{},"None",[90,105,106,107],{},"See ",[93,108,111],{"href":109,"rel":110},"https://docs.gitlab.com/user/application_security/sast/#requirements",[],"SAST requirements",[70,113,114,121,123,125],{},[90,115,116],{},[93,117,120],{"href":118,"rel":119},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"Secret detection",[90,122,100],{},[90,124,103],{},[90,126,103],{},[70,128,129,136,138,141],{},[90,130,131],{},[93,132,135],{"href":133,"rel":134},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"Container scanning",[90,137,100],{},[90,139,140],{},"Container image built and pushed to registry",[90,142,143,148,149],{},[93,144,147],{"href":145,"rel":146},"https://docs.gitlab.com/user/application_security/container_scanning/#requirements",[],"Docker 18.09.03 or higher installed on the same computer as the runner","; image uses a ",[93,150,153],{"href":151,"rel":152},"https://docs.gitlab.com/user/application_security/container_scanning/#supported-distributions",[],"supported distribution",[70,155,156,163,165,167],{},[90,157,158],{},[93,159,162],{"href":160,"rel":161},"https://docs.gitlab.com/user/application_security/iac_scanning/",[],"Infrastructure as code (IaC) scanning",[90,164,100],{},[90,166,103],{},[90,168,106,169],{},[93,170,173],{"href":171,"rel":172},"https://docs.gitlab.com/user/application_security/iac_scanning/#supported-languages-and-frameworks",[],"supported languages and frameworks",[70,175,176,184,187,189],{},[90,177,178,183],{},[93,179,182],{"href":180,"rel":181},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency scanning"," - includes license compliance",[90,185,186],{},"Ultimate",[90,188,103],{},[90,190,191,192],{},"Application must use one of the ",[93,193,196],{"href":194,"rel":195},"https://docs.gitlab.com/user/application_security/dependency_scanning/#supported-languages-and-package-managers",[],"supported languages and package managers",[70,198,199,206,208,215],{},[90,200,201],{},[93,202,205],{"href":203,"rel":204},"https://docs.gitlab.com/user/application_security/dast/",[],"Dynamic application security testing (DAST)",[90,207,186],{},[90,209,210],{},[93,211,214],{"href":212,"rel":213},"https://docs.gitlab.com/user/application_security/dast/#prerequisites",[],"Deployed target application",[90,216,106,217],{},[93,218,221],{"href":219,"rel":220},"https://docs.gitlab.com/user/application_security/dast/#gitlab-dast",[],"GitLab DAST scanning options",[70,223,224,231,233,236],{},[90,225,226],{},[93,227,230],{"href":228,"rel":229},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/",[],"Coverage-guided fuzz testing",[90,232,186],{},[90,234,235],{},"Instrumented version of application",[90,237,106,238],{},[93,239,242],{"href":240,"rel":241},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/#supported-fuzzing-engines-and-languages",[],"supported fuzzing engines and languages",[70,244,245,252,254,256],{},[90,246,247],{},[93,248,251],{"href":249,"rel":250},"https://docs.gitlab.com/user/application_security/api_fuzzing/",[],"Web API fuzz testing",[90,253,186],{},[90,255,214],{},[90,257,106,258],{},[93,259,262],{"href":260,"rel":261},"https://docs.gitlab.com/user/application_security/api_fuzzing/#enable-web-api-fuzzing",[],"supported API types",[13,264,265],{},"Many customers will start with secret detection, dependency scanning, or",[13,267,268],{},"SAST scanning, as they have the fewest requirements for usage.",[56,270,272],{"id":271},"add-the-scanner-template","Add the scanner template",[13,274,275,276],{},"GitLab provides a ",[93,277,280],{"href":278,"rel":279},"https://docs.gitlab.com/user/application_security/#security-scanning-without-auto-devops",[],"CI template for each security scan",[13,282,283,284,286,287,292,293,295],{},"that can be added to your existing ",[41,285,43],{}," file. This can be done by manually editing the CI file and adding the appropriate template path in the templates section of the file. Several scanners can also be ",[93,288,291],{"href":289,"rel":290},"https://docs.gitlab.com/user/application_security/sast/#configure-sast-in-the-ui",[],"enabled via the UI",", where a merge request will be created to add the appropriate scanner to the ",[41,294,43],{}," file.",[13,297,298,299,302],{},"I will use a simple spring boot application as an example and enable dependency scanning, a scanner that is popular amongst our customers, as my first security scan. Dependency scanning will find vulnerabilities in the libraries I am using to build my application. My project is a Java application built via Maven and includes a ",[41,300,301],{},"pom.xml"," file, so it meets the requirements for dependency scanning. Since dependency scanning can be enabled via the UI, I'm going to take advantage of that feature here.",[13,304,305,306,308,309,311],{},"For this project, I have created a ",[41,307,43],{}," file that contains a build and test stage and a build job. I'm using the Auto DevOps auto-build job, but you can define your own build job if desired. This is the starting pipeline code in my ",[41,310,43],{}," file:",[313,314,319],"pre",{"className":315,"code":316,"language":317,"meta":318,"style":318},"language-yaml shiki shiki-themes github-light","image: alpine:latest\n\ninclude:\n  - template: Jobs/Build.gitlab-ci.yml  # https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib/gitlab/ci/templates/Jobs/Build.gitlab-ci.yml\n\nstages:\n- build\n- test\n","yaml","",[41,320,321,338,345,354,372,377,385,394],{"__ignoreMap":318},[322,323,326,330,334],"span",{"class":324,"line":325},"line",1,[322,327,329],{"class":328},"shJU0","image",[322,331,333],{"class":332},"sgsFI",": ",[322,335,337],{"class":336},"sYBdl","alpine:latest\n",[322,339,341],{"class":324,"line":340},2,[322,342,344],{"emptyLinePlaceholder":343},true,"\n",[322,346,348,351],{"class":324,"line":347},3,[322,349,350],{"class":328},"include",[322,352,353],{"class":332},":\n",[322,355,357,360,363,365,368],{"class":324,"line":356},4,[322,358,359],{"class":332},"  - ",[322,361,362],{"class":328},"template",[322,364,333],{"class":332},[322,366,367],{"class":336},"Jobs/Build.gitlab-ci.yml",[322,369,371],{"class":370},"sAwPA","  # https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib/gitlab/ci/templates/Jobs/Build.gitlab-ci.yml\n",[322,373,375],{"class":324,"line":374},5,[322,376,344],{"emptyLinePlaceholder":343},[322,378,380,383],{"class":324,"line":379},6,[322,381,382],{"class":328},"stages",[322,384,353],{"class":332},[322,386,388,391],{"class":324,"line":387},7,[322,389,390],{"class":332},"- ",[322,392,393],{"class":336},"build\n",[322,395,397,399],{"class":324,"line":396},8,[322,398,390],{"class":332},[322,400,401],{"class":336},"test\n",[13,403,404,405,409,410,413],{},"To enable dependency scanning, I'll first navigate to the ",[406,407,408],"strong",{},"Security &\nCompliance"," menu, ",[406,411,412],{},"Configuration"," sub-menu.",[13,415,416],{},[417,418],"img",{"alt":419,"src":420},"web identity","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397763/blog/Content%20Images/2023-02-26-getting-started-with-gitlab-application-security/security_config.png",[13,422,423,424,427,428,431],{},"The option to enable dependency scanning is available about halfway down the page. When I click ",[41,425,426],{},"Configure with a merge request",", a branch is created and\nI am prompted to create a corresponding draft merge request. I'll click ",[41,429,430],{},"Create Merge Request"," to save the merge request.",[13,433,434,435,438,439,441],{},"Once the merge request has been created, I see that a new branch ",[41,436,437],{},"set-dependency-scanning-config-1"," has been created and the ",[41,440,43],{}," file has been updated with this code:",[313,443,448],{"className":444,"code":446,"language":447,"meta":318},[445],"language-text","# You can override the included template(s) by including variable overrides\n# SAST customization:\nhttps://docs.gitlab.com/user/application_security/sast/#customizing-the-sast-settings\n# Secret Detection customization:\nhttps://docs.gitlab.com/user/application_security/secret_detection/#customizing-settings\n\n# Dependency Scanning customization:\nhttps://docs.gitlab.com/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings\n\n# Container Scanning customization:\nhttps://docs.gitlab.com/user/application_security/container_scanning/#customizing-the-container-scanning-settings\n\n# Note that environment variables can be set in several places\n\n# See https://docs.gitlab.com/ci/variables/#cicd-variable-precedence\nimage: alpine:latest\ninclude:\n- template: Jobs/Build.gitlab-ci.yml\n- template: Security/Dependency-Scanning.gitlab-ci.yml\nstages:\n- build\n- test\n\n","text",[41,449,446],{"__ignoreMap":318},[13,451,452],{},"The change kicks off a pipeline, which will now include the dependency scan.",[13,454,455],{},[417,456],{"alt":419,"src":457},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397762/blog/Content%20Images/2023-02-26-getting-started-with-gitlab-application-security/dependency_job.png",[23,459,461],{"id":460},"view-results-of-the-security-scan","View results of the security scan",[13,463,464],{},"For all license tiers, you can view the results of any security scan jobs in the appropriate JSON report that can be downloaded from the merge request.",[13,466,467],{},[417,468],{"alt":419,"src":469},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397762/blog/Content%20Images/2023-02-26-getting-started-with-gitlab-application-security/mr_artifacts.png",[13,471,472],{},"With GitLab Ultimate, you will also see the vulnerabilities found by the scan in the merge request widget.",[13,474,475],{},[417,476],{"alt":419,"src":477},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397763/blog/Content%20Images/2023-02-26-getting-started-with-gitlab-application-security/mr_widget.png",[13,479,480,481,483,484,486,487,490],{},"At this point, the ",[41,482,43],{}," changes that enable security scanning are only available in the ",[41,485,437],{}," branch. I will merge them to ",[41,488,489],{},"main"," so that the changes will be included in all future feature branches.",[13,492,493,494,496],{},"With GitLab Ultimate, merging to ",[41,495,489],{}," will also provide the baseline",[13,498,499,502],{},[406,500,501],{},"Vulnerability Report"," for our application.",[13,504,505],{},[417,506],{"alt":419,"src":507},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397763/blog/Content%20Images/2023-02-26-getting-started-with-gitlab-application-security/vuln_report.png",[13,509,510,511,513],{},"Now, scan results presented in the merge request widget for any new merge requests will only show vulnerabilities introduced by those new code changes in the corresponding feature branch, and not the baseline of vulnerabilities that already exist on ",[41,512,489],{},".",[23,515,517],{"id":516},"scan-enforcement","Scan enforcement",[13,519,520],{},"Once you have enabled your first scans in your CI/CD pipelines, you might be curious to know how you can enforce security scans, or enforce a review and approval when critical vulnerabilities are found in new code changes. I recommend reviewing these resources that cover these topics.",[31,522,523,530],{},[34,524,525,526],{},"For Ultimate customers: ",[93,527,529],{"href":528},"/blog/ensuring-compliance/","How to ensure separation of duties and enforce compliance with GitLab",[34,531,532,533],{},"For Premium customers: ",[93,534,537],{"href":535,"rel":536},"https://about.gitlab.com/solutions/application-security-testing/",[],"How to action security vulnerabilities in GitLab Premium",[13,539,540,541,546],{},"Now that you've gained comfort with security scanners as part of the GitLab\nCI/CD pipeline, check out our ",[93,542,545],{"href":543,"rel":544},"https://docs.gitlab.com/user/application_security/get-started-security/",[],"Getting Started with GitLab Application Security","\ndocumentation for recommended next steps.",[23,548,550],{"id":549},"more-resources","More resources",[31,552,553,559,565,571],{},[34,554,555],{},[93,556,558],{"href":557},"/blog/secure-stage-for-appsec/","How GitLab's application security dashboard helps AppSec engineers",[34,560,561],{},[93,562,564],{"href":563},"/blog/offline-environments/","Running security scans in limited connectivity and offline environments",[34,566,567],{},[93,568,570],{"href":569},"/blog/gitlabs-newest-continuous-compliance-features-bolster-software/","GitLab's newest continuous compliance features bolster software supply chain security",[34,572,573],{},[93,574,576],{"href":575},"/blog/how-to-scan-a-full-commit-history-to-detect-sensitive-secrets/","How to scan a full commit history to detect sensitive secrets",[578,579,580],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":318,"searchDepth":340,"depth":340,"links":582},[583,584,588,589,590],{"id":25,"depth":340,"text":26},{"id":50,"depth":340,"text":51,"children":585},[586,587],{"id":58,"depth":347,"text":59},{"id":271,"depth":347,"text":272},{"id":460,"depth":340,"text":461},{"id":516,"depth":340,"text":517},{"id":549,"depth":340,"text":550},"engineering","2023-03-15","This tutorial shows how to incorporate GitLab security scan templates into a .gitlab-ci.yml file and view scan results.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749663993/Blog/Hero%20Images/2018-developer-report-cover.jpg",{},"/en-us/blog/getting-started-with-gitlab-application-security",{"ogTitle":5,"ogImage":597,"ogDescription":593,"ogSiteName":601,"noIndex":596,"ogType":602,"ogUrl":603,"title":5,"canonicalUrls":603,"description":593},"https://about.gitlab.com","article","https://about.gitlab.com/blog/getting-started-with-gitlab-application-security","getting-started-with-gitlab-application-security","en-us/blog/getting-started-with-gitlab-application-security",[607,608,609,610],"DevSecOps","CI","CD","security","BlogPost","JCZbXFJg0dFp8hdCcpcJ6GsKTpRlC1MOop4RwvkfOEk",{"logo":614,"freeTrial":619,"sales":624,"login":629,"items":634,"search":961,"minimal":992,"duo":1011,"switchNav":1020,"pricingDeployment":1031},{"config":615},{"href":616,"dataGaName":617,"dataGaLocation":618},"/","gitlab logo","header",{"text":620,"config":621},"Get free trial",{"href":622,"dataGaName":623,"dataGaLocation":618},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":625,"config":626},"Request a demo",{"href":627,"dataGaName":628,"dataGaLocation":618},"/sales/?contact-topic=request-demo","sales",{"text":630,"config":631},"Sign in",{"href":632,"dataGaName":633,"dataGaLocation":618},"https://gitlab.com/users/sign_in/","sign in",[635,664,764,769,883,939],{"text":636,"config":637,"menu":639},"Platform",{"dataNavLevelOne":638},"platform",{"type":640,"columns":641},"cards",[642,648,656],{"title":636,"description":643,"link":644},"The intelligent orchestration platform for DevSecOps",{"text":645,"config":646},"Explore our Platform",{"href":647,"dataGaName":638,"dataGaLocation":618},"/platform/",{"title":649,"description":650,"link":651},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":652,"config":653},"Meet GitLab Duo",{"href":654,"dataGaName":655,"dataGaLocation":618},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":657,"description":658,"link":659},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":660,"config":661},"Learn more",{"href":662,"dataGaName":663,"dataGaLocation":618},"/why-gitlab/","why gitlab",{"text":665,"left":343,"config":666,"menu":668},"Product",{"dataNavLevelOne":667},"solutions",{"type":669,"link":670,"columns":674,"feature":743},"lists",{"text":671,"config":672},"View all Solutions",{"href":673,"dataGaName":667,"dataGaLocation":618},"/solutions/",[675,699,722],{"title":676,"description":677,"link":678,"items":683},"Automation","CI/CD and automation to accelerate deployment",{"config":679},{"icon":680,"href":681,"dataGaName":682,"dataGaLocation":618},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[684,688,691,695],{"text":685,"config":686},"CI/CD",{"href":687,"dataGaLocation":618,"dataGaName":685},"/solutions/continuous-integration/",{"text":649,"config":689},{"href":654,"dataGaLocation":618,"dataGaName":690},"gitlab duo agent platform - product menu",{"text":692,"config":693},"Source Code Management",{"href":694,"dataGaLocation":618,"dataGaName":692},"/solutions/source-code-management/",{"text":696,"config":697},"Automated Software Delivery",{"href":681,"dataGaLocation":618,"dataGaName":698},"Automated software delivery",{"title":700,"description":701,"link":702,"items":707},"Security","Deliver code faster without compromising security",{"config":703},{"href":704,"dataGaName":705,"dataGaLocation":618,"icon":706},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[708,712,717],{"text":709,"config":710},"Application Security Testing",{"href":704,"dataGaName":711,"dataGaLocation":618},"Application security testing",{"text":713,"config":714},"Software Supply Chain Security",{"href":715,"dataGaLocation":618,"dataGaName":716},"/solutions/supply-chain/","Software supply chain security",{"text":718,"config":719},"Software Compliance",{"href":720,"dataGaName":721,"dataGaLocation":618},"/solutions/software-compliance/","software compliance",{"title":723,"link":724,"items":729},"Measurement",{"config":725},{"icon":726,"href":727,"dataGaName":728,"dataGaLocation":618},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[730,734,738],{"text":731,"config":732},"Visibility & Measurement",{"href":727,"dataGaLocation":618,"dataGaName":733},"Visibility and Measurement",{"text":735,"config":736},"Value Stream Management",{"href":737,"dataGaLocation":618,"dataGaName":735},"/solutions/value-stream-management/",{"text":739,"config":740},"Analytics & Insights",{"href":741,"dataGaLocation":618,"dataGaName":742},"/solutions/analytics-and-insights/","Analytics and insights",{"title":744,"type":669,"items":745},"GitLab for",[746,752,758],{"text":747,"config":748},"Enterprise",{"icon":749,"href":750,"dataGaLocation":618,"dataGaName":751},"Building","/enterprise/","enterprise",{"text":753,"config":754},"Small Business",{"icon":755,"href":756,"dataGaLocation":618,"dataGaName":757},"Work","/small-business/","small business",{"text":759,"config":760},"Public Sector",{"icon":761,"href":762,"dataGaLocation":618,"dataGaName":763},"Organization","/solutions/public-sector/","public sector",{"text":765,"config":766},"Pricing",{"href":767,"dataGaName":768,"dataGaLocation":618,"dataNavLevelOne":768},"/pricing/","pricing",{"text":770,"config":771,"menu":773},"Resources",{"dataNavLevelOne":772},"resources",{"type":669,"link":774,"columns":778,"feature":872},{"text":775,"config":776},"View all resources",{"href":777,"dataGaName":772,"dataGaLocation":618},"/resources/",[779,812,839],{"title":780,"items":781},"Getting started",[782,787,792,797,802,807],{"text":783,"config":784},"Install",{"href":785,"dataGaName":786,"dataGaLocation":618},"/install/","install",{"text":788,"config":789},"Quick start guides",{"href":790,"dataGaName":791,"dataGaLocation":618},"/get-started/","quick setup checklists",{"text":793,"config":794},"Learn",{"href":795,"dataGaLocation":618,"dataGaName":796},"https://university.gitlab.com/","learn",{"text":798,"config":799},"Product documentation",{"href":800,"dataGaName":801,"dataGaLocation":618},"https://docs.gitlab.com/","product documentation",{"text":803,"config":804},"Best practice videos",{"href":805,"dataGaName":806,"dataGaLocation":618},"/getting-started-videos/","best practice videos",{"text":808,"config":809},"Integrations",{"href":810,"dataGaName":811,"dataGaLocation":618},"/integrations/","integrations",{"title":813,"items":814},"Discover",[815,820,825,830,834],{"text":816,"config":817},"Customer success stories",{"href":818,"dataGaName":819,"dataGaLocation":618},"/customers/","customer success stories",{"text":821,"config":822},"Blog",{"href":823,"dataGaName":824,"dataGaLocation":618},"/blog/","blog",{"text":826,"config":827},"Demo Hub",{"href":828,"dataGaName":829,"dataGaLocation":618},"/demo-hub/","demo hub",{"text":831,"config":832},"The Source",{"href":833,"dataGaName":824,"dataGaLocation":618},"/the-source/",{"text":835,"config":836},"Remote",{"href":837,"dataGaName":838,"dataGaLocation":618},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":840,"items":841},"Connect",[842,847,852,857,862,867],{"text":843,"config":844},"GitLab Services",{"href":845,"dataGaName":846,"dataGaLocation":618},"/services/","services",{"text":848,"config":849},"Contribute",{"href":850,"dataGaName":851,"dataGaLocation":618},"https://contributors.gitlab.com","contribute",{"text":853,"config":854},"Community",{"href":855,"dataGaName":856,"dataGaLocation":618},"/community/","community",{"text":858,"config":859},"Forum",{"href":860,"dataGaName":861,"dataGaLocation":618},"https://forum.gitlab.com/","forum",{"text":863,"config":864},"Events",{"href":865,"dataGaName":866,"dataGaLocation":618},"/events/","events",{"text":868,"config":869},"Partners",{"href":870,"dataGaName":871,"dataGaLocation":618},"/partners/","partners",{"config":873,"title":876,"text":877,"link":878},{"background":874,"textColor":875},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":879,"config":880},"Read the latest",{"href":881,"dataGaName":882,"dataGaLocation":618},"/whats-new/","whats new",{"text":884,"config":885,"menu":887},"Company",{"dataNavLevelOne":886},"company",{"type":669,"columns":888},[889],{"items":890},[891,896,902,904,909,914,919,924,929,934],{"text":892,"config":893},"About",{"href":894,"dataGaName":895,"dataGaLocation":618},"/company/","about",{"text":897,"config":898,"footerGa":901},"Jobs",{"href":899,"dataGaName":900,"dataGaLocation":618},"/jobs/","jobs",{"dataGaName":900},{"text":863,"config":903},{"href":865,"dataGaName":866,"dataGaLocation":618},{"text":905,"config":906},"Leadership",{"href":907,"dataGaName":908,"dataGaLocation":618},"/company/team/e-group/","leadership",{"text":910,"config":911},"Handbook",{"href":912,"dataGaName":913,"dataGaLocation":618},"https://handbook.gitlab.com/","handbook",{"text":915,"config":916},"Investor relations",{"href":917,"dataGaName":918,"dataGaLocation":618},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":920,"config":921},"Trust Center",{"href":922,"dataGaName":923,"dataGaLocation":618},"/security/","trust center",{"text":925,"config":926},"AI Transparency Center",{"href":927,"dataGaName":928,"dataGaLocation":618},"/ai-transparency-center/","ai transparency center",{"text":930,"config":931},"Newsletter",{"href":932,"dataGaName":933,"dataGaLocation":618},"/company/contact/#contact-forms","newsletter",{"text":935,"config":936},"Press",{"href":937,"dataGaName":938,"dataGaLocation":618},"/press/","press",{"text":940,"config":941,"menu":942},"Contact us",{"dataNavLevelOne":886},{"type":669,"columns":943},[944],{"items":945},[946,951,956],{"text":947,"config":948},"Talk to sales",{"href":949,"dataGaName":950,"dataGaLocation":618},"/sales/","talk to sales",{"text":952,"config":953},"Support portal",{"href":954,"dataGaName":955,"dataGaLocation":618},"https://support.gitlab.com/hc/en-us","support portal",{"text":957,"config":958},"Customer portal",{"href":959,"dataGaName":960,"dataGaLocation":618},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":962,"login":963,"suggestions":970},"Close",{"text":964,"link":965},"To search repositories and projects, login to",{"text":966,"config":967},"gitlab.com",{"href":632,"dataGaName":968,"dataGaLocation":969},"search login","search",{"text":971,"default":972},"Suggestions",[973,975,979,981,985,989],{"text":649,"config":974},{"href":654,"dataGaName":649,"dataGaLocation":969},{"text":976,"config":977},"Code Suggestions (AI)",{"href":978,"dataGaName":976,"dataGaLocation":969},"/solutions/code-suggestions/",{"text":685,"config":980},{"href":687,"dataGaName":685,"dataGaLocation":969},{"text":982,"config":983},"GitLab on AWS",{"href":984,"dataGaName":982,"dataGaLocation":969},"/partners/technology-partners/aws/",{"text":986,"config":987},"GitLab on Google Cloud",{"href":988,"dataGaName":986,"dataGaLocation":969},"/partners/technology-partners/google-cloud-platform/",{"text":990,"config":991},"Why GitLab?",{"href":662,"dataGaName":990,"dataGaLocation":969},{"freeTrial":993,"mobileIcon":998,"desktopIcon":1003,"secondaryButton":1006},{"text":994,"config":995},"Start free trial",{"href":996,"dataGaName":623,"dataGaLocation":997},"https://gitlab.com/-/trials/new/","nav",{"altText":999,"config":1000},"Gitlab Icon",{"src":1001,"dataGaName":1002,"dataGaLocation":997},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":999,"config":1004},{"src":1005,"dataGaName":1002,"dataGaLocation":997},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1007,"config":1008},"Get Started",{"href":1009,"dataGaName":1010,"dataGaLocation":997},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1012,"mobileIcon":1016,"desktopIcon":1018},{"text":1013,"config":1014},"Learn more about GitLab Duo",{"href":654,"dataGaName":1015,"dataGaLocation":997},"gitlab duo",{"altText":999,"config":1017},{"src":1001,"dataGaName":1002,"dataGaLocation":997},{"altText":999,"config":1019},{"src":1005,"dataGaName":1002,"dataGaLocation":997},{"button":1021,"mobileIcon":1026,"desktopIcon":1028},{"text":1022,"config":1023},"/switch",{"href":1024,"dataGaName":1025,"dataGaLocation":997},"#contact","switch",{"altText":999,"config":1027},{"src":1001,"dataGaName":1002,"dataGaLocation":997},{"altText":999,"config":1029},{"src":1030,"dataGaName":1002,"dataGaLocation":997},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1032,"mobileIcon":1037,"desktopIcon":1039},{"text":1033,"config":1034},"Back to pricing",{"href":767,"dataGaName":1035,"dataGaLocation":997,"icon":1036},"back to pricing","GoBack",{"altText":999,"config":1038},{"src":1001,"dataGaName":1002,"dataGaLocation":997},{"altText":999,"config":1040},{"src":1005,"dataGaName":1002,"dataGaLocation":997},{"title":1042,"titleMobile":1043,"button":1044,"config":1049},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":660,"config":1045},{"href":1046,"dataGaName":1047,"dataGaLocation":1048},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1050,"disabled":596},"release",{"data":1052},{"text":1053,"source":1054,"edit":1060,"contribute":1065,"config":1070,"items":1075,"minimal":1284},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1055,"config":1056},"View page source",{"href":1057,"dataGaName":1058,"dataGaLocation":1059},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1061,"config":1062},"Edit this page",{"href":1063,"dataGaName":1064,"dataGaLocation":1059},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1066,"config":1067},"Please contribute",{"href":1068,"dataGaName":1069,"dataGaLocation":1059},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1071,"facebook":1072,"youtube":1073,"linkedin":1074},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1076,1123,1176,1220,1252],{"title":765,"links":1077,"subMenu":1092},[1078,1082,1087],{"text":1079,"config":1080},"View plans",{"href":767,"dataGaName":1081,"dataGaLocation":1059},"view plans",{"text":1083,"config":1084},"Why Premium?",{"href":1085,"dataGaName":1086,"dataGaLocation":1059},"/pricing/premium/","why premium",{"text":1088,"config":1089},"Why Ultimate?",{"href":1090,"dataGaName":1091,"dataGaLocation":1059},"/pricing/ultimate/","why ultimate",[1093],{"title":1094,"links":1095},"Contact Us",[1096,1099,1101,1103,1108,1113,1118],{"text":1097,"config":1098},"Contact sales",{"href":949,"dataGaName":628,"dataGaLocation":1059},{"text":952,"config":1100},{"href":954,"dataGaName":955,"dataGaLocation":1059},{"text":957,"config":1102},{"href":959,"dataGaName":960,"dataGaLocation":1059},{"text":1104,"config":1105},"Status",{"href":1106,"dataGaName":1107,"dataGaLocation":1059},"https://status.gitlab.com/","status",{"text":1109,"config":1110},"Terms of use",{"href":1111,"dataGaName":1112,"dataGaLocation":1059},"/terms/","terms of use",{"text":1114,"config":1115},"Privacy statement",{"href":1116,"dataGaName":1117,"dataGaLocation":1059},"/privacy/","privacy statement",{"text":1119,"config":1120},"Cookie preferences",{"dataGaName":1121,"dataGaLocation":1059,"id":1122,"isOneTrustButton":343},"cookie preferences","ot-sdk-btn",{"title":665,"links":1124,"subMenu":1133},[1125,1129],{"text":1126,"config":1127},"DevSecOps platform",{"href":647,"dataGaName":1128,"dataGaLocation":1059},"devsecops platform",{"text":1130,"config":1131},"AI-Assisted Development",{"href":654,"dataGaName":1132,"dataGaLocation":1059},"ai-assisted development",[1134],{"title":1135,"links":1136},"Topics",[1137,1142,1147,1152,1157,1161,1166,1171],{"text":1138,"config":1139},"CICD",{"href":1140,"dataGaName":1141,"dataGaLocation":1059},"/topics/ci-cd/","cicd",{"text":1143,"config":1144},"GitOps",{"href":1145,"dataGaName":1146,"dataGaLocation":1059},"/topics/gitops/","gitops",{"text":1148,"config":1149},"DevOps",{"href":1150,"dataGaName":1151,"dataGaLocation":1059},"/topics/devops/","devops",{"text":1153,"config":1154},"Version Control",{"href":1155,"dataGaName":1156,"dataGaLocation":1059},"/topics/version-control/","version control",{"text":607,"config":1158},{"href":1159,"dataGaName":1160,"dataGaLocation":1059},"/topics/devsecops/","devsecops",{"text":1162,"config":1163},"Cloud Native",{"href":1164,"dataGaName":1165,"dataGaLocation":1059},"/topics/cloud-native/","cloud native",{"text":1167,"config":1168},"AI for Coding",{"href":1169,"dataGaName":1170,"dataGaLocation":1059},"/topics/devops/ai-for-coding/","ai for coding",{"text":1172,"config":1173},"Agentic AI",{"href":1174,"dataGaName":1175,"dataGaLocation":1059},"/topics/agentic-ai/","agentic ai",{"title":1177,"links":1178},"Solutions",[1179,1181,1183,1188,1192,1195,1199,1202,1204,1207,1210,1215],{"text":709,"config":1180},{"href":704,"dataGaName":709,"dataGaLocation":1059},{"text":698,"config":1182},{"href":681,"dataGaName":682,"dataGaLocation":1059},{"text":1184,"config":1185},"Agile development",{"href":1186,"dataGaName":1187,"dataGaLocation":1059},"/solutions/agile-delivery/","agile delivery",{"text":1189,"config":1190},"SCM",{"href":694,"dataGaName":1191,"dataGaLocation":1059},"source code management",{"text":1138,"config":1193},{"href":687,"dataGaName":1194,"dataGaLocation":1059},"continuous integration & delivery",{"text":1196,"config":1197},"Value stream management",{"href":737,"dataGaName":1198,"dataGaLocation":1059},"value stream management",{"text":1143,"config":1200},{"href":1201,"dataGaName":1146,"dataGaLocation":1059},"/solutions/gitops/",{"text":747,"config":1203},{"href":750,"dataGaName":751,"dataGaLocation":1059},{"text":1205,"config":1206},"Small business",{"href":756,"dataGaName":757,"dataGaLocation":1059},{"text":1208,"config":1209},"Public sector",{"href":762,"dataGaName":763,"dataGaLocation":1059},{"text":1211,"config":1212},"Education",{"href":1213,"dataGaName":1214,"dataGaLocation":1059},"/solutions/education/","education",{"text":1216,"config":1217},"Financial services",{"href":1218,"dataGaName":1219,"dataGaLocation":1059},"/solutions/finance/","financial services",{"title":770,"links":1221},[1222,1224,1226,1228,1231,1233,1236,1238,1240,1242,1244,1246,1248,1250],{"text":783,"config":1223},{"href":785,"dataGaName":786,"dataGaLocation":1059},{"text":788,"config":1225},{"href":790,"dataGaName":791,"dataGaLocation":1059},{"text":793,"config":1227},{"href":795,"dataGaName":796,"dataGaLocation":1059},{"text":798,"config":1229},{"href":800,"dataGaName":1230,"dataGaLocation":1059},"docs",{"text":821,"config":1232},{"href":823,"dataGaName":824,"dataGaLocation":1059},{"text":1234,"config":1235},"What's new",{"href":881,"dataGaName":882,"dataGaLocation":1059},{"text":816,"config":1237},{"href":818,"dataGaName":819,"dataGaLocation":1059},{"text":835,"config":1239},{"href":837,"dataGaName":838,"dataGaLocation":1059},{"text":843,"config":1241},{"href":845,"dataGaName":846,"dataGaLocation":1059},{"text":848,"config":1243},{"href":850,"dataGaName":851,"dataGaLocation":1059},{"text":853,"config":1245},{"href":855,"dataGaName":856,"dataGaLocation":1059},{"text":858,"config":1247},{"href":860,"dataGaName":861,"dataGaLocation":1059},{"text":863,"config":1249},{"href":865,"dataGaName":866,"dataGaLocation":1059},{"text":868,"config":1251},{"href":870,"dataGaName":871,"dataGaLocation":1059},{"title":884,"links":1253},[1254,1256,1258,1260,1262,1264,1268,1273,1275,1277,1279],{"text":892,"config":1255},{"href":894,"dataGaName":886,"dataGaLocation":1059},{"text":897,"config":1257},{"href":899,"dataGaName":900,"dataGaLocation":1059},{"text":905,"config":1259},{"href":907,"dataGaName":908,"dataGaLocation":1059},{"text":910,"config":1261},{"href":912,"dataGaName":913,"dataGaLocation":1059},{"text":915,"config":1263},{"href":917,"dataGaName":918,"dataGaLocation":1059},{"text":1265,"config":1266},"Sustainability",{"href":1267,"dataGaName":1265,"dataGaLocation":1059},"/sustainability/",{"text":1269,"config":1270},"Diversity, inclusion and belonging (DIB)",{"href":1271,"dataGaName":1272,"dataGaLocation":1059},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":920,"config":1274},{"href":922,"dataGaName":923,"dataGaLocation":1059},{"text":930,"config":1276},{"href":932,"dataGaName":933,"dataGaLocation":1059},{"text":935,"config":1278},{"href":937,"dataGaName":938,"dataGaLocation":1059},{"text":1280,"config":1281},"Modern Slavery Transparency Statement",{"href":1282,"dataGaName":1283,"dataGaLocation":1059},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1285},[1286,1289,1292],{"text":1287,"config":1288},"Terms",{"href":1111,"dataGaName":1112,"dataGaLocation":1059},{"text":1290,"config":1291},"Cookies",{"dataGaName":1121,"dataGaLocation":1059,"id":1122,"isOneTrustButton":343},{"text":1293,"config":1294},"Privacy",{"href":1116,"dataGaName":1117,"dataGaLocation":1059},[1296,1310],{"id":1297,"title":7,"body":595,"config":1298,"content":1300,"description":595,"extension":1304,"meta":1305,"navigation":343,"path":1306,"seo":1307,"stem":1308,"__hash__":1309},"blogAuthors/en-us/blog/authors/victor-hernandez.yml",{"template":1299},"BlogAuthor",{"name":7,"config":1301},{"headshot":1302,"ctfId":1303},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","KVTkvySIqkAu34p2jsXZz","yml",{},"/en-us/blog/authors/victor-hernandez",{},"en-us/blog/authors/victor-hernandez","KtMXKfGztEilmfsejO4JoNk05CExgJGTNZFpQUYlQPs",{"id":1311,"title":8,"body":595,"config":1312,"content":1313,"description":595,"extension":1304,"meta":1317,"navigation":343,"path":1318,"seo":1319,"stem":1320,"__hash__":1321},"blogAuthors/en-us/blog/authors/julie-byrne.yml",{"template":1299},{"name":8,"config":1314},{"headshot":1315,"ctfId":1316},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669432/Blog/Author%20Headshots/juliebyrne.jpg","3SaRWyz0u889xiq6rZkCO",{},"/en-us/blog/authors/julie-byrne",{},"en-us/blog/authors/julie-byrne","ah5NLMVkha_1IgTyOVEpcgM8Ni6s0eBt7Z7r68WGukI",[1323,1332,1340],{"title":1324,"description":1325,"heroImage":1326,"category":591,"date":1327,"authors":1328,"slug":1331,"externalUrl":595},"Confidential AI for GitLab Self-Hosted","Give developers AI coding agents in GitLab Duo without source code leaving a hardware-encrypted boundary — no GPUs needed.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773866173/vte9qh8rriznvyclhkes.png","2026-08-06",[1329,1330],"Mathias Ewald","Martin Paloncy, Edgeless Systems","confidential-ai-for-gitlab-self-hosted",{"title":1333,"description":1334,"heroImage":1335,"category":591,"date":1336,"authors":1337,"slug":1339,"externalUrl":595},"Green DevOps: Why carbon measurement belongs in your CI/CD pipeline","CI/CD pipelines have a hidden carbon cost. Here's why measuring it matters, and how you can get started with Eco CI and Carmen in GitLab.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1765809212/noh0mdfn9o94ry9ykura.png","2026-07-09",[1338],"Lysanne Pinto","green-devops-carbon-measurement-cicd-pipeline",{"title":1341,"description":1342,"heroImage":1343,"category":591,"date":1344,"authors":1345,"slug":1347,"externalUrl":595},"How to build CI/CD observability at scale","This practical guide to GitLab pipeline analytics helps self-managed users gain operational insights using Prometheus and Grafana.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774465167/n5hlvrsrheadeccyr1oz.png","2026-04-28",[1346],"Paul Meresanu","how-to-build-ci-cd-observability-at-scale",{"promotions":1349},[1350,1364,1376,1387],{"id":1351,"categories":1352,"header":1354,"text":1355,"button":1356,"image":1361},"ai-modernization",[1353],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1357,"config":1358},"Get your AI maturity score",{"href":1359,"dataGaName":1360,"dataGaLocation":824},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1362},{"src":1363},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1365,"categories":1366,"header":1368,"text":1355,"button":1369,"image":1373},"devops-modernization",[1367,1160],"product","Are you just managing tools or shipping innovation?",{"text":1370,"config":1371},"Get your DevOps maturity score",{"href":1372,"dataGaName":1360,"dataGaLocation":824},"/assessments/devops-modernization-assessment/",{"config":1374},{"src":1375},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1377,"categories":1378,"header":1379,"text":1355,"button":1380,"image":1384},"security-modernization",[610],"Are you trading speed for security?",{"text":1381,"config":1382},"Get your security maturity score",{"href":1383,"dataGaName":1360,"dataGaLocation":824},"/assessments/security-modernization-assessment/",{"config":1385},{"src":1386},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1388,"paths":1389,"header":1392,"text":1393,"button":1394,"image":1399},"github-azure-migration",[1390,1391],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1395,"config":1396},"See how GitLab compares to GitHub",{"href":1397,"dataGaName":1398,"dataGaLocation":824},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1400},{"src":1375},{"header":1402,"blurb":1403,"button":1404,"secondaryButton":1409},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1405,"config":1406},"Get your free trial",{"href":1407,"dataGaName":623,"dataGaLocation":1408},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1097,"config":1410},{"href":949,"dataGaName":628,"dataGaLocation":1408},1786803759705]