[{"data":1,"prerenderedAt":1117},["ShallowReactive",2],{"/blog/gitlab-open-sources-protocol-fuzz-test-engine":3,"navigation-en-us":333,"banner-en-us":761,"footer-en-us":771,"blog-post-authors-en-us-Sam Kerr":1016,"blog-related-posts-en-us-gitlab-open-sources-protocol-fuzz-test-engine":1031,"blog-promotions-en-us":1053,"next-steps-en-us":1107},{"id":4,"title":5,"authors":6,"body":8,"category":313,"date":314,"description":315,"extension":316,"externalUrl":317,"faq":317,"featured":318,"heroImage":319,"meta":320,"navigation":321,"path":322,"seo":323,"slug":327,"stem":328,"tags":329,"template":331,"updatedDate":317,"__hash__":332},"blogPosts/en-us/blog/gitlab-open-sources-protocol-fuzz-test-engine.md","We're open sourcing Protocol Fuzzer Community Edition!",[7],"Sam Kerr",{"type":9,"value":10,"toc":297},"minimark",[11,20,47,56,61,64,68,71,74,77,81,90,95,104,108,111,115,118,131,134,137,140,144,147,150,153,157,160,180,184,199,202,210,213,221,235,238,255,263,267,288],[12,13,14,19],"p",{},[15,16,18],"a",{"href":17},"/press/releases/2020-06-11-gitlab-acquires-peach-tech-and-fuzzit-to-expand-devsecops-offering/","GitLab acquired Peach Tech",", the industry leader in protocol and API fuzz testing, last year.",[12,21,22,23,28,29,34,35,40,41,46],{},"We were thrilled to release ",[15,24,27],{"href":25,"rel":26},"https://docs.gitlab.com/user/application_security/api_fuzzing/",[],"API fuzz testing"," as part of our ",[15,30,33],{"href":31,"rel":32},"https://docs.gitlab.com/releases/#api-fuzz-testing-with-openapi-specs-or-har-files",[],"13.4 release",".\nSince then we’ve made tons of improvements, such as ",[15,36,39],{"href":37,"rel":38},"https://docs.gitlab.com/releases/#postman-collection-support-for-api-fuzz-testing",[],"adding Postman support","\nand ",[15,42,45],{"href":43,"rel":44},"https://gitlab.com/gitlab-org/gitlab/-/issues/273111",[],"supporting runtime value overrides",", and we've received great feedback.\nWe’ve also heard the questions about the Peach protocol fuzz testing\ncapabilities and what is going to happen to them.",[12,48,49,50,55],{},"Today, we are incredibly excited to announce that we are releasing the core\nprotocol fuzz testing engine of Peach as ",[15,51,54],{"href":52,"rel":53},"https://gitlab.com/gitlab-org/security-products/protocol-fuzzer-ce",[],"GitLab Protocol Fuzzer Community Edition",", and it's open source! This edition has many\ncapabilities previously only available with a commercial Peach license.\nIt contains the engine to run and orchestrate fuzz tests as well as the\npieces needed to define your own protocols.",[57,58,60],"h2",{"id":59},"this-is-a-major-gain-for-the-open-source-community","This is a major gain for the open source community",[12,62,63],{},"Previously, the only way\nto get access to many of these tools was to pay for the commercial\nversion of Peach Fuzzer, or to use an older, unmaintained version of Peach Fuzzer\nCommunity that lacked many of the features and bug fixes available in the commercial version.\nBy open sourcing much of what\nwas previously available only with a paid license, we are thrilled to\nenable more security researchers, students, and developers to experiment\nwith and use protocol fuzz testing to find vulnerabilities and bugs\nthat other tools will not. This also enables everyone to contribute and\nhelp advance the state of the art even further!",[57,65,67],{"id":66},"what-is-fuzz-testing","What is fuzz testing?",[12,69,70],{},"Fuzz testing is an automated software testing technique that provides invalid, unexpected, or random data to a computer program. Like black box testing, a fuzzing tool injects these unexpected inputs into the system and monitors for negative reactions such as crashes or information leakage, which could indicate security, performance, or quality gaps or issues.\nThe goal is to reveal software defects and vulnerabilities.",[12,72,73],{},"The name “fuzzing” dates back to 1988 when the University of Wisconsin - Madison Professor Barton Miller noticed significant interference on the signal while logging into a UNIX system via a dial-up network during a storm. The interference ultimately resulted in a crash.",[12,75,76],{},"Later, Miller decided to have his students conduct a simulation of his experience with the idea that external “noise” couldn’t be tolerated by code. They blasted UNIX, Mac, and Windows systems with noise using a fuzz generator to see if they would crash.",[57,78,80],{"id":79},"what-is-a-peach-fuzzer","What is a peach fuzzer?",[12,82,83,84,89],{},"Peach is a SmartFuzzer that provides a way to define the format of data that should be generated as well as how and when the fuzzed data should be generated.\nIt requires the creation of Peach Pit files, which are XML files that contain complete information about the data structure, type of information, and the relationship of the data. The files define the structure, type of information, and relationships in the data to be fuzzed.\nAdditionally, it allows for the configuration of a fuzzing run, including selecting a data transport (",[15,85,88],{"href":86,"rel":87},"https://peachtech.gitlab.io/peach-fuzzer-community/v3/Publisher.html",[],"Publisher","), logging interface, etc.\nPeach has been under development since 2004.",[91,92,94],"h3",{"id":93},"what-a-peach-fuzzer-does","What a peach fuzzer does",[12,96,97,98,103],{},"A peach fuzzer is capable of performing both ",[15,99,102],{"href":100,"rel":101},"https://peachtech.gitlab.io/peach-fuzzer-community/GenerationMutationFuzzing.html",[],"generation and mutation-based"," fuzzing.",[91,105,107],{"id":106},"benefits-of-a-peach-fuzzer","Benefits of a peach fuzzer",[12,109,110],{},"A peach fuzzer tool is easy to use and allows for efficient testing and standardized reporting suitable for all stakeholders. Tests are repeatable, and findings can be verified and validated across multiple testing sessions.",[57,112,114],{"id":113},"benefits-and-challenges-of-fuzz-testing","Benefits and challenges of fuzz testing",[12,116,117],{},"Because of its random nature, experts believe fuzz testing is most likely to find bugs that other conventional tests and manual audits miss. Some of its other many benefits include:",[119,120,121,125,128],"ul",{},[122,123,124],"li",{},"Providing a good overall picture of the quality of the target system and software. Fuzzing tools let you easily assess the robustness and security risk posture of the system and software being tested.",[122,126,127],{},"Fuzzing is the main technique malicious hackers use to find software vulnerabilities. When used in a security program, it helps prevent zero-day exploits from unknown bugs and weaknesses in your system.",[122,129,130],{},"Reduced cost and time. Once a fuzzer is up and running, it can start to look for bugs on its own, with no manual intervention, and can continue to do so for as long as needed.",[12,132,133],{},"Setup and data analysis are the two main challenges practitioners face when trying to implement fuzz testing. It also isn’t easy to set up fuzz testing--it requires complex testing “harnesses” that can be even more tricky to create if the fuzz testing isn’t actually located within an existing toolchain.",[12,135,136],{},"Further, fuzz testing can generate a lot of data, including potentially false positives. So it’s critical that a testing team is prepared to deal with the onslaught of information.",[12,138,139],{},"There is also a perception issue. Because it is less easy to document, negative attitudes toward the “vague” nature of fuzz testing persist in the QA community.",[57,141,143],{"id":142},"how-to-get-started-with-fuzz-testing","How to get started with fuzz testing",[12,145,146],{},"Fuzzing, like another aspect of a software project, requires planning, maintenance, and commitment.\nFirst, figure out what you want to fuzz, what you want to find, and how you are going to fuzz. Then you will want to make sure the tool you’re going to use is flexible enough to cover all uses.",[12,148,149],{},"If you are setting up a fuzzing system but aren’t one of the developers who will actually fix the results found, communicating with the people will be. Ask about the kind of information they want to receive in a bug report from fuzz testing.",[12,151,152],{},"At the very least, a bug report should contain all the information required to reproduce the issue. This may include test case, configuration, operating system used, version or build number of the target, CPU and memory information, and, where applicable, compiler options and debug flags.\nIf no new bugs are found after running the fuzz test for a long period of time, this might indicate your fuzzing is either doing a great job, and the robustness of your target is increasing—or that the fuzz is stuck.",[57,154,156],{"id":155},"some-fuzz-testing-best-practices","Some fuzz testing best practices",[12,158,159],{},"To ensure the efficiency of your fuzz software and security testing, make sure to follow these best practices:",[119,161,162,165,168,171,174,177],{},[122,163,164],{},"Determine what the target software is to be developed",[122,166,167],{},"Identify the inputs for the data to be tested",[122,169,170],{},"Generate your fuzz data",[122,172,173],{},"Use the generated fuzz data to execute the test",[122,175,176],{},"Monitor the system for potential security vulnerabilities, crashes, and memory leaks",[122,178,179],{},"Check defects in the log so they can be addressed before the product is released",[57,181,183],{"id":182},"how-to-use-fuzz-testing-in-gitlab","How to use fuzz testing in GitLab",[12,185,186,187,192,193,198],{},"Gitlab recommends doing fuzz testing in addition to the other security scanners in ",[15,188,191],{"href":189,"rel":190},"https://docs.gitlab.com/user/application_security/",[],"GitLab Secure"," and your own test processes. If you’re using ",[15,194,197],{"href":195,"rel":196},"https://docs.gitlab.com/ci/",[],"GitLab CI/CD",", you can run your coverage-guided fuzz testing as part of your CI/CD workflow.\nWeb API fuzzing runs in the fuzz stage of the CI/CD pipeline. To ensure API fuzzing scans the latest code, your CI/CD pipeline should deploy changes to a test environment in one of the stages preceding the fuzz stage.",[12,200,201],{},"The following changes have been made to the API fuzzing template:",[119,203,204,207],{},[122,205,206],{},"In GitLab 14.0 and later, you must define a fuzz stage in your .gitlab-ci.yml file.",[122,208,209],{},"In GitLab 13.12 and earlier, the API fuzzing template defines the build, test, deploy, and fuzz stages. The fuzz stage runs last by default. The predefined stages were deprecated and removed from the API-Fuzzing.latest.gitlab-ci.yml template. They will be removed in a future GitLab version.",[12,211,212],{},"If your pipeline is configured to deploy to the same web server on each run, running a pipeline while another is still running could cause a race condition in which one pipeline overwrites the code from another. The API to scan should be excluded from changes for the duration of a fuzzing scan.\nThe only changes to the API should be from the fuzzing scanner. Any changes made to the API (for example, by users, scheduled tasks, database changes, code changes, other pipelines, or other scanners) during a scan could cause inaccurate results.",[12,214,215,216,220],{},"You can run a ",[15,217,219],{"href":25,"rel":218},[],"Web API fuzzing scan"," using the following methods:",[119,222,223,226,229,232],{},[122,224,225],{},"OpenAPI Specification - versions 2 and 3.",[122,227,228],{},"GraphQL Schema",[122,230,231],{},"HTTP Archive (HAR)",[122,233,234],{},"Postman Collection - versions 2.0 or 2.1",[12,236,237],{},"Example projects using these methods are available:",[119,239,240,243,246,249,252],{},[122,241,242],{},"Example OpenAPI v2 Specification project",[122,244,245],{},"Example HTTP Archive (HAR) project",[122,247,248],{},"Example Postman Collection project",[122,250,251],{},"Example GraphQL project",[122,253,254],{},"Example SOAP project",[12,256,257,258,262],{},"More information about web API fuzz testing in GitLab can be found ",[15,259,261],{"href":25,"rel":260},[],"here",".",[57,264,266],{"id":265},"future-plans-for-fuzz-testing","Future plans for fuzz testing",[12,268,269,270,275,276,281,282,287],{},"We plan to add additional capabilities to the Community Edition in the future\nand integrate it into GitLab the product. You can read more details about our\nfuture plans on our ",[15,271,274],{"href":272,"rel":273},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/",[],"fuzz testing direction page",".\nWe will keep our ",[15,277,280],{"href":278,"rel":279},"https://handbook.gitlab.com/handbook/company/stewardship/",[],"stewardship policy"," in mind as we ",[15,283,286],{"href":284,"rel":285},"https://handbook.gitlab.com/handbook/product/product-processes/tiering-guidance-for-features/",[],"determine which tiers of GitLab that specific features\nare added to",". Some of the capabilities you can look forward to are\nindustry-specific features, tighter integration with the CI process and vulnerability\nmanagement, as well as pre-built support for many common network protocols.",[12,289,290,291,296],{},"One of our values at GitLab is ",[15,292,295],{"href":293,"rel":294},"https://handbook.gitlab.com/handbook/values/#iteration",[],"iteration"," and we wanted to share the Community\nEdition as soon as we could so everyone can contribute sooner! We would\nlove for you to check it out and provide feedback and your own contributions.",{"title":298,"searchDepth":299,"depth":299,"links":300},"",2,[301,302,303,308,309,310,311,312],{"id":59,"depth":299,"text":60},{"id":66,"depth":299,"text":67},{"id":79,"depth":299,"text":80,"children":304},[305,307],{"id":93,"depth":306,"text":94},3,{"id":106,"depth":306,"text":107},{"id":113,"depth":299,"text":114},{"id":142,"depth":299,"text":143},{"id":155,"depth":299,"text":156},{"id":182,"depth":299,"text":183},{"id":265,"depth":299,"text":266},"news","2021-03-23","GitLab is releasing an open source protocol fuzz testing repository.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749667243/Blog/Hero%20Images/open-source-community.png",{},true,"/en-us/blog/gitlab-open-sources-protocol-fuzz-test-engine",{"title":5,"description":315,"ogTitle":5,"ogDescription":315,"noIndex":318,"ogImage":319,"ogUrl":324,"ogSiteName":325,"ogType":326,"canonicalUrls":324},"https://about.gitlab.com/blog/gitlab-open-sources-protocol-fuzz-test-engine","https://about.gitlab.com","article","gitlab-open-sources-protocol-fuzz-test-engine","en-us/blog/gitlab-open-sources-protocol-fuzz-test-engine",[330,313],"open source","BlogPost","1SGbIZe2tIrLOmm0MkpXJaM7Bwbt_hDjqAmyvABcU5U",{"logo":334,"freeTrial":339,"sales":344,"login":349,"items":354,"search":681,"minimal":712,"duo":731,"switchNav":740,"pricingDeployment":751},{"config":335},{"href":336,"dataGaName":337,"dataGaLocation":338},"/","gitlab logo","header",{"text":340,"config":341},"Get free trial",{"href":342,"dataGaName":343,"dataGaLocation":338},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":345,"config":346},"Request a demo",{"href":347,"dataGaName":348,"dataGaLocation":338},"/sales/?contact-topic=request-demo","sales",{"text":350,"config":351},"Sign in",{"href":352,"dataGaName":353,"dataGaLocation":338},"https://gitlab.com/users/sign_in/","sign in",[355,384,484,489,603,659],{"text":356,"config":357,"menu":359},"Platform",{"dataNavLevelOne":358},"platform",{"type":360,"columns":361},"cards",[362,368,376],{"title":356,"description":363,"link":364},"The intelligent orchestration platform for DevSecOps",{"text":365,"config":366},"Explore our Platform",{"href":367,"dataGaName":358,"dataGaLocation":338},"/platform/",{"title":369,"description":370,"link":371},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":372,"config":373},"Meet GitLab Duo",{"href":374,"dataGaName":375,"dataGaLocation":338},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":377,"description":378,"link":379},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":380,"config":381},"Learn more",{"href":382,"dataGaName":383,"dataGaLocation":338},"/why-gitlab/","why gitlab",{"text":385,"left":321,"config":386,"menu":388},"Product",{"dataNavLevelOne":387},"solutions",{"type":389,"link":390,"columns":394,"feature":463},"lists",{"text":391,"config":392},"View all Solutions",{"href":393,"dataGaName":387,"dataGaLocation":338},"/solutions/",[395,419,442],{"title":396,"description":397,"link":398,"items":403},"Automation","CI/CD and automation to accelerate deployment",{"config":399},{"icon":400,"href":401,"dataGaName":402,"dataGaLocation":338},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[404,408,411,415],{"text":405,"config":406},"CI/CD",{"href":407,"dataGaLocation":338,"dataGaName":405},"/solutions/continuous-integration/",{"text":369,"config":409},{"href":374,"dataGaLocation":338,"dataGaName":410},"gitlab duo agent platform - product menu",{"text":412,"config":413},"Source Code Management",{"href":414,"dataGaLocation":338,"dataGaName":412},"/solutions/source-code-management/",{"text":416,"config":417},"Automated Software Delivery",{"href":401,"dataGaLocation":338,"dataGaName":418},"Automated software delivery",{"title":420,"description":421,"link":422,"items":427},"Security","Deliver code faster without compromising security",{"config":423},{"href":424,"dataGaName":425,"dataGaLocation":338,"icon":426},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[428,432,437],{"text":429,"config":430},"Application Security Testing",{"href":424,"dataGaName":431,"dataGaLocation":338},"Application security testing",{"text":433,"config":434},"Software Supply Chain Security",{"href":435,"dataGaLocation":338,"dataGaName":436},"/solutions/supply-chain/","Software supply chain security",{"text":438,"config":439},"Software Compliance",{"href":440,"dataGaName":441,"dataGaLocation":338},"/solutions/software-compliance/","software compliance",{"title":443,"link":444,"items":449},"Measurement",{"config":445},{"icon":446,"href":447,"dataGaName":448,"dataGaLocation":338},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[450,454,458],{"text":451,"config":452},"Visibility & Measurement",{"href":447,"dataGaLocation":338,"dataGaName":453},"Visibility and Measurement",{"text":455,"config":456},"Value Stream Management",{"href":457,"dataGaLocation":338,"dataGaName":455},"/solutions/value-stream-management/",{"text":459,"config":460},"Analytics & Insights",{"href":461,"dataGaLocation":338,"dataGaName":462},"/solutions/analytics-and-insights/","Analytics and insights",{"title":464,"type":389,"items":465},"GitLab for",[466,472,478],{"text":467,"config":468},"Enterprise",{"icon":469,"href":470,"dataGaLocation":338,"dataGaName":471},"Building","/enterprise/","enterprise",{"text":473,"config":474},"Small Business",{"icon":475,"href":476,"dataGaLocation":338,"dataGaName":477},"Work","/small-business/","small business",{"text":479,"config":480},"Public Sector",{"icon":481,"href":482,"dataGaLocation":338,"dataGaName":483},"Organization","/solutions/public-sector/","public sector",{"text":485,"config":486},"Pricing",{"href":487,"dataGaName":488,"dataGaLocation":338,"dataNavLevelOne":488},"/pricing/","pricing",{"text":490,"config":491,"menu":493},"Resources",{"dataNavLevelOne":492},"resources",{"type":389,"link":494,"columns":498,"feature":592},{"text":495,"config":496},"View all resources",{"href":497,"dataGaName":492,"dataGaLocation":338},"/resources/",[499,532,559],{"title":500,"items":501},"Getting started",[502,507,512,517,522,527],{"text":503,"config":504},"Install",{"href":505,"dataGaName":506,"dataGaLocation":338},"/install/","install",{"text":508,"config":509},"Quick start guides",{"href":510,"dataGaName":511,"dataGaLocation":338},"/get-started/","quick setup checklists",{"text":513,"config":514},"Learn",{"href":515,"dataGaLocation":338,"dataGaName":516},"https://university.gitlab.com/","learn",{"text":518,"config":519},"Product documentation",{"href":520,"dataGaName":521,"dataGaLocation":338},"https://docs.gitlab.com/","product documentation",{"text":523,"config":524},"Best practice videos",{"href":525,"dataGaName":526,"dataGaLocation":338},"/getting-started-videos/","best practice videos",{"text":528,"config":529},"Integrations",{"href":530,"dataGaName":531,"dataGaLocation":338},"/integrations/","integrations",{"title":533,"items":534},"Discover",[535,540,545,550,554],{"text":536,"config":537},"Customer success stories",{"href":538,"dataGaName":539,"dataGaLocation":338},"/customers/","customer success stories",{"text":541,"config":542},"Blog",{"href":543,"dataGaName":544,"dataGaLocation":338},"/blog/","blog",{"text":546,"config":547},"Demo Hub",{"href":548,"dataGaName":549,"dataGaLocation":338},"/demo-hub/","demo hub",{"text":551,"config":552},"The Source",{"href":553,"dataGaName":544,"dataGaLocation":338},"/the-source/",{"text":555,"config":556},"Remote",{"href":557,"dataGaName":558,"dataGaLocation":338},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":560,"items":561},"Connect",[562,567,572,577,582,587],{"text":563,"config":564},"GitLab Services",{"href":565,"dataGaName":566,"dataGaLocation":338},"/services/","services",{"text":568,"config":569},"Contribute",{"href":570,"dataGaName":571,"dataGaLocation":338},"https://contributors.gitlab.com","contribute",{"text":573,"config":574},"Community",{"href":575,"dataGaName":576,"dataGaLocation":338},"/community/","community",{"text":578,"config":579},"Forum",{"href":580,"dataGaName":581,"dataGaLocation":338},"https://forum.gitlab.com/","forum",{"text":583,"config":584},"Events",{"href":585,"dataGaName":586,"dataGaLocation":338},"/events/","events",{"text":588,"config":589},"Partners",{"href":590,"dataGaName":591,"dataGaLocation":338},"/partners/","partners",{"config":593,"title":596,"text":597,"link":598},{"background":594,"textColor":595},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":599,"config":600},"Read the latest",{"href":601,"dataGaName":602,"dataGaLocation":338},"/whats-new/","whats new",{"text":604,"config":605,"menu":607},"Company",{"dataNavLevelOne":606},"company",{"type":389,"columns":608},[609],{"items":610},[611,616,622,624,629,634,639,644,649,654],{"text":612,"config":613},"About",{"href":614,"dataGaName":615,"dataGaLocation":338},"/company/","about",{"text":617,"config":618,"footerGa":621},"Jobs",{"href":619,"dataGaName":620,"dataGaLocation":338},"/jobs/","jobs",{"dataGaName":620},{"text":583,"config":623},{"href":585,"dataGaName":586,"dataGaLocation":338},{"text":625,"config":626},"Leadership",{"href":627,"dataGaName":628,"dataGaLocation":338},"/company/team/e-group/","leadership",{"text":630,"config":631},"Handbook",{"href":632,"dataGaName":633,"dataGaLocation":338},"https://handbook.gitlab.com/","handbook",{"text":635,"config":636},"Investor relations",{"href":637,"dataGaName":638,"dataGaLocation":338},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":640,"config":641},"Trust Center",{"href":642,"dataGaName":643,"dataGaLocation":338},"/security/","trust center",{"text":645,"config":646},"AI Transparency Center",{"href":647,"dataGaName":648,"dataGaLocation":338},"/ai-transparency-center/","ai transparency center",{"text":650,"config":651},"Newsletter",{"href":652,"dataGaName":653,"dataGaLocation":338},"/company/contact/#contact-forms","newsletter",{"text":655,"config":656},"Press",{"href":657,"dataGaName":658,"dataGaLocation":338},"/press/","press",{"text":660,"config":661,"menu":662},"Contact us",{"dataNavLevelOne":606},{"type":389,"columns":663},[664],{"items":665},[666,671,676],{"text":667,"config":668},"Talk to sales",{"href":669,"dataGaName":670,"dataGaLocation":338},"/sales/","talk to sales",{"text":672,"config":673},"Support portal",{"href":674,"dataGaName":675,"dataGaLocation":338},"https://support.gitlab.com/hc/en-us","support portal",{"text":677,"config":678},"Customer portal",{"href":679,"dataGaName":680,"dataGaLocation":338},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":682,"login":683,"suggestions":690},"Close",{"text":684,"link":685},"To search repositories and projects, login to",{"text":686,"config":687},"gitlab.com",{"href":352,"dataGaName":688,"dataGaLocation":689},"search login","search",{"text":691,"default":692},"Suggestions",[693,695,699,701,705,709],{"text":369,"config":694},{"href":374,"dataGaName":369,"dataGaLocation":689},{"text":696,"config":697},"Code Suggestions (AI)",{"href":698,"dataGaName":696,"dataGaLocation":689},"/solutions/code-suggestions/",{"text":405,"config":700},{"href":407,"dataGaName":405,"dataGaLocation":689},{"text":702,"config":703},"GitLab on AWS",{"href":704,"dataGaName":702,"dataGaLocation":689},"/partners/technology-partners/aws/",{"text":706,"config":707},"GitLab on Google Cloud",{"href":708,"dataGaName":706,"dataGaLocation":689},"/partners/technology-partners/google-cloud-platform/",{"text":710,"config":711},"Why GitLab?",{"href":382,"dataGaName":710,"dataGaLocation":689},{"freeTrial":713,"mobileIcon":718,"desktopIcon":723,"secondaryButton":726},{"text":714,"config":715},"Start free trial",{"href":716,"dataGaName":343,"dataGaLocation":717},"https://gitlab.com/-/trials/new/","nav",{"altText":719,"config":720},"Gitlab Icon",{"src":721,"dataGaName":722,"dataGaLocation":717},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":719,"config":724},{"src":725,"dataGaName":722,"dataGaLocation":717},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":727,"config":728},"Get Started",{"href":729,"dataGaName":730,"dataGaLocation":717},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":732,"mobileIcon":736,"desktopIcon":738},{"text":733,"config":734},"Learn more about GitLab Duo",{"href":374,"dataGaName":735,"dataGaLocation":717},"gitlab duo",{"altText":719,"config":737},{"src":721,"dataGaName":722,"dataGaLocation":717},{"altText":719,"config":739},{"src":725,"dataGaName":722,"dataGaLocation":717},{"button":741,"mobileIcon":746,"desktopIcon":748},{"text":742,"config":743},"/switch",{"href":744,"dataGaName":745,"dataGaLocation":717},"#contact","switch",{"altText":719,"config":747},{"src":721,"dataGaName":722,"dataGaLocation":717},{"altText":719,"config":749},{"src":750,"dataGaName":722,"dataGaLocation":717},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":752,"mobileIcon":757,"desktopIcon":759},{"text":753,"config":754},"Back to pricing",{"href":487,"dataGaName":755,"dataGaLocation":717,"icon":756},"back to pricing","GoBack",{"altText":719,"config":758},{"src":721,"dataGaName":722,"dataGaLocation":717},{"altText":719,"config":760},{"src":725,"dataGaName":722,"dataGaLocation":717},{"title":762,"titleMobile":763,"button":764,"config":769},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":380,"config":765},{"href":766,"dataGaName":767,"dataGaLocation":768},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":770,"disabled":318},"release",{"data":772},{"text":773,"source":774,"edit":780,"contribute":785,"config":790,"items":795,"minimal":1005},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":775,"config":776},"View page source",{"href":777,"dataGaName":778,"dataGaLocation":779},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":781,"config":782},"Edit this page",{"href":783,"dataGaName":784,"dataGaLocation":779},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":786,"config":787},"Please contribute",{"href":788,"dataGaName":789,"dataGaLocation":779},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":791,"facebook":792,"youtube":793,"linkedin":794},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[796,843,897,941,973],{"title":485,"links":797,"subMenu":812},[798,802,807],{"text":799,"config":800},"View plans",{"href":487,"dataGaName":801,"dataGaLocation":779},"view plans",{"text":803,"config":804},"Why Premium?",{"href":805,"dataGaName":806,"dataGaLocation":779},"/pricing/premium/","why premium",{"text":808,"config":809},"Why Ultimate?",{"href":810,"dataGaName":811,"dataGaLocation":779},"/pricing/ultimate/","why ultimate",[813],{"title":814,"links":815},"Contact Us",[816,819,821,823,828,833,838],{"text":817,"config":818},"Contact sales",{"href":669,"dataGaName":348,"dataGaLocation":779},{"text":672,"config":820},{"href":674,"dataGaName":675,"dataGaLocation":779},{"text":677,"config":822},{"href":679,"dataGaName":680,"dataGaLocation":779},{"text":824,"config":825},"Status",{"href":826,"dataGaName":827,"dataGaLocation":779},"https://status.gitlab.com/","status",{"text":829,"config":830},"Terms of use",{"href":831,"dataGaName":832,"dataGaLocation":779},"/terms/","terms of use",{"text":834,"config":835},"Privacy statement",{"href":836,"dataGaName":837,"dataGaLocation":779},"/privacy/","privacy statement",{"text":839,"config":840},"Cookie preferences",{"dataGaName":841,"dataGaLocation":779,"id":842,"isOneTrustButton":321},"cookie preferences","ot-sdk-btn",{"title":385,"links":844,"subMenu":853},[845,849],{"text":846,"config":847},"DevSecOps platform",{"href":367,"dataGaName":848,"dataGaLocation":779},"devsecops platform",{"text":850,"config":851},"AI-Assisted Development",{"href":374,"dataGaName":852,"dataGaLocation":779},"ai-assisted development",[854],{"title":855,"links":856},"Topics",[857,862,867,872,877,882,887,892],{"text":858,"config":859},"CICD",{"href":860,"dataGaName":861,"dataGaLocation":779},"/topics/ci-cd/","cicd",{"text":863,"config":864},"GitOps",{"href":865,"dataGaName":866,"dataGaLocation":779},"/topics/gitops/","gitops",{"text":868,"config":869},"DevOps",{"href":870,"dataGaName":871,"dataGaLocation":779},"/topics/devops/","devops",{"text":873,"config":874},"Version Control",{"href":875,"dataGaName":876,"dataGaLocation":779},"/topics/version-control/","version control",{"text":878,"config":879},"DevSecOps",{"href":880,"dataGaName":881,"dataGaLocation":779},"/topics/devsecops/","devsecops",{"text":883,"config":884},"Cloud Native",{"href":885,"dataGaName":886,"dataGaLocation":779},"/topics/cloud-native/","cloud native",{"text":888,"config":889},"AI for Coding",{"href":890,"dataGaName":891,"dataGaLocation":779},"/topics/devops/ai-for-coding/","ai for coding",{"text":893,"config":894},"Agentic AI",{"href":895,"dataGaName":896,"dataGaLocation":779},"/topics/agentic-ai/","agentic ai",{"title":898,"links":899},"Solutions",[900,902,904,909,913,916,920,923,925,928,931,936],{"text":429,"config":901},{"href":424,"dataGaName":429,"dataGaLocation":779},{"text":418,"config":903},{"href":401,"dataGaName":402,"dataGaLocation":779},{"text":905,"config":906},"Agile development",{"href":907,"dataGaName":908,"dataGaLocation":779},"/solutions/agile-delivery/","agile delivery",{"text":910,"config":911},"SCM",{"href":414,"dataGaName":912,"dataGaLocation":779},"source code management",{"text":858,"config":914},{"href":407,"dataGaName":915,"dataGaLocation":779},"continuous integration & delivery",{"text":917,"config":918},"Value stream management",{"href":457,"dataGaName":919,"dataGaLocation":779},"value stream management",{"text":863,"config":921},{"href":922,"dataGaName":866,"dataGaLocation":779},"/solutions/gitops/",{"text":467,"config":924},{"href":470,"dataGaName":471,"dataGaLocation":779},{"text":926,"config":927},"Small business",{"href":476,"dataGaName":477,"dataGaLocation":779},{"text":929,"config":930},"Public sector",{"href":482,"dataGaName":483,"dataGaLocation":779},{"text":932,"config":933},"Education",{"href":934,"dataGaName":935,"dataGaLocation":779},"/solutions/education/","education",{"text":937,"config":938},"Financial services",{"href":939,"dataGaName":940,"dataGaLocation":779},"/solutions/finance/","financial services",{"title":490,"links":942},[943,945,947,949,952,954,957,959,961,963,965,967,969,971],{"text":503,"config":944},{"href":505,"dataGaName":506,"dataGaLocation":779},{"text":508,"config":946},{"href":510,"dataGaName":511,"dataGaLocation":779},{"text":513,"config":948},{"href":515,"dataGaName":516,"dataGaLocation":779},{"text":518,"config":950},{"href":520,"dataGaName":951,"dataGaLocation":779},"docs",{"text":541,"config":953},{"href":543,"dataGaName":544,"dataGaLocation":779},{"text":955,"config":956},"What's new",{"href":601,"dataGaName":602,"dataGaLocation":779},{"text":536,"config":958},{"href":538,"dataGaName":539,"dataGaLocation":779},{"text":555,"config":960},{"href":557,"dataGaName":558,"dataGaLocation":779},{"text":563,"config":962},{"href":565,"dataGaName":566,"dataGaLocation":779},{"text":568,"config":964},{"href":570,"dataGaName":571,"dataGaLocation":779},{"text":573,"config":966},{"href":575,"dataGaName":576,"dataGaLocation":779},{"text":578,"config":968},{"href":580,"dataGaName":581,"dataGaLocation":779},{"text":583,"config":970},{"href":585,"dataGaName":586,"dataGaLocation":779},{"text":588,"config":972},{"href":590,"dataGaName":591,"dataGaLocation":779},{"title":604,"links":974},[975,977,979,981,983,985,989,994,996,998,1000],{"text":612,"config":976},{"href":614,"dataGaName":606,"dataGaLocation":779},{"text":617,"config":978},{"href":619,"dataGaName":620,"dataGaLocation":779},{"text":625,"config":980},{"href":627,"dataGaName":628,"dataGaLocation":779},{"text":630,"config":982},{"href":632,"dataGaName":633,"dataGaLocation":779},{"text":635,"config":984},{"href":637,"dataGaName":638,"dataGaLocation":779},{"text":986,"config":987},"Sustainability",{"href":988,"dataGaName":986,"dataGaLocation":779},"/sustainability/",{"text":990,"config":991},"Diversity, inclusion and belonging (DIB)",{"href":992,"dataGaName":993,"dataGaLocation":779},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":640,"config":995},{"href":642,"dataGaName":643,"dataGaLocation":779},{"text":650,"config":997},{"href":652,"dataGaName":653,"dataGaLocation":779},{"text":655,"config":999},{"href":657,"dataGaName":658,"dataGaLocation":779},{"text":1001,"config":1002},"Modern Slavery Transparency Statement",{"href":1003,"dataGaName":1004,"dataGaLocation":779},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1006},[1007,1010,1013],{"text":1008,"config":1009},"Terms",{"href":831,"dataGaName":832,"dataGaLocation":779},{"text":1011,"config":1012},"Cookies",{"dataGaName":841,"dataGaLocation":779,"id":842,"isOneTrustButton":321},{"text":1014,"config":1015},"Privacy",{"href":836,"dataGaName":837,"dataGaLocation":779},[1017],{"id":1018,"title":7,"body":317,"config":1019,"content":1021,"description":317,"extension":1025,"meta":1026,"navigation":321,"path":1027,"seo":1028,"stem":1029,"__hash__":1030},"blogAuthors/en-us/blog/authors/sam-kerr.yml",{"template":1020},"BlogAuthor",{"name":7,"config":1022},{"headshot":1023,"ctfId":1024},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749668841/Blog/Author%20Headshots/stkerr-headshot.jpg","stkerr","yml",{},"/en-us/blog/authors/sam-kerr",{},"en-us/blog/authors/sam-kerr","Uy_fuPl-EwaUBm9ppfxsmwgZvhXQR9HumvuLsv4cbko",[1032,1040,1047],{"title":1033,"description":1034,"heroImage":1035,"category":313,"date":1036,"authors":1037,"slug":1039,"externalUrl":317},"GitLab named a Leader in the 2026 Gartner® Magic Quadrant™ for DevSecOps Platforms","Agents made coding fast. GitLab is the Intelligent Orchestration Platform for DevSecOps that brings speed with control for the rest of the software lifecycle.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750099203/Blog/Hero%20Images/Blog/Hero%20Images/blog-image-template-1800x945%20%2820%29_2bJGC5ZP3WheoqzlLT05C5_1750099203484.png","2026-06-17",[1038],"Manav Khurana","gitlab-leader-2026-gartner-mq-devsecops-platforms",{"title":1041,"description":1042,"heroImage":1043,"category":313,"date":1036,"authors":1044,"slug":1046,"externalUrl":317},"GitLab and Capgemini accelerate DevSecOps transformation","The global alliance helps organizations modernize software delivery, secure their supply chain, and bring AI into development workflows.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1781279411/n3pkmddd2eswa8qbu06z.png",[1045],"Alex Picker","gitlab-and-capgemini-global-alliance-partnership",{"title":1048,"description":1049,"heroImage":1050,"category":313,"date":1036,"authors":1051,"slug":1052,"externalUrl":317},"Introducing the 2026 EMEA GitLab Partner Award winners","Learn about the EMEA partners who made an outstanding impact over the past year.\n","https://res.cloudinary.com/about-gitlab-com/image/upload/v1781608381/biycl2ib2kpsbspjlac7.png",[1045],"2026-emea-gitlab-partner-awards",{"promotions":1054},[1055,1069,1081,1093],{"id":1056,"categories":1057,"header":1059,"text":1060,"button":1061,"image":1066},"ai-modernization",[1058],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1062,"config":1063},"Get your AI maturity score",{"href":1064,"dataGaName":1065,"dataGaLocation":544},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1067},{"src":1068},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1070,"categories":1071,"header":1073,"text":1060,"button":1074,"image":1078},"devops-modernization",[1072,881],"product","Are you just managing tools or shipping innovation?",{"text":1075,"config":1076},"Get your DevOps maturity score",{"href":1077,"dataGaName":1065,"dataGaLocation":544},"/assessments/devops-modernization-assessment/",{"config":1079},{"src":1080},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1082,"categories":1083,"header":1085,"text":1060,"button":1086,"image":1090},"security-modernization",[1084],"security","Are you trading speed for security?",{"text":1087,"config":1088},"Get your security maturity score",{"href":1089,"dataGaName":1065,"dataGaLocation":544},"/assessments/security-modernization-assessment/",{"config":1091},{"src":1092},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1094,"paths":1095,"header":1098,"text":1099,"button":1100,"image":1105},"github-azure-migration",[1096,1097],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1101,"config":1102},"See how GitLab compares to GitHub",{"href":1103,"dataGaName":1104,"dataGaLocation":544},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1106},{"src":1080},{"header":1108,"blurb":1109,"button":1110,"secondaryButton":1115},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1111,"config":1112},"Get your free trial",{"href":1113,"dataGaName":343,"dataGaLocation":1114},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":817,"config":1116},{"href":669,"dataGaName":348,"dataGaLocation":1114},1786803750593]