[{"data":1,"prerenderedAt":1559},["ShallowReactive",2],{"/blog/how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance":3,"navigation-en-us":775,"banner-en-us":1201,"footer-en-us":1211,"blog-post-authors-en-us-Joseph Longo":1456,"blog-related-posts-en-us-how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance":1471,"blog-promotions-en-us":1496,"next-steps-en-us":1549},{"id":4,"title":5,"authors":6,"body":8,"category":754,"date":755,"description":756,"extension":757,"externalUrl":758,"faq":758,"featured":759,"heroImage":760,"meta":761,"navigation":762,"path":763,"seo":764,"slug":768,"stem":769,"tags":770,"template":773,"updatedDate":758,"__hash__":774},"blogPosts/en-us/blog/how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance.md","How GitLab supports NSA and CISA CI/CD security guidance",[7],"Joseph Longo",{"type":9,"value":10,"toc":743},"minimark",[11,22,31,36,39,42,67,76,79,83,86,91,94,99,105,125,129,134,149,161,170,184,196,200,205,214,239,247,254,257,261,266,275,305,319,325,328,332,337,346,366,375,383,387,392,400,403,407,412,420,439,443,446,450,455,458,469,501,510,514,519,526,529,532,536,541,544,551,565,570,572,582,586,591,599,603,608,617,637,643,646,655,659,664,672,680,686,689,692,696,701,720,728,732,735],[12,13,14,15,21],"p",{},"In June, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) ",[16,17,20],"a",{"href":18,"rel":19},"https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF",[],"issued a joint cybersecurity information sheet (CSI)"," providing recommendations and best practices for cloud-based DevSecOps environments. Specifically, the CSI focuses on security hardening best practices for continuous integration/continuous delivery (CI/CD) cloud deployments.",[12,23,24,25,30],{},"Let's take a look at the relevant threats, recommended countermeasures, and how the ",[16,26,29],{"href":27,"rel":28},"https://about.gitlab.com/platform/",[],"GitLab DevSecOps Platform"," can support the implementation and enforcement of the countermeasures to help secure your CI/CD environment.",[32,33,35],"h2",{"id":34},"cicd-environments-are-under-threat","CI/CD environments are under threat",[12,37,38],{},"Over the past few years, the software supply chain, and specifically CI/CD environments, have become a persistent and valuable target for malicious actors. Theft of proprietary code and data, injection of malicious links and redirects, and denial-of-service attacks are a few examples of why CI/CD environments have been such lucrative targets for threat actors.",[12,40,41],{},"The CSI outlines examples of common risks in CI/CD pipelines. These risks include:",[43,44,45,49,52,55,58,61,64],"ul",{},[46,47,48],"li",{},"insecure first-party code",[46,50,51],{},"insecure third-party code",[46,53,54],{},"poisoned pipeline execution",[46,56,57],{},"insufficient pipeline access controls",[46,59,60],{},"insecure system configuration",[46,62,63],{},"usage of insecure third-party services",[46,65,66],{},"exposure of secrets",[12,68,69,70,75],{},"Additional context can be found in the CSI and in ",[16,71,74],{"href":72,"rel":73},"https://owasp.org/www-project-top-10-ci-cd-security-risks/",[],"OWASP's top 10 CI/CD security risks",".",[12,77,78],{},"Note: The CSI contains helpful information on potential threat scenarios and illustrations to help visualize different attack vectors.",[32,80,82],{"id":81},"hardening-recommendations-for-cicd-environment","Hardening recommendations for CI/CD environment",[12,84,85],{},"As a single, all-inclusive DevSecOps platform, GitLab's features support the implementation of the recommended mitigations from the NSA and CISA.",[87,88,90],"h3",{"id":89},"authentication-and-access-mitigation","Authentication and access mitigation",[12,92,93],{},"Here are the features that align with authentication and access mitigation.",[95,96,98],"h4",{"id":97},"use-nsa-recommended-cryptography","Use NSA-recommended cryptography",[12,100,101],{},[102,103,104],"em",{},"\"NSA and CISA recommend the implementation and configuration of strong cryptographic algorithms when configuring cloud applications and services.\"",[12,106,107,108,113,114,119,120,75],{},"GitLab's ",[16,109,112],{"href":110,"rel":111},"https://about.gitlab.com/solutions/",[],"GitLab.com"," and ",[16,115,118],{"href":116,"rel":117},"https://about.gitlab.com/dedicated/",[],"GitLab Dedicated"," SaaS solutions implement TLS 1.2+ for encrypting data in transit and AES-256-bit encryption for data at rest. You can learn more about our approach to cryptography in our ",[16,121,124],{"href":122,"rel":123},"https://handbook.gitlab.com/handbook/security/policies_and_standards/cryptographic-standard/",[],"Cryptography Standard",[95,126,128],{"id":127},"minimize-the-use-of-long-term-credentials","Minimize the use of long-term credentials",[12,130,131],{},[102,132,133],{},"\"Use strong credentials that are resistant to stealing, phishing, guessing, and replaying wherever and whenever possible.\"",[12,135,136,137,142,143,148],{},"To support the use of strong credentials, GitLab enables you to centralize authentication and authorization responsibilities for your GitLab instance through ",[16,138,141],{"href":139,"rel":140},"https://docs.gitlab.com/user/group/saml_sso/",[],"SAML SSO"," integrations. GitLab integrates with a wide range of identity providers to support our customers’ diverse tech stacks. GitLab also supports the System for Cross-Domain Identity Management (",[16,144,147],{"href":145,"rel":146},"https://docs.gitlab.com/user/group/saml_sso/scim_setup/",[],"SCIM","). Through GitLab’s SSO and SCIM integrations, you can automate the lifecycle of your user identities in a secure and efficient manner.",[12,150,151,113,156,160],{},[16,152,155],{"href":153,"rel":154},"https://docs.gitlab.com/integration/saml/",[],"SSO",[16,157,147],{"href":158,"rel":159},"https://docs.gitlab.com/administration/settings/scim_setup/",[]," are also available for GitLab self-managed customers.",[12,162,163,164,169],{},"GitLab supports ",[16,165,168],{"href":166,"rel":167},"https://docs.gitlab.com/user/profile/account/two_factor_authentication/",[],"two-factor authentication",". Customers can enable one or both of the following second factors of authentication:",[43,171,172,181],{},[46,173,174,175,180],{},"time-based one-time passwords (",[16,176,179],{"href":177,"rel":178},"https://datatracker.ietf.org/doc/html/rfc6238",[],"TOTP",")",[46,182,183],{},"WebAuthn devices",[185,186,187],"blockquote",{},[12,188,189,190,195],{},"Check out our ",[16,191,194],{"href":192,"rel":193},"https://about.gitlab.com/blog/the-ultimate-guide-to-enabling-saml/",[],"Ultimate guide to enabling SAML and SSO on GitLab.com"," for more information.",[95,197,199],{"id":198},"add-signature-to-cicd-configuration-and-verify-it","Add signature to CI/CD configuration and verify it",[12,201,202],{},[102,203,204],{},"\"NSA and CISA recommend implementing secure code signing to establish digital trust\nwithin the CI/CD pipeline.\"",[12,206,207,208,213],{},"GitLab enables its customers to ",[16,209,212],{"href":210,"rel":211},"https://docs.gitlab.com/user/project/repository/signed_commits/",[],"sign commits"," using:",[43,215,216,224,232],{},[46,217,218,219],{},"an ",[16,220,223],{"href":221,"rel":222},"https://docs.gitlab.com/user/project/repository/signed_commits/ssh/",[],"SSH key",[46,225,226,227],{},"a ",[16,228,231],{"href":229,"rel":230},"https://docs.gitlab.com/user/project/repository/signed_commits/gpg/",[],"GPG key",[46,233,226,234],{},[16,235,238],{"href":236,"rel":237},"https://docs.gitlab.com/user/project/repository/signed_commits/x509/",[],"personal x.509 certificate",[12,240,107,241,246],{},[16,242,245],{"href":243,"rel":244},"https://docs.gitlab.com/user/project/repository/push_rules/",[],"push rules"," feature can also be used to reject individual commits if they are not signed with GPG, or you can choose to reject all commits from unverified users.",[12,248,249],{},[250,251],"img",{"alt":252,"src":253},"Signed commits","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397840/blog/Content%20Images/2023-09-07-how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance/signed-commits.png",[12,255,256],{},"Signed commits verified and unverified badges",[95,258,260],{"id":259},"utilize-two-person-rules-2pr-for-all-code-updates","Utilize two-person rules (2PR) for all code updates",[12,262,263],{},[102,264,265],{},"\"No single developer should be able to check in code without another developer\nreviewing and approving the changes.\"",[12,267,268,269,274],{},"GitLab enables users to configure their ",[16,270,273],{"href":271,"rel":272},"https://docs.gitlab.com/user/project/merge_requests/approvals/",[],"merge requests"," (MRs) so that they must be approved before they can be merged. MR approvals allow users to set the minimum number of required approvals before work can merge into a project. Some examples of rules you can create include:",[43,276,277,280,288,297],{},[46,278,279],{},"Users with specific permissions can always approve work.",[46,281,282,287],{},[16,283,286],{"href":284,"rel":285},"https://docs.gitlab.com/user/project/codeowners/",[],"Code owners"," can approve work for files they own.",[46,289,290,291,296],{},"Users with specific permissions can approve work, ",[16,292,295],{"href":293,"rel":294},"https://docs.gitlab.com/user/project/merge_requests/approvals/rules/#merge-request-approval-segregation-of-duties",[],"even if they don’t have merge rights"," to the repository.",[46,298,299,300,75],{},"Users with specific permissions can be allowed or denied the ability to ",[16,301,304],{"href":302,"rel":303},"https://docs.gitlab.com/user/project/merge_requests/approvals/rules/#edit-or-override-merge-request-approval-rules",[],"override approval rules on a specific MR",[12,306,307,308,113,313,318],{},"GitLab's MR approval ",[16,309,312],{"href":310,"rel":311},"https://docs.gitlab.com/user/project/merge_requests/approvals/rules/",[],"rules",[16,314,317],{"href":315,"rel":316},"https://docs.gitlab.com/user/project/merge_requests/approvals/settings/",[],"settings"," can be configured and adapted to meet your organization's requirements and align with your risk tolerance.",[12,320,321],{},[250,322],{"alt":323,"src":324},"MR approval settings","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397840/blog/Content%20Images/2023-09-07-how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance/mr-approval-settings.png",[12,326,327],{},"Example of MR approval requirements",[95,329,331],{"id":330},"implement-least-privilege-policies-for-cicd-access","Implement least-privilege policies for CI/CD access",[12,333,334],{},[102,335,336],{},"\"The CI/CD pipeline should not be accessible by everyone in the organization.\"\n\"Mitigate password risks by implementing multi-factor authentication (MFA).\"",[12,338,339,340,345],{},"GitLab enables you to ",[16,341,344],{"href":342,"rel":343},"https://docs.gitlab.com/user/permissions/",[],"assign users a role"," when you add them to a project or group. A user’s role determines the actions they can take within your GitLab instance. The following roles are available for assignment:",[43,347,348,351,354,357,360,363],{},[46,349,350],{},"Guest (private and internal projects only)",[46,352,353],{},"Reporter",[46,355,356],{},"Developer",[46,358,359],{},"Maintainer",[46,361,362],{},"Owner",[46,364,365],{},"Minimal access (available for the top-level group only)",[12,367,368,369,374],{},"GitLab's role-based access control (RBAC) model enables you to limit a user’s permissions in accordance with the ",[16,370,373],{"href":371,"rel":372},"https://csrc.nist.gov/glossary/term/least_privilege",[],"principle of least privilege"," and your business and information security requirements.",[12,376,377,378,382],{},"As mentioned ",[16,379,381],{"href":380},"#minimize-the-use-of-long-term-credentials","above",", GitLab supports two-factor authentication and can integrate with several SSO providers to support your tech stack and help you centralize authentication and authorization responsibilities.",[95,384,386],{"id":385},"secure-user-accounts","Secure user accounts",[12,388,389],{},[102,390,391],{},"\"Regularly audit administrative user accounts and configure access controls under the\nprinciples of least privilege and separation of duties. Audit logs to ensure new accounts\nare legitimate.\"",[12,393,394,395,399],{},"As mentioned in the ",[16,396,398],{"href":397},"#implement-least-privilege-policies-for-cicd-access","previous section",", GitLab enables you to assign roles and associated permissions to your users in a way that aligns with your business and information security requirements. GitLab's authorization feature enables you to support the principle of least privilege and the concept of separation of duties.",[12,401,402],{},"Keep reading to understand how GitLab supports the NSA and CISA's audit log guidance.",[95,404,406],{"id":405},"secure-secrets","Secure secrets",[12,408,409],{},[102,410,411],{},"\"Secure handling of secrets, tokens, and other credentials is crucial in a CI/CD pipeline.\"",[12,413,107,414,419],{},[16,415,418],{"href":416,"rel":417},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"secret detection"," enables users to scan their repositories for exposed secrets and take action based on the scan results.",[12,421,422,423,113,428,433,434,75],{},"With secret detection, users can see scan results in multiple places such as GitLab's ",[16,424,427],{"href":425,"rel":426},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"vulnerability report",[16,429,432],{"href":430,"rel":431},"https://docs.gitlab.com/user/application_security/security_dashboard/",[],"security dashboard",", and users can configure ",[16,435,438],{"href":436,"rel":437},"https://docs.gitlab.com/user/application_security/secret_detection/automatic_response/",[],"automatic responses to leaked secrets",[87,440,442],{"id":441},"development-process-mitigations","Development process mitigations",[12,444,445],{},"Here are features that support development process mitigations.",[95,447,449],{"id":448},"integrate-security-scanning-as-part-of-the-cicd-pipeline","Integrate security scanning as part of the CI/CD pipeline",[12,451,452],{},[102,453,454],{},"\"Include security scanning early in the CI/CD process.\"",[12,456,457],{},"The CSI recommends the implementation of the following tools:",[43,459,460,463,466],{},[46,461,462],{},"static application security testing (SAST)",[46,464,465],{},"registry scanning",[46,467,468],{},"dynamic analysis security testing",[12,470,471,472,477,478,477,483,488,489,494,495,500],{},"GitLab supports these recommendations through its ",[16,473,476],{"href":474,"rel":475},"https://docs.gitlab.com/user/application_security/sast/",[],"SAST",", ",[16,479,482],{"href":480,"rel":481},"https://docs.gitlab.com/user/application_security/dast/",[],"dynamic application security testing (DAST)",[16,484,487],{"href":485,"rel":486},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"container scanning",", and ",[16,490,493],{"href":491,"rel":492},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"dependency scanning"," features. GitLab also offers additional scanning features such as ",[16,496,499],{"href":497,"rel":498},"https://docs.gitlab.com/ci/testing/code_quality/",[],"code quality"," and dynamic API security testing (DAST API).",[12,502,503,504,509],{},"Together, these ",[16,505,508],{"href":506,"rel":507},"https://about.gitlab.com/pricing/feature-comparison/",[],"Secure stage"," features provide comprehensive coverage to help you write secure code faster.",[95,511,513],{"id":512},"restrict-untrusted-libraries-and-tools","Restrict untrusted libraries and tools",[12,515,516],{},[102,517,518],{},"\"Only use software, tools, libraries, and artifacts from secure and trusted sources.\"",[12,520,521,522,525],{},"In addition to ",[16,523,493],{"href":491,"rel":524},[],", GitLab's license compliance feature enables organizations to incorporate trusted dependencies into their codebase that meet their unique business and security requirements.",[12,527,528],{},"With license compliance, you can check that your dependencies' licenses are compatible with your business and security requirements, and you can approve or deny dependencies based on configured license approval policies.",[12,530,531],{},"Note: License compliance is only available for GitLab Ultimate users.",[95,533,535],{"id":534},"analyze-committed-code","Analyze committed code",[12,537,538],{},[102,539,540],{},"\"Securing the CI/CD pipeline involves analyzing the code that is being committed, which can be achieved manually or by using automated tools.\"",[12,542,543],{},"As an all-inclusive DevSecOps platform, GitLab supports a seamless and comprehensive approach to reviewing code changes.",[12,545,546,547,550],{},"With the scanning features mentioned ",[16,548,381],{"href":549},"#integrate-security-scanning-as-part-of-the-cicd-pipeline",", you can enable automated code reviews to help identify vulnerabilities, logic flaws, and policy violations.",[12,552,107,553,558,559,564],{},[16,554,557],{"href":555,"rel":556},"https://docs.gitlab.com/user/project/merge_requests/reviews/",[],"MR review"," feature streamlines the manual code review process. ",[16,560,563],{"href":561,"rel":562},"https://docs.gitlab.com/user/project/merge_requests/reviews/#suggested-reviewers",[],"Suggested Reviewers"," makes it easy to identify users who are authorized to review and merge your changes.",[12,566,567],{},[250,568],{"alt":563,"src":569},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397841/blog/Content%20Images/2023-09-07-how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance/suggested-reviewers.png",[12,571,563],{},[12,573,574,575,113,578,581],{},"MR approval ",[16,576,312],{"href":310,"rel":577},[],[16,579,317],{"href":315,"rel":580},[]," help ensure your code review requirements are enforced in a programmatic way.",[95,583,585],{"id":584},"remove-any-temporary-resources","Remove any temporary resources",[12,587,588],{},[102,589,590],{},"\"A CI/CD pipeline may also create temporary resources, such as virtual machines or Kubernetes clusters, to run tests. While test environments are usually always live, these temporary resources are meant to be created for a single test purpose and must be destroyed after the pipeline run.\"",[12,592,593,594,75],{},"Within GitLab, a temporary runner VM hosts and runs each CI job. GitLab automatically issues a command to remove the temporary runner VM immediately after the CI job completes. Additional details on this process can be found in our documentation for ",[16,595,598],{"href":596,"rel":597},"https://docs.gitlab.com/ci/runners/#security-for-saas-runners",[],"Security for SaaS runners",[95,600,602],{"id":601},"keep-audit-logs","Keep audit logs",[12,604,605],{},[102,606,607],{},"\"An audit log should provide clear information on who committed, reviewed, and deployed what, when, and where.\"",[12,609,610,611,616],{},"As outlined in this ",[16,612,615],{"href":613,"rel":614},"https://about.gitlab.com/blog/how-gitlab-can-support-your-iso-compliance-journey/",[],"blog post",", GitLab enables you to use audit events to track important events, including who performed the related action and when. Audit events cover a broad range of categories, including:",[43,618,619,622,625,628,631,634],{},[46,620,621],{},"group management",[46,623,624],{},"authentication and authorization",[46,626,627],{},"user management",[46,629,630],{},"compliance and security",[46,632,633],{},"CI/CD",[46,635,636],{},"GitLab Runners",[12,638,639],{},[250,640],{"alt":641,"src":642},"Audit events","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397834/blog/Content%20Images/2023-08-24-how-gitlab-can-support-your-iso-compliance-journey/example-of-an-audit-event.png",[12,644,645],{},"Example of an audit event",[12,647,648,649,654],{},"For ",[16,650,653],{"href":651,"rel":652},"https://about.gitlab.com/pricing/ultimate/",[],"Ultimate"," customers, audit event streaming can be enabled. Audit event streaming enables users to set a streaming destination for a top-level group or instance to receive all audit events about the group, subgroups, and projects, as structured JSON.",[95,656,658],{"id":657},"implement-an-sbom-and-sca","Implement an SBOM and SCA",[12,660,661],{},[102,662,663],{},"\"A software bill of materials (SBOM) and software composition analysis (SCA) can play a useful role in the software development lifecycle (SDLC) and in DevSecOps by helping to track all third-party and open source components in the codebase.\"",[12,665,107,666,671],{},[16,667,670],{"href":668,"rel":669},"https://docs.gitlab.com/user/application_security/dependency_list/",[],"dependency list"," feature enables you to review your project or group’s dependencies, including their known vulnerabilities.",[12,673,674,675,679],{},"Combining GitLab's dependency list feature with its ",[16,676,678],{"href":677},"#restrict-untrusted-libraries-and-tools","SCA"," suite of features supports a comprehensive strategy for identifying and remediating vulnerabilities and risks within your supply chain.",[12,681,682],{},[250,683],{"alt":684,"src":685},"Dependency List","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397838/blog/Content%20Images/2023-09-07-how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance/dependency-list.png",[12,687,688],{},"Example of dependency list results",[12,690,691],{},"Note: Dependency list is only available for GitLab Ultimate users.",[95,693,695],{"id":694},"plan-build-and-test-for-resiliency","Plan, build, and test for resiliency",[12,697,698],{},[102,699,700],{},"\"Build the pipeline for high availability, and test for disaster recovery periodically.\"",[12,702,703,704,113,709,714,715,75],{},"As a SaaS provider, GitLab prioritizes your resiliency and efficiency needs. We maintain robust ",[16,705,708],{"href":706,"rel":707},"https://handbook.gitlab.com/handbook/business-technology/entapps-documentation/policies/gitlab-business-continuity-plan/",[],"business continuity",[16,710,713],{"href":711,"rel":712},"https://gitlab.com/gitlab-com/gl-infra/readiness/-/blob/master/library/disaster-recovery/index.md",[],"disaster recovery"," strategies to support the availability of the GitLab platform, and we provide helpful strategies for GitLab users to maintain ",[16,716,719],{"href":717,"rel":718},"https://docs.gitlab.com/ci/pipelines/pipeline_efficiency/",[],"pipeline efficiency",[12,721,722,723,75],{},"If you'd like to learn more about what we're doing to maintain the security, confidentiality, and availability of the GitLab platform, please request our ",[16,724,727],{"href":725,"rel":726},"https://trust.gitlab.com/",[],"Customer Assurance Package",[32,729,731],{"id":730},"learn-more","Learn more",[12,733,734],{},"As a comprehensive DevSecOps platform, GitLab supports a broad range of requirements and recommendations. CI/CD environments have become lucrative targets for malicious actors, and the CSI provides excellent guidance for protecting such a critical component of an organization's assets. As a strategic partner, GitLab supports your efforts to safeguard your CI/CD environment and enables you to develop secure software faster.",[12,736,737,738,75],{},"To learn more about these features, have a look at our library of ",[16,739,742],{"href":740,"rel":741},"https://docs.gitlab.com/tutorials/",[],"tutorials",{"title":744,"searchDepth":745,"depth":745,"links":746},"",2,[747,748,753],{"id":34,"depth":745,"text":35},{"id":81,"depth":745,"text":82,"children":749},[750,752],{"id":89,"depth":751,"text":90},3,{"id":441,"depth":751,"text":442},{"id":730,"depth":745,"text":731},"security","2023-09-19","GitLab can support your alignment with NSA and CISA CI/CD recommendations and best practices for cloud-based DevSecOps environments.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749683032/Blog/Hero%20Images/vaultimage.png",{},true,"/en-us/blog/how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance",{"title":5,"description":756,"ogTitle":5,"ogDescription":756,"noIndex":759,"ogImage":760,"ogUrl":765,"ogSiteName":766,"ogType":767,"canonicalUrls":765},"https://about.gitlab.com/blog/how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance","https://about.gitlab.com","article","how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance","en-us/blog/how-gitlab-supports-the-nsa-and-cisa-cicd-security-guidance",[754,771,772,633],"features","customers","BlogPost","Z3FP1D_w4AFvoR5TPrPXlsEHszJQNUboRTXJIUrpgGI",{"logo":776,"freeTrial":781,"sales":786,"login":791,"items":796,"search":1121,"minimal":1152,"duo":1171,"switchNav":1180,"pricingDeployment":1191},{"config":777},{"href":778,"dataGaName":779,"dataGaLocation":780},"/","gitlab logo","header",{"text":782,"config":783},"Get free trial",{"href":784,"dataGaName":785,"dataGaLocation":780},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":787,"config":788},"Request a demo",{"href":789,"dataGaName":790,"dataGaLocation":780},"/sales/?contact-topic=request-demo","sales",{"text":792,"config":793},"Sign in",{"href":794,"dataGaName":795,"dataGaLocation":780},"https://gitlab.com/users/sign_in/","sign in",[797,825,924,929,1043,1099],{"text":798,"config":799,"menu":801},"Platform",{"dataNavLevelOne":800},"platform",{"type":802,"columns":803},"cards",[804,810,818],{"title":798,"description":805,"link":806},"The intelligent orchestration platform for DevSecOps",{"text":807,"config":808},"Explore our Platform",{"href":809,"dataGaName":800,"dataGaLocation":780},"/platform/",{"title":811,"description":812,"link":813},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":814,"config":815},"Meet GitLab Duo",{"href":816,"dataGaName":817,"dataGaLocation":780},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":819,"description":820,"link":821},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":731,"config":822},{"href":823,"dataGaName":824,"dataGaLocation":780},"/why-gitlab/","why gitlab",{"text":826,"left":762,"config":827,"menu":829},"Product",{"dataNavLevelOne":828},"solutions",{"type":830,"link":831,"columns":835,"feature":903},"lists",{"text":832,"config":833},"View all Solutions",{"href":834,"dataGaName":828,"dataGaLocation":780},"/solutions/",[836,859,882],{"title":837,"description":838,"link":839,"items":844},"Automation","CI/CD and automation to accelerate deployment",{"config":840},{"icon":841,"href":842,"dataGaName":843,"dataGaLocation":780},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[845,848,851,855],{"text":633,"config":846},{"href":847,"dataGaLocation":780,"dataGaName":633},"/solutions/continuous-integration/",{"text":811,"config":849},{"href":816,"dataGaLocation":780,"dataGaName":850},"gitlab duo agent platform - product menu",{"text":852,"config":853},"Source Code Management",{"href":854,"dataGaLocation":780,"dataGaName":852},"/solutions/source-code-management/",{"text":856,"config":857},"Automated Software Delivery",{"href":842,"dataGaLocation":780,"dataGaName":858},"Automated software delivery",{"title":860,"description":861,"link":862,"items":867},"Security","Deliver code faster without compromising security",{"config":863},{"href":864,"dataGaName":865,"dataGaLocation":780,"icon":866},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[868,872,877],{"text":869,"config":870},"Application Security Testing",{"href":864,"dataGaName":871,"dataGaLocation":780},"Application security testing",{"text":873,"config":874},"Software Supply Chain Security",{"href":875,"dataGaLocation":780,"dataGaName":876},"/solutions/supply-chain/","Software supply chain security",{"text":878,"config":879},"Software Compliance",{"href":880,"dataGaName":881,"dataGaLocation":780},"/solutions/software-compliance/","software compliance",{"title":883,"link":884,"items":889},"Measurement",{"config":885},{"icon":886,"href":887,"dataGaName":888,"dataGaLocation":780},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[890,894,898],{"text":891,"config":892},"Visibility & Measurement",{"href":887,"dataGaLocation":780,"dataGaName":893},"Visibility and Measurement",{"text":895,"config":896},"Value Stream Management",{"href":897,"dataGaLocation":780,"dataGaName":895},"/solutions/value-stream-management/",{"text":899,"config":900},"Analytics & Insights",{"href":901,"dataGaLocation":780,"dataGaName":902},"/solutions/analytics-and-insights/","Analytics and insights",{"title":904,"type":830,"items":905},"GitLab for",[906,912,918],{"text":907,"config":908},"Enterprise",{"icon":909,"href":910,"dataGaLocation":780,"dataGaName":911},"Building","/enterprise/","enterprise",{"text":913,"config":914},"Small Business",{"icon":915,"href":916,"dataGaLocation":780,"dataGaName":917},"Work","/small-business/","small business",{"text":919,"config":920},"Public Sector",{"icon":921,"href":922,"dataGaLocation":780,"dataGaName":923},"Organization","/solutions/public-sector/","public sector",{"text":925,"config":926},"Pricing",{"href":927,"dataGaName":928,"dataGaLocation":780,"dataNavLevelOne":928},"/pricing/","pricing",{"text":930,"config":931,"menu":933},"Resources",{"dataNavLevelOne":932},"resources",{"type":830,"link":934,"columns":938,"feature":1032},{"text":935,"config":936},"View all resources",{"href":937,"dataGaName":932,"dataGaLocation":780},"/resources/",[939,972,999],{"title":940,"items":941},"Getting started",[942,947,952,957,962,967],{"text":943,"config":944},"Install",{"href":945,"dataGaName":946,"dataGaLocation":780},"/install/","install",{"text":948,"config":949},"Quick start guides",{"href":950,"dataGaName":951,"dataGaLocation":780},"/get-started/","quick setup checklists",{"text":953,"config":954},"Learn",{"href":955,"dataGaLocation":780,"dataGaName":956},"https://university.gitlab.com/","learn",{"text":958,"config":959},"Product documentation",{"href":960,"dataGaName":961,"dataGaLocation":780},"https://docs.gitlab.com/","product documentation",{"text":963,"config":964},"Best practice videos",{"href":965,"dataGaName":966,"dataGaLocation":780},"/getting-started-videos/","best practice videos",{"text":968,"config":969},"Integrations",{"href":970,"dataGaName":971,"dataGaLocation":780},"/integrations/","integrations",{"title":973,"items":974},"Discover",[975,980,985,990,994],{"text":976,"config":977},"Customer success stories",{"href":978,"dataGaName":979,"dataGaLocation":780},"/customers/","customer success stories",{"text":981,"config":982},"Blog",{"href":983,"dataGaName":984,"dataGaLocation":780},"/blog/","blog",{"text":986,"config":987},"Demo Hub",{"href":988,"dataGaName":989,"dataGaLocation":780},"/demo-hub/","demo hub",{"text":991,"config":992},"The Source",{"href":993,"dataGaName":984,"dataGaLocation":780},"/the-source/",{"text":995,"config":996},"Remote",{"href":997,"dataGaName":998,"dataGaLocation":780},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1000,"items":1001},"Connect",[1002,1007,1012,1017,1022,1027],{"text":1003,"config":1004},"GitLab Services",{"href":1005,"dataGaName":1006,"dataGaLocation":780},"/services/","services",{"text":1008,"config":1009},"Contribute",{"href":1010,"dataGaName":1011,"dataGaLocation":780},"https://contributors.gitlab.com","contribute",{"text":1013,"config":1014},"Community",{"href":1015,"dataGaName":1016,"dataGaLocation":780},"/community/","community",{"text":1018,"config":1019},"Forum",{"href":1020,"dataGaName":1021,"dataGaLocation":780},"https://forum.gitlab.com/","forum",{"text":1023,"config":1024},"Events",{"href":1025,"dataGaName":1026,"dataGaLocation":780},"/events/","events",{"text":1028,"config":1029},"Partners",{"href":1030,"dataGaName":1031,"dataGaLocation":780},"/partners/","partners",{"config":1033,"title":1036,"text":1037,"link":1038},{"background":1034,"textColor":1035},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1039,"config":1040},"Read the latest",{"href":1041,"dataGaName":1042,"dataGaLocation":780},"/whats-new/","whats new",{"text":1044,"config":1045,"menu":1047},"Company",{"dataNavLevelOne":1046},"company",{"type":830,"columns":1048},[1049],{"items":1050},[1051,1056,1062,1064,1069,1074,1079,1084,1089,1094],{"text":1052,"config":1053},"About",{"href":1054,"dataGaName":1055,"dataGaLocation":780},"/company/","about",{"text":1057,"config":1058,"footerGa":1061},"Jobs",{"href":1059,"dataGaName":1060,"dataGaLocation":780},"/jobs/","jobs",{"dataGaName":1060},{"text":1023,"config":1063},{"href":1025,"dataGaName":1026,"dataGaLocation":780},{"text":1065,"config":1066},"Leadership",{"href":1067,"dataGaName":1068,"dataGaLocation":780},"/company/team/e-group/","leadership",{"text":1070,"config":1071},"Handbook",{"href":1072,"dataGaName":1073,"dataGaLocation":780},"https://handbook.gitlab.com/","handbook",{"text":1075,"config":1076},"Investor relations",{"href":1077,"dataGaName":1078,"dataGaLocation":780},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1080,"config":1081},"Trust Center",{"href":1082,"dataGaName":1083,"dataGaLocation":780},"/security/","trust center",{"text":1085,"config":1086},"AI Transparency Center",{"href":1087,"dataGaName":1088,"dataGaLocation":780},"/ai-transparency-center/","ai transparency center",{"text":1090,"config":1091},"Newsletter",{"href":1092,"dataGaName":1093,"dataGaLocation":780},"/company/contact/#contact-forms","newsletter",{"text":1095,"config":1096},"Press",{"href":1097,"dataGaName":1098,"dataGaLocation":780},"/press/","press",{"text":1100,"config":1101,"menu":1102},"Contact us",{"dataNavLevelOne":1046},{"type":830,"columns":1103},[1104],{"items":1105},[1106,1111,1116],{"text":1107,"config":1108},"Talk to sales",{"href":1109,"dataGaName":1110,"dataGaLocation":780},"/sales/","talk to sales",{"text":1112,"config":1113},"Support portal",{"href":1114,"dataGaName":1115,"dataGaLocation":780},"https://support.gitlab.com/hc/en-us","support portal",{"text":1117,"config":1118},"Customer portal",{"href":1119,"dataGaName":1120,"dataGaLocation":780},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1122,"login":1123,"suggestions":1130},"Close",{"text":1124,"link":1125},"To search repositories and projects, login to",{"text":1126,"config":1127},"gitlab.com",{"href":794,"dataGaName":1128,"dataGaLocation":1129},"search login","search",{"text":1131,"default":1132},"Suggestions",[1133,1135,1139,1141,1145,1149],{"text":811,"config":1134},{"href":816,"dataGaName":811,"dataGaLocation":1129},{"text":1136,"config":1137},"Code Suggestions (AI)",{"href":1138,"dataGaName":1136,"dataGaLocation":1129},"/solutions/code-suggestions/",{"text":633,"config":1140},{"href":847,"dataGaName":633,"dataGaLocation":1129},{"text":1142,"config":1143},"GitLab on AWS",{"href":1144,"dataGaName":1142,"dataGaLocation":1129},"/partners/technology-partners/aws/",{"text":1146,"config":1147},"GitLab on Google Cloud",{"href":1148,"dataGaName":1146,"dataGaLocation":1129},"/partners/technology-partners/google-cloud-platform/",{"text":1150,"config":1151},"Why GitLab?",{"href":823,"dataGaName":1150,"dataGaLocation":1129},{"freeTrial":1153,"mobileIcon":1158,"desktopIcon":1163,"secondaryButton":1166},{"text":1154,"config":1155},"Start free trial",{"href":1156,"dataGaName":785,"dataGaLocation":1157},"https://gitlab.com/-/trials/new/","nav",{"altText":1159,"config":1160},"Gitlab Icon",{"src":1161,"dataGaName":1162,"dataGaLocation":1157},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1159,"config":1164},{"src":1165,"dataGaName":1162,"dataGaLocation":1157},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1167,"config":1168},"Get Started",{"href":1169,"dataGaName":1170,"dataGaLocation":1157},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1172,"mobileIcon":1176,"desktopIcon":1178},{"text":1173,"config":1174},"Learn more about GitLab Duo",{"href":816,"dataGaName":1175,"dataGaLocation":1157},"gitlab duo",{"altText":1159,"config":1177},{"src":1161,"dataGaName":1162,"dataGaLocation":1157},{"altText":1159,"config":1179},{"src":1165,"dataGaName":1162,"dataGaLocation":1157},{"button":1181,"mobileIcon":1186,"desktopIcon":1188},{"text":1182,"config":1183},"/switch",{"href":1184,"dataGaName":1185,"dataGaLocation":1157},"#contact","switch",{"altText":1159,"config":1187},{"src":1161,"dataGaName":1162,"dataGaLocation":1157},{"altText":1159,"config":1189},{"src":1190,"dataGaName":1162,"dataGaLocation":1157},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1192,"mobileIcon":1197,"desktopIcon":1199},{"text":1193,"config":1194},"Back to pricing",{"href":927,"dataGaName":1195,"dataGaLocation":1157,"icon":1196},"back to pricing","GoBack",{"altText":1159,"config":1198},{"src":1161,"dataGaName":1162,"dataGaLocation":1157},{"altText":1159,"config":1200},{"src":1165,"dataGaName":1162,"dataGaLocation":1157},{"title":1202,"titleMobile":1203,"button":1204,"config":1209},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":731,"config":1205},{"href":1206,"dataGaName":1207,"dataGaLocation":1208},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1210,"disabled":759},"release",{"data":1212},{"text":1213,"source":1214,"edit":1220,"contribute":1225,"config":1230,"items":1235,"minimal":1445},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1215,"config":1216},"View page source",{"href":1217,"dataGaName":1218,"dataGaLocation":1219},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1221,"config":1222},"Edit this page",{"href":1223,"dataGaName":1224,"dataGaLocation":1219},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1226,"config":1227},"Please contribute",{"href":1228,"dataGaName":1229,"dataGaLocation":1219},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1231,"facebook":1232,"youtube":1233,"linkedin":1234},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1236,1283,1337,1381,1413],{"title":925,"links":1237,"subMenu":1252},[1238,1242,1247],{"text":1239,"config":1240},"View plans",{"href":927,"dataGaName":1241,"dataGaLocation":1219},"view plans",{"text":1243,"config":1244},"Why Premium?",{"href":1245,"dataGaName":1246,"dataGaLocation":1219},"/pricing/premium/","why premium",{"text":1248,"config":1249},"Why Ultimate?",{"href":1250,"dataGaName":1251,"dataGaLocation":1219},"/pricing/ultimate/","why ultimate",[1253],{"title":1254,"links":1255},"Contact Us",[1256,1259,1261,1263,1268,1273,1278],{"text":1257,"config":1258},"Contact sales",{"href":1109,"dataGaName":790,"dataGaLocation":1219},{"text":1112,"config":1260},{"href":1114,"dataGaName":1115,"dataGaLocation":1219},{"text":1117,"config":1262},{"href":1119,"dataGaName":1120,"dataGaLocation":1219},{"text":1264,"config":1265},"Status",{"href":1266,"dataGaName":1267,"dataGaLocation":1219},"https://status.gitlab.com/","status",{"text":1269,"config":1270},"Terms of use",{"href":1271,"dataGaName":1272,"dataGaLocation":1219},"/terms/","terms of use",{"text":1274,"config":1275},"Privacy statement",{"href":1276,"dataGaName":1277,"dataGaLocation":1219},"/privacy/","privacy statement",{"text":1279,"config":1280},"Cookie preferences",{"dataGaName":1281,"dataGaLocation":1219,"id":1282,"isOneTrustButton":762},"cookie preferences","ot-sdk-btn",{"title":826,"links":1284,"subMenu":1293},[1285,1289],{"text":1286,"config":1287},"DevSecOps platform",{"href":809,"dataGaName":1288,"dataGaLocation":1219},"devsecops platform",{"text":1290,"config":1291},"AI-Assisted Development",{"href":816,"dataGaName":1292,"dataGaLocation":1219},"ai-assisted development",[1294],{"title":1295,"links":1296},"Topics",[1297,1302,1307,1312,1317,1322,1327,1332],{"text":1298,"config":1299},"CICD",{"href":1300,"dataGaName":1301,"dataGaLocation":1219},"/topics/ci-cd/","cicd",{"text":1303,"config":1304},"GitOps",{"href":1305,"dataGaName":1306,"dataGaLocation":1219},"/topics/gitops/","gitops",{"text":1308,"config":1309},"DevOps",{"href":1310,"dataGaName":1311,"dataGaLocation":1219},"/topics/devops/","devops",{"text":1313,"config":1314},"Version Control",{"href":1315,"dataGaName":1316,"dataGaLocation":1219},"/topics/version-control/","version control",{"text":1318,"config":1319},"DevSecOps",{"href":1320,"dataGaName":1321,"dataGaLocation":1219},"/topics/devsecops/","devsecops",{"text":1323,"config":1324},"Cloud Native",{"href":1325,"dataGaName":1326,"dataGaLocation":1219},"/topics/cloud-native/","cloud native",{"text":1328,"config":1329},"AI for Coding",{"href":1330,"dataGaName":1331,"dataGaLocation":1219},"/topics/devops/ai-for-coding/","ai for coding",{"text":1333,"config":1334},"Agentic AI",{"href":1335,"dataGaName":1336,"dataGaLocation":1219},"/topics/agentic-ai/","agentic ai",{"title":1338,"links":1339},"Solutions",[1340,1342,1344,1349,1353,1356,1360,1363,1365,1368,1371,1376],{"text":869,"config":1341},{"href":864,"dataGaName":869,"dataGaLocation":1219},{"text":858,"config":1343},{"href":842,"dataGaName":843,"dataGaLocation":1219},{"text":1345,"config":1346},"Agile development",{"href":1347,"dataGaName":1348,"dataGaLocation":1219},"/solutions/agile-delivery/","agile delivery",{"text":1350,"config":1351},"SCM",{"href":854,"dataGaName":1352,"dataGaLocation":1219},"source code management",{"text":1298,"config":1354},{"href":847,"dataGaName":1355,"dataGaLocation":1219},"continuous integration & delivery",{"text":1357,"config":1358},"Value stream management",{"href":897,"dataGaName":1359,"dataGaLocation":1219},"value stream management",{"text":1303,"config":1361},{"href":1362,"dataGaName":1306,"dataGaLocation":1219},"/solutions/gitops/",{"text":907,"config":1364},{"href":910,"dataGaName":911,"dataGaLocation":1219},{"text":1366,"config":1367},"Small business",{"href":916,"dataGaName":917,"dataGaLocation":1219},{"text":1369,"config":1370},"Public sector",{"href":922,"dataGaName":923,"dataGaLocation":1219},{"text":1372,"config":1373},"Education",{"href":1374,"dataGaName":1375,"dataGaLocation":1219},"/solutions/education/","education",{"text":1377,"config":1378},"Financial services",{"href":1379,"dataGaName":1380,"dataGaLocation":1219},"/solutions/finance/","financial services",{"title":930,"links":1382},[1383,1385,1387,1389,1392,1394,1397,1399,1401,1403,1405,1407,1409,1411],{"text":943,"config":1384},{"href":945,"dataGaName":946,"dataGaLocation":1219},{"text":948,"config":1386},{"href":950,"dataGaName":951,"dataGaLocation":1219},{"text":953,"config":1388},{"href":955,"dataGaName":956,"dataGaLocation":1219},{"text":958,"config":1390},{"href":960,"dataGaName":1391,"dataGaLocation":1219},"docs",{"text":981,"config":1393},{"href":983,"dataGaName":984,"dataGaLocation":1219},{"text":1395,"config":1396},"What's new",{"href":1041,"dataGaName":1042,"dataGaLocation":1219},{"text":976,"config":1398},{"href":978,"dataGaName":979,"dataGaLocation":1219},{"text":995,"config":1400},{"href":997,"dataGaName":998,"dataGaLocation":1219},{"text":1003,"config":1402},{"href":1005,"dataGaName":1006,"dataGaLocation":1219},{"text":1008,"config":1404},{"href":1010,"dataGaName":1011,"dataGaLocation":1219},{"text":1013,"config":1406},{"href":1015,"dataGaName":1016,"dataGaLocation":1219},{"text":1018,"config":1408},{"href":1020,"dataGaName":1021,"dataGaLocation":1219},{"text":1023,"config":1410},{"href":1025,"dataGaName":1026,"dataGaLocation":1219},{"text":1028,"config":1412},{"href":1030,"dataGaName":1031,"dataGaLocation":1219},{"title":1044,"links":1414},[1415,1417,1419,1421,1423,1425,1429,1434,1436,1438,1440],{"text":1052,"config":1416},{"href":1054,"dataGaName":1046,"dataGaLocation":1219},{"text":1057,"config":1418},{"href":1059,"dataGaName":1060,"dataGaLocation":1219},{"text":1065,"config":1420},{"href":1067,"dataGaName":1068,"dataGaLocation":1219},{"text":1070,"config":1422},{"href":1072,"dataGaName":1073,"dataGaLocation":1219},{"text":1075,"config":1424},{"href":1077,"dataGaName":1078,"dataGaLocation":1219},{"text":1426,"config":1427},"Sustainability",{"href":1428,"dataGaName":1426,"dataGaLocation":1219},"/sustainability/",{"text":1430,"config":1431},"Diversity, inclusion and belonging (DIB)",{"href":1432,"dataGaName":1433,"dataGaLocation":1219},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1080,"config":1435},{"href":1082,"dataGaName":1083,"dataGaLocation":1219},{"text":1090,"config":1437},{"href":1092,"dataGaName":1093,"dataGaLocation":1219},{"text":1095,"config":1439},{"href":1097,"dataGaName":1098,"dataGaLocation":1219},{"text":1441,"config":1442},"Modern Slavery Transparency Statement",{"href":1443,"dataGaName":1444,"dataGaLocation":1219},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1446},[1447,1450,1453],{"text":1448,"config":1449},"Terms",{"href":1271,"dataGaName":1272,"dataGaLocation":1219},{"text":1451,"config":1452},"Cookies",{"dataGaName":1281,"dataGaLocation":1219,"id":1282,"isOneTrustButton":762},{"text":1454,"config":1455},"Privacy",{"href":1276,"dataGaName":1277,"dataGaLocation":1219},[1457],{"id":1458,"title":7,"body":758,"config":1459,"content":1461,"description":758,"extension":1465,"meta":1466,"navigation":762,"path":1467,"seo":1468,"stem":1469,"__hash__":1470},"blogAuthors/en-us/blog/authors/joseph-longo.yml",{"template":1460},"BlogAuthor",{"name":7,"config":1462},{"headshot":1463,"ctfId":1464},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659681/Blog/Author%20Headshots/jlongo_gitlab-headshot.jpg","jlongogitlab","yml",{},"/en-us/blog/authors/joseph-longo",{},"en-us/blog/authors/joseph-longo","VIlsk9hPcH3cl865aygtOArC3lR9vjVvQqDgvE-S7qU",[1472,1480,1488],{"title":1473,"description":1474,"heroImage":1475,"category":754,"date":1476,"authors":1477,"slug":1479,"externalUrl":758},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1478],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1481,"description":1482,"heroImage":1475,"category":754,"date":1483,"authors":1484,"slug":1487,"externalUrl":758},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1485,1486],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1489,"description":1490,"heroImage":1491,"category":754,"date":1492,"authors":1493,"slug":1495,"externalUrl":758},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1494],"Alisa Ho","claude-security-and-gitlab",{"promotions":1497},[1498,1512,1524,1535],{"id":1499,"categories":1500,"header":1502,"text":1503,"button":1504,"image":1509},"ai-modernization",[1501],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1505,"config":1506},"Get your AI maturity score",{"href":1507,"dataGaName":1508,"dataGaLocation":984},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1510},{"src":1511},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1513,"categories":1514,"header":1516,"text":1503,"button":1517,"image":1521},"devops-modernization",[1515,1321],"product","Are you just managing tools or shipping innovation?",{"text":1518,"config":1519},"Get your DevOps maturity score",{"href":1520,"dataGaName":1508,"dataGaLocation":984},"/assessments/devops-modernization-assessment/",{"config":1522},{"src":1523},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1525,"categories":1526,"header":1527,"text":1503,"button":1528,"image":1532},"security-modernization",[754],"Are you trading speed for security?",{"text":1529,"config":1530},"Get your security maturity score",{"href":1531,"dataGaName":1508,"dataGaLocation":984},"/assessments/security-modernization-assessment/",{"config":1533},{"src":1534},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1536,"paths":1537,"header":1540,"text":1541,"button":1542,"image":1547},"github-azure-migration",[1538,1539],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1543,"config":1544},"See how GitLab compares to GitHub",{"href":1545,"dataGaName":1546,"dataGaLocation":984},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1548},{"src":1523},{"header":1550,"blurb":1551,"button":1552,"secondaryButton":1557},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1553,"config":1554},"Get your free trial",{"href":1555,"dataGaName":785,"dataGaLocation":1556},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1257,"config":1558},{"href":1109,"dataGaName":790,"dataGaLocation":1556},1786803769583]