[{"data":1,"prerenderedAt":1040},["ShallowReactive",2],{"/blog/how-to-fuzz-rust-code":3,"navigation-en-us":254,"banner-en-us":682,"footer-en-us":692,"blog-post-authors-en-us-Yevgeny Pats":936,"blog-related-posts-en-us-how-to-fuzz-rust-code":950,"blog-promotions-en-us":976,"next-steps-en-us":1030},{"id":4,"title":5,"authors":6,"body":8,"category":233,"date":234,"description":235,"extension":236,"externalUrl":237,"faq":237,"featured":238,"heroImage":239,"meta":240,"navigation":241,"path":242,"seo":243,"slug":247,"stem":248,"tags":249,"template":252,"updatedDate":237,"__hash__":253},"blogPosts/en-us/blog/how-to-fuzz-rust-code.md","How to fuzz Rust code continuously",[7],"Yevgeny Pats",{"type":9,"value":10,"toc":225},"minimark",[11,15,20,29,37,41,49,58,61,70,73,83,87,90,98,107,113,121,127,130,136,139,143,155,161,168,189,197,211],[12,13,14],"p",{},"This blog post was originally published on the GitLab Unfiltered blog. It was reviewed and republished on 2020-12-17.",[16,17,19],"h2",{"id":18},"what-is-fuzzing","What is fuzzing?",[12,21,22,23,28],{},"Fuzzing, also called ",[24,25,27],"a",{"href":26},"/topics/devsecops/what-is-fuzz-testing/","fuzz testing",", is an automated software technique that involves providing semi-random data as an input to the test program in order to uncover bugs and crashes.",[12,30,31,32,36],{},"In this short tutorial we will discuss using ",[33,34,35],"code",{},"cargo-fuzz"," for fuzzing Rust code.",[16,38,40],{"id":39},"why-fuzz-rust-code","Why fuzz Rust code?",[12,42,43,48],{},[24,44,47],{"href":45,"rel":46},"https://www.rust-lang.org/",[],"Rust"," is a safe language (mostly) and memory corruption issues are a thing of the past so we don’t need to fuzz our code, right? Wrong!\nAny code, and especially where stability, quality, and coverage are important, is worth fuzzing.\nFuzzing can uncover logical bugs and denial-of-service issues in critical components that can lead to security issues as well.",[12,50,51,52,57],{},"As a reference to almost infinite amount of bugs found with cargo-fuzz (only the documented one) you can look at ",[24,53,56],{"href":54,"rel":55},"https://github.com/rust-fuzz/trophy-case",[],"the list of bugs found by fuzz-testing Rust codebases",".",[16,59,60],{"id":35},"Cargo-fuzz",[12,62,63,64,69],{},"cargo-fuzz is the current de-facto standard fuzzer for Rust and essentially it is a proxy layer to the well-tested ",[24,65,68],{"href":66,"rel":67},"https://llvm.org/docs/LibFuzzer.html",[],"libFuzzer"," engine.\nThis means the algorithm and the interface is all based on libFuzzer, which is a widely-used, coverage-guided fuzzer for C/C++ and some other languages that implemented a proxy layer – just like cargo-fuzz.",[12,71,72],{},"libFuzzer (cargo-fuzz) and coverage-guided fuzzers in general have the following algorithm:",[74,75,81],"pre",{"className":76,"code":78,"language":79,"meta":80},[77],"language-text","// pseudo code\nInstrument program for code coverage\nfor {\n  Choose random input from corpus\n  Mutate input\n  Execute input and collect coverage\n  If new coverage/paths are hit add it to corpus (corpus - directory with test-cases)\n}\n","text","",[33,82,78],{"__ignoreMap":80},[16,84,86],{"id":85},"building-and-running-the-fuzzer","Building and running the fuzzer",[12,88,89],{},"If you are already familiar with this part you can skip to Continuous Fuzzing section.",[12,91,92,93,57],{},"We will start with ",[24,94,97],{"href":95,"rel":96},"https://gitlab.com/gitlab-org/security-products/demos/coverage-fuzzing/rust-fuzzing-example",[],"rust-fuzzing-example",[12,99,100,101,106],{},"For the sake of the example, we have a simple ",[24,102,105],{"href":103,"rel":104},"https://gitlab.com/gitlab-org/security-products/demos/coverage-fuzzing/rust-fuzzing-example/-/blob/master/src/lib.rs",[],"function"," with an off-by-one bug:",[74,108,111],{"className":109,"code":110,"language":79,"meta":80},[77],"pub fn parse_complex(data: &[u8]) -> bool{\n    if data.len() == 5 {\n        if data[0] == b'F' && data[1] == b'U' && data[2] == b'Z' && data[3] == b'Z' && data[4] == b'I' && data[5] == b'T' {\n            return true\n        }\n    }\n    return true;\n}\n",[33,112,110],{"__ignoreMap":80},[12,114,115,116,120],{},"Our fuzz ",[24,117,105],{"href":118,"rel":119},"https://gitlab.com/gitlab-org/security-products/demos/coverage-fuzzing/rust-fuzzing-example/-/blob/master/fuzz/fuzz_targets/fuzz_parse_complex.rs",[]," will look like this and will be called by libFuzzer in an infinite loop with the generated data, according to the coverage-guided algorithm.",[74,122,125],{"className":123,"code":124,"language":79,"meta":80},[77],"#![no_main]\n#[macro_use] extern crate libfuzzer_sys;\nextern crate example_rust;\n\nfuzz_target!(|data: &[u8]| {\n    let _ = example_rust::parse_complex(&data);\n});\n",[33,126,124],{"__ignoreMap":80},[12,128,129],{},"To run the fuzzer we need to build an instrumented version of the code together with the fuzz function.\ncargo-fuzz is doing for us the heavy lifting so it can be done using the following simple steps:",[74,131,134],{"className":132,"code":133,"language":79,"meta":80},[77],"# cargo-fuzz is available in rust nightly\ndocker run -it rustlang/rust:nightly-stretch /bin/bash\ncargo install cargo-fuzz\n\n# Download the example repo, build, and run the fuzzer\ngit clone https://gitlab.com/gitlab-org/security-products/demos/coverage-fuzzing/rust-fuzzing-example/-/blob/master/fuzz/fuzz_targets/fuzz_parse_complex.rs\ncd example-rust\ncargo fuzz run fuzz_parse_complex\n\n## The output should look like this:\n#524288 pulse  cov: 105 ft: 99 corp: 6/26b lim: 517 exec/s: 131072 rss: 93Mb\n#1048576        pulse  cov: 105 ft: 99 corp: 6/26b lim: 1040 exec/s: 116508 rss: 229Mb\n==2208== ERROR: libFuzzer: deadly signal\n    #0 0x5588b8234961  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0x83961)\n    #1 0x5588b8262dc5  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xb1dc5)\n    #2 0x5588b8284734  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xd3734)\n    #3 0x5588b82845e9  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xd35e9)\n    #4 0x5588b826493a  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xb393a)\n    #5 0x7f93737e70df  (/lib/x86_64-linux-gnu/libpthread.so.0+0x110df)\n    #6 0x7f9373252ffe  (/lib/x86_64-linux-gnu/libc.so.6+0x32ffe)\n    #7 0x7f9373254429  (/lib/x86_64-linux-gnu/libc.so.6+0x34429)\n    #8 0x5588b82a4a06  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xf3a06)\n    #9 0x5588b82a1b75  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xf0b75)\n    #10 0x5588b824fa1b  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0x9ea1b)\n    #11 0x5588b82a442b  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xf342b)\n    #12 0x5588b82a3ee1  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xf2ee1)\n    #13 0x5588b82a3dd5  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xf2dd5)\n    #14 0x5588b82b6cd9  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0x105cd9)\n    #15 0x5588b82b6c94  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0x105c94)\n    #16 0x5588b824edda  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0x9ddda)\n    #17 0x5588b81c45b7  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0x135b7)\n    #18 0x5588b824f7e4  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0x9e7e4)\n    #19 0x5588b827da53  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xcca53)\n    #20 0x5588b82a4a18  (/example-rust/fuzz/target/x86_64-unknown-linux-gnu/debug/fuzz_parse_complex+0xf3a18)\n\nNOTE: libFuzzer has rudimentary signal handlers.\n      Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\nMS: 2 ShuffleBytes-ChangeByte-; base unit: 89b92cdd9bcb9b861c47c0179eff7b3a9baafcde\n0x46,0x55,0x5a,0x5a,0x49,\nFUZZI\nartifact_prefix='/example-rust/fuzz/artifacts/fuzz_parse_complex/'; Test unit written to /example-rust/fuzz/artifacts/fuzz_parse_complex/crash-df779ced6b712c5fca247e465de2de474d1d23b9\nBase64: RlVaWkk=\n",[33,135,133],{"__ignoreMap":80},[12,137,138],{},"This find the bug in a few seconds, prints the “FUZZI” string that triggers the vulnerability and saves it to a file.",[16,140,142],{"id":141},"running-cargo-fuzz-from-ci","Running cargo-fuzz from CI",[12,144,145,146,149,150,57],{},"The best way to integrate go-fuzz fuzzing with Gitlab CI/CD is by adding additional stage and step to your ",[33,147,148],{},".gitlab-ci.yml",". It is straightforward and ",[24,151,154],{"href":152,"rel":153},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/#configuration",[],"fully documented",[74,156,159],{"className":157,"code":158,"language":79,"meta":80},[77],"include:\n  - template: Coverage-Fuzzing.gitlab-ci.yml\n\nmy_fuzz_target:\n  extends: .fuzz_base\n  script:\n    - apt-get update -qq && apt-get install -y -qq git make clang cmake\n    - export CC=`which clang`\n    - export CXX=`which clang++`\n    - cargo install cargo-fuzz\n    - cargo fuzz run fuzz_parse_complex -- -runs=0\n    - ./gitlab-cov-fuzz run --regression=$REGRESSION -- ./fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_parse_complex\n",[33,160,158],{"__ignoreMap":80},[12,162,163,164,167],{},"For each fuzz target you will have to create a step which extends ",[33,165,166],{},".fuzz_base"," that runs the following:",[169,170,171,175,178],"ul",{},[172,173,174],"li",{},"Builds the fuzz target.",[172,176,177],{},"Runs the fuzz target via gitlab-cov-fuzz CLI.",[172,179,180,181,184,185,188],{},"For ",[33,182,183],{},"$CI_DEFAULT_BRANCH"," (can be override by ",[33,186,187],{},"$COV_FUZZING_BRANCH",") will run fully fledged fuzzing sessions. For everything else including MRs will run fuzzing regression with the accumulated corpus and fixed crashes.",[12,190,191,192,57],{},"This will run your fuzz tests in a blocking manner inside your pipeline. There is also a possibility to run longer fuzz sessions asynchronously, as described in the ",[24,193,196],{"href":194,"rel":195},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/#continuous-fuzzing-long-running-async-fuzzing-jobs",[],"docs",[12,198,199,200,205,206,210],{},"Check out our ",[24,201,204],{"href":202,"rel":203},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/",[],"full documentation"," and the ",[24,207,209],{"href":95,"rel":208},[],"example repo"," and try adding fuzz testing to your own repos!",[12,212,213,214,219,220],{},"Cover image by ",[24,215,218],{"href":216,"rel":217},"https://unsplash.com/@sunitalap",[],"Zsolt Palatinus"," on ",[24,221,224],{"href":222,"rel":223},"https://unsplash.com/",[],"Unsplash",{"title":80,"searchDepth":226,"depth":226,"links":227},2,[228,229,230,231,232],{"id":18,"depth":226,"text":19},{"id":39,"depth":226,"text":40},{"id":35,"depth":226,"text":60},{"id":85,"depth":226,"text":86},{"id":141,"depth":226,"text":142},"engineering","2020-12-03","Learn why you should always fuzz test your Rust code, and the code you'll need to do it.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749681441/Blog/Hero%20Images/rust.jpg",{},true,"/en-us/blog/how-to-fuzz-rust-code",{"title":5,"description":235,"ogTitle":5,"ogDescription":235,"noIndex":238,"ogImage":239,"ogUrl":244,"ogSiteName":245,"ogType":246,"canonicalUrls":244},"https://about.gitlab.com/blog/how-to-fuzz-rust-code","https://about.gitlab.com","article","how-to-fuzz-rust-code","en-us/blog/how-to-fuzz-rust-code",[250,251],"open source","tutorial","BlogPost","GMFaT7C4JnO4OtHLkh18Vh83kBqajFCCpm2YQICXxSo",{"logo":255,"freeTrial":260,"sales":265,"login":270,"items":275,"search":602,"minimal":633,"duo":652,"switchNav":661,"pricingDeployment":672},{"config":256},{"href":257,"dataGaName":258,"dataGaLocation":259},"/","gitlab logo","header",{"text":261,"config":262},"Get free trial",{"href":263,"dataGaName":264,"dataGaLocation":259},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":266,"config":267},"Request a demo",{"href":268,"dataGaName":269,"dataGaLocation":259},"/sales/?contact-topic=request-demo","sales",{"text":271,"config":272},"Sign in",{"href":273,"dataGaName":274,"dataGaLocation":259},"https://gitlab.com/users/sign_in/","sign in",[276,305,405,410,524,580],{"text":277,"config":278,"menu":280},"Platform",{"dataNavLevelOne":279},"platform",{"type":281,"columns":282},"cards",[283,289,297],{"title":277,"description":284,"link":285},"The intelligent orchestration platform for DevSecOps",{"text":286,"config":287},"Explore our Platform",{"href":288,"dataGaName":279,"dataGaLocation":259},"/platform/",{"title":290,"description":291,"link":292},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":293,"config":294},"Meet GitLab Duo",{"href":295,"dataGaName":296,"dataGaLocation":259},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":298,"description":299,"link":300},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":301,"config":302},"Learn more",{"href":303,"dataGaName":304,"dataGaLocation":259},"/why-gitlab/","why gitlab",{"text":306,"left":241,"config":307,"menu":309},"Product",{"dataNavLevelOne":308},"solutions",{"type":310,"link":311,"columns":315,"feature":384},"lists",{"text":312,"config":313},"View all Solutions",{"href":314,"dataGaName":308,"dataGaLocation":259},"/solutions/",[316,340,363],{"title":317,"description":318,"link":319,"items":324},"Automation","CI/CD and automation to accelerate deployment",{"config":320},{"icon":321,"href":322,"dataGaName":323,"dataGaLocation":259},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[325,329,332,336],{"text":326,"config":327},"CI/CD",{"href":328,"dataGaLocation":259,"dataGaName":326},"/solutions/continuous-integration/",{"text":290,"config":330},{"href":295,"dataGaLocation":259,"dataGaName":331},"gitlab duo agent platform - product menu",{"text":333,"config":334},"Source Code Management",{"href":335,"dataGaLocation":259,"dataGaName":333},"/solutions/source-code-management/",{"text":337,"config":338},"Automated Software Delivery",{"href":322,"dataGaLocation":259,"dataGaName":339},"Automated software delivery",{"title":341,"description":342,"link":343,"items":348},"Security","Deliver code faster without compromising security",{"config":344},{"href":345,"dataGaName":346,"dataGaLocation":259,"icon":347},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[349,353,358],{"text":350,"config":351},"Application Security Testing",{"href":345,"dataGaName":352,"dataGaLocation":259},"Application security testing",{"text":354,"config":355},"Software Supply Chain Security",{"href":356,"dataGaLocation":259,"dataGaName":357},"/solutions/supply-chain/","Software supply chain security",{"text":359,"config":360},"Software Compliance",{"href":361,"dataGaName":362,"dataGaLocation":259},"/solutions/software-compliance/","software compliance",{"title":364,"link":365,"items":370},"Measurement",{"config":366},{"icon":367,"href":368,"dataGaName":369,"dataGaLocation":259},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[371,375,379],{"text":372,"config":373},"Visibility & Measurement",{"href":368,"dataGaLocation":259,"dataGaName":374},"Visibility and Measurement",{"text":376,"config":377},"Value Stream Management",{"href":378,"dataGaLocation":259,"dataGaName":376},"/solutions/value-stream-management/",{"text":380,"config":381},"Analytics & Insights",{"href":382,"dataGaLocation":259,"dataGaName":383},"/solutions/analytics-and-insights/","Analytics and insights",{"title":385,"type":310,"items":386},"GitLab for",[387,393,399],{"text":388,"config":389},"Enterprise",{"icon":390,"href":391,"dataGaLocation":259,"dataGaName":392},"Building","/enterprise/","enterprise",{"text":394,"config":395},"Small Business",{"icon":396,"href":397,"dataGaLocation":259,"dataGaName":398},"Work","/small-business/","small business",{"text":400,"config":401},"Public Sector",{"icon":402,"href":403,"dataGaLocation":259,"dataGaName":404},"Organization","/solutions/public-sector/","public sector",{"text":406,"config":407},"Pricing",{"href":408,"dataGaName":409,"dataGaLocation":259,"dataNavLevelOne":409},"/pricing/","pricing",{"text":411,"config":412,"menu":414},"Resources",{"dataNavLevelOne":413},"resources",{"type":310,"link":415,"columns":419,"feature":513},{"text":416,"config":417},"View all resources",{"href":418,"dataGaName":413,"dataGaLocation":259},"/resources/",[420,453,480],{"title":421,"items":422},"Getting started",[423,428,433,438,443,448],{"text":424,"config":425},"Install",{"href":426,"dataGaName":427,"dataGaLocation":259},"/install/","install",{"text":429,"config":430},"Quick start guides",{"href":431,"dataGaName":432,"dataGaLocation":259},"/get-started/","quick setup checklists",{"text":434,"config":435},"Learn",{"href":436,"dataGaLocation":259,"dataGaName":437},"https://university.gitlab.com/","learn",{"text":439,"config":440},"Product documentation",{"href":441,"dataGaName":442,"dataGaLocation":259},"https://docs.gitlab.com/","product documentation",{"text":444,"config":445},"Best practice videos",{"href":446,"dataGaName":447,"dataGaLocation":259},"/getting-started-videos/","best practice videos",{"text":449,"config":450},"Integrations",{"href":451,"dataGaName":452,"dataGaLocation":259},"/integrations/","integrations",{"title":454,"items":455},"Discover",[456,461,466,471,475],{"text":457,"config":458},"Customer success stories",{"href":459,"dataGaName":460,"dataGaLocation":259},"/customers/","customer success stories",{"text":462,"config":463},"Blog",{"href":464,"dataGaName":465,"dataGaLocation":259},"/blog/","blog",{"text":467,"config":468},"Demo Hub",{"href":469,"dataGaName":470,"dataGaLocation":259},"/demo-hub/","demo hub",{"text":472,"config":473},"The Source",{"href":474,"dataGaName":465,"dataGaLocation":259},"/the-source/",{"text":476,"config":477},"Remote",{"href":478,"dataGaName":479,"dataGaLocation":259},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":481,"items":482},"Connect",[483,488,493,498,503,508],{"text":484,"config":485},"GitLab Services",{"href":486,"dataGaName":487,"dataGaLocation":259},"/services/","services",{"text":489,"config":490},"Contribute",{"href":491,"dataGaName":492,"dataGaLocation":259},"https://contributors.gitlab.com","contribute",{"text":494,"config":495},"Community",{"href":496,"dataGaName":497,"dataGaLocation":259},"/community/","community",{"text":499,"config":500},"Forum",{"href":501,"dataGaName":502,"dataGaLocation":259},"https://forum.gitlab.com/","forum",{"text":504,"config":505},"Events",{"href":506,"dataGaName":507,"dataGaLocation":259},"/events/","events",{"text":509,"config":510},"Partners",{"href":511,"dataGaName":512,"dataGaLocation":259},"/partners/","partners",{"config":514,"title":517,"text":518,"link":519},{"background":515,"textColor":516},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":520,"config":521},"Read the latest",{"href":522,"dataGaName":523,"dataGaLocation":259},"/whats-new/","whats new",{"text":525,"config":526,"menu":528},"Company",{"dataNavLevelOne":527},"company",{"type":310,"columns":529},[530],{"items":531},[532,537,543,545,550,555,560,565,570,575],{"text":533,"config":534},"About",{"href":535,"dataGaName":536,"dataGaLocation":259},"/company/","about",{"text":538,"config":539,"footerGa":542},"Jobs",{"href":540,"dataGaName":541,"dataGaLocation":259},"/jobs/","jobs",{"dataGaName":541},{"text":504,"config":544},{"href":506,"dataGaName":507,"dataGaLocation":259},{"text":546,"config":547},"Leadership",{"href":548,"dataGaName":549,"dataGaLocation":259},"/company/team/e-group/","leadership",{"text":551,"config":552},"Handbook",{"href":553,"dataGaName":554,"dataGaLocation":259},"https://handbook.gitlab.com/","handbook",{"text":556,"config":557},"Investor relations",{"href":558,"dataGaName":559,"dataGaLocation":259},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":561,"config":562},"Trust Center",{"href":563,"dataGaName":564,"dataGaLocation":259},"/security/","trust center",{"text":566,"config":567},"AI Transparency Center",{"href":568,"dataGaName":569,"dataGaLocation":259},"/ai-transparency-center/","ai transparency center",{"text":571,"config":572},"Newsletter",{"href":573,"dataGaName":574,"dataGaLocation":259},"/company/contact/#contact-forms","newsletter",{"text":576,"config":577},"Press",{"href":578,"dataGaName":579,"dataGaLocation":259},"/press/","press",{"text":581,"config":582,"menu":583},"Contact us",{"dataNavLevelOne":527},{"type":310,"columns":584},[585],{"items":586},[587,592,597],{"text":588,"config":589},"Talk to sales",{"href":590,"dataGaName":591,"dataGaLocation":259},"/sales/","talk to sales",{"text":593,"config":594},"Support portal",{"href":595,"dataGaName":596,"dataGaLocation":259},"https://support.gitlab.com/hc/en-us","support portal",{"text":598,"config":599},"Customer portal",{"href":600,"dataGaName":601,"dataGaLocation":259},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":603,"login":604,"suggestions":611},"Close",{"text":605,"link":606},"To search repositories and projects, login to",{"text":607,"config":608},"gitlab.com",{"href":273,"dataGaName":609,"dataGaLocation":610},"search login","search",{"text":612,"default":613},"Suggestions",[614,616,620,622,626,630],{"text":290,"config":615},{"href":295,"dataGaName":290,"dataGaLocation":610},{"text":617,"config":618},"Code Suggestions (AI)",{"href":619,"dataGaName":617,"dataGaLocation":610},"/solutions/code-suggestions/",{"text":326,"config":621},{"href":328,"dataGaName":326,"dataGaLocation":610},{"text":623,"config":624},"GitLab on AWS",{"href":625,"dataGaName":623,"dataGaLocation":610},"/partners/technology-partners/aws/",{"text":627,"config":628},"GitLab on Google Cloud",{"href":629,"dataGaName":627,"dataGaLocation":610},"/partners/technology-partners/google-cloud-platform/",{"text":631,"config":632},"Why GitLab?",{"href":303,"dataGaName":631,"dataGaLocation":610},{"freeTrial":634,"mobileIcon":639,"desktopIcon":644,"secondaryButton":647},{"text":635,"config":636},"Start free trial",{"href":637,"dataGaName":264,"dataGaLocation":638},"https://gitlab.com/-/trials/new/","nav",{"altText":640,"config":641},"Gitlab Icon",{"src":642,"dataGaName":643,"dataGaLocation":638},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":640,"config":645},{"src":646,"dataGaName":643,"dataGaLocation":638},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":648,"config":649},"Get Started",{"href":650,"dataGaName":651,"dataGaLocation":638},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":653,"mobileIcon":657,"desktopIcon":659},{"text":654,"config":655},"Learn more about GitLab Duo",{"href":295,"dataGaName":656,"dataGaLocation":638},"gitlab duo",{"altText":640,"config":658},{"src":642,"dataGaName":643,"dataGaLocation":638},{"altText":640,"config":660},{"src":646,"dataGaName":643,"dataGaLocation":638},{"button":662,"mobileIcon":667,"desktopIcon":669},{"text":663,"config":664},"/switch",{"href":665,"dataGaName":666,"dataGaLocation":638},"#contact","switch",{"altText":640,"config":668},{"src":642,"dataGaName":643,"dataGaLocation":638},{"altText":640,"config":670},{"src":671,"dataGaName":643,"dataGaLocation":638},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":673,"mobileIcon":678,"desktopIcon":680},{"text":674,"config":675},"Back to pricing",{"href":408,"dataGaName":676,"dataGaLocation":638,"icon":677},"back to pricing","GoBack",{"altText":640,"config":679},{"src":642,"dataGaName":643,"dataGaLocation":638},{"altText":640,"config":681},{"src":646,"dataGaName":643,"dataGaLocation":638},{"title":683,"titleMobile":684,"button":685,"config":690},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":301,"config":686},{"href":687,"dataGaName":688,"dataGaLocation":689},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":691,"disabled":238},"release",{"data":693},{"text":694,"source":695,"edit":701,"contribute":706,"config":711,"items":716,"minimal":925},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":696,"config":697},"View page source",{"href":698,"dataGaName":699,"dataGaLocation":700},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":702,"config":703},"Edit this page",{"href":704,"dataGaName":705,"dataGaLocation":700},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":707,"config":708},"Please contribute",{"href":709,"dataGaName":710,"dataGaLocation":700},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":712,"facebook":713,"youtube":714,"linkedin":715},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[717,764,818,862,893],{"title":406,"links":718,"subMenu":733},[719,723,728],{"text":720,"config":721},"View plans",{"href":408,"dataGaName":722,"dataGaLocation":700},"view plans",{"text":724,"config":725},"Why Premium?",{"href":726,"dataGaName":727,"dataGaLocation":700},"/pricing/premium/","why premium",{"text":729,"config":730},"Why Ultimate?",{"href":731,"dataGaName":732,"dataGaLocation":700},"/pricing/ultimate/","why ultimate",[734],{"title":735,"links":736},"Contact Us",[737,740,742,744,749,754,759],{"text":738,"config":739},"Contact sales",{"href":590,"dataGaName":269,"dataGaLocation":700},{"text":593,"config":741},{"href":595,"dataGaName":596,"dataGaLocation":700},{"text":598,"config":743},{"href":600,"dataGaName":601,"dataGaLocation":700},{"text":745,"config":746},"Status",{"href":747,"dataGaName":748,"dataGaLocation":700},"https://status.gitlab.com/","status",{"text":750,"config":751},"Terms of use",{"href":752,"dataGaName":753,"dataGaLocation":700},"/terms/","terms of use",{"text":755,"config":756},"Privacy statement",{"href":757,"dataGaName":758,"dataGaLocation":700},"/privacy/","privacy statement",{"text":760,"config":761},"Cookie preferences",{"dataGaName":762,"dataGaLocation":700,"id":763,"isOneTrustButton":241},"cookie preferences","ot-sdk-btn",{"title":306,"links":765,"subMenu":774},[766,770],{"text":767,"config":768},"DevSecOps platform",{"href":288,"dataGaName":769,"dataGaLocation":700},"devsecops platform",{"text":771,"config":772},"AI-Assisted Development",{"href":295,"dataGaName":773,"dataGaLocation":700},"ai-assisted development",[775],{"title":776,"links":777},"Topics",[778,783,788,793,798,803,808,813],{"text":779,"config":780},"CICD",{"href":781,"dataGaName":782,"dataGaLocation":700},"/topics/ci-cd/","cicd",{"text":784,"config":785},"GitOps",{"href":786,"dataGaName":787,"dataGaLocation":700},"/topics/gitops/","gitops",{"text":789,"config":790},"DevOps",{"href":791,"dataGaName":792,"dataGaLocation":700},"/topics/devops/","devops",{"text":794,"config":795},"Version Control",{"href":796,"dataGaName":797,"dataGaLocation":700},"/topics/version-control/","version control",{"text":799,"config":800},"DevSecOps",{"href":801,"dataGaName":802,"dataGaLocation":700},"/topics/devsecops/","devsecops",{"text":804,"config":805},"Cloud Native",{"href":806,"dataGaName":807,"dataGaLocation":700},"/topics/cloud-native/","cloud native",{"text":809,"config":810},"AI for Coding",{"href":811,"dataGaName":812,"dataGaLocation":700},"/topics/devops/ai-for-coding/","ai for coding",{"text":814,"config":815},"Agentic AI",{"href":816,"dataGaName":817,"dataGaLocation":700},"/topics/agentic-ai/","agentic ai",{"title":819,"links":820},"Solutions",[821,823,825,830,834,837,841,844,846,849,852,857],{"text":350,"config":822},{"href":345,"dataGaName":350,"dataGaLocation":700},{"text":339,"config":824},{"href":322,"dataGaName":323,"dataGaLocation":700},{"text":826,"config":827},"Agile development",{"href":828,"dataGaName":829,"dataGaLocation":700},"/solutions/agile-delivery/","agile delivery",{"text":831,"config":832},"SCM",{"href":335,"dataGaName":833,"dataGaLocation":700},"source code management",{"text":779,"config":835},{"href":328,"dataGaName":836,"dataGaLocation":700},"continuous integration & delivery",{"text":838,"config":839},"Value stream management",{"href":378,"dataGaName":840,"dataGaLocation":700},"value stream management",{"text":784,"config":842},{"href":843,"dataGaName":787,"dataGaLocation":700},"/solutions/gitops/",{"text":388,"config":845},{"href":391,"dataGaName":392,"dataGaLocation":700},{"text":847,"config":848},"Small business",{"href":397,"dataGaName":398,"dataGaLocation":700},{"text":850,"config":851},"Public sector",{"href":403,"dataGaName":404,"dataGaLocation":700},{"text":853,"config":854},"Education",{"href":855,"dataGaName":856,"dataGaLocation":700},"/solutions/education/","education",{"text":858,"config":859},"Financial services",{"href":860,"dataGaName":861,"dataGaLocation":700},"/solutions/finance/","financial services",{"title":411,"links":863},[864,866,868,870,872,874,877,879,881,883,885,887,889,891],{"text":424,"config":865},{"href":426,"dataGaName":427,"dataGaLocation":700},{"text":429,"config":867},{"href":431,"dataGaName":432,"dataGaLocation":700},{"text":434,"config":869},{"href":436,"dataGaName":437,"dataGaLocation":700},{"text":439,"config":871},{"href":441,"dataGaName":196,"dataGaLocation":700},{"text":462,"config":873},{"href":464,"dataGaName":465,"dataGaLocation":700},{"text":875,"config":876},"What's new",{"href":522,"dataGaName":523,"dataGaLocation":700},{"text":457,"config":878},{"href":459,"dataGaName":460,"dataGaLocation":700},{"text":476,"config":880},{"href":478,"dataGaName":479,"dataGaLocation":700},{"text":484,"config":882},{"href":486,"dataGaName":487,"dataGaLocation":700},{"text":489,"config":884},{"href":491,"dataGaName":492,"dataGaLocation":700},{"text":494,"config":886},{"href":496,"dataGaName":497,"dataGaLocation":700},{"text":499,"config":888},{"href":501,"dataGaName":502,"dataGaLocation":700},{"text":504,"config":890},{"href":506,"dataGaName":507,"dataGaLocation":700},{"text":509,"config":892},{"href":511,"dataGaName":512,"dataGaLocation":700},{"title":525,"links":894},[895,897,899,901,903,905,909,914,916,918,920],{"text":533,"config":896},{"href":535,"dataGaName":527,"dataGaLocation":700},{"text":538,"config":898},{"href":540,"dataGaName":541,"dataGaLocation":700},{"text":546,"config":900},{"href":548,"dataGaName":549,"dataGaLocation":700},{"text":551,"config":902},{"href":553,"dataGaName":554,"dataGaLocation":700},{"text":556,"config":904},{"href":558,"dataGaName":559,"dataGaLocation":700},{"text":906,"config":907},"Sustainability",{"href":908,"dataGaName":906,"dataGaLocation":700},"/sustainability/",{"text":910,"config":911},"Diversity, inclusion and belonging (DIB)",{"href":912,"dataGaName":913,"dataGaLocation":700},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":561,"config":915},{"href":563,"dataGaName":564,"dataGaLocation":700},{"text":571,"config":917},{"href":573,"dataGaName":574,"dataGaLocation":700},{"text":576,"config":919},{"href":578,"dataGaName":579,"dataGaLocation":700},{"text":921,"config":922},"Modern Slavery Transparency Statement",{"href":923,"dataGaName":924,"dataGaLocation":700},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":926},[927,930,933],{"text":928,"config":929},"Terms",{"href":752,"dataGaName":753,"dataGaLocation":700},{"text":931,"config":932},"Cookies",{"dataGaName":762,"dataGaLocation":700,"id":763,"isOneTrustButton":241},{"text":934,"config":935},"Privacy",{"href":757,"dataGaName":758,"dataGaLocation":700},[937],{"id":938,"title":7,"body":237,"config":939,"content":941,"description":237,"extension":944,"meta":945,"navigation":241,"path":946,"seo":947,"stem":948,"__hash__":949},"blogAuthors/en-us/blog/authors/yevgeny-pats.yml",{"template":940},"BlogAuthor",{"name":7,"config":942},{"headshot":80,"ctfId":943},"ypats","yml",{},"/en-us/blog/authors/yevgeny-pats",{},"en-us/blog/authors/yevgeny-pats","Eyf0FMujgvuiOm0zj0NDJAlOukR9i1LRkM8OsWsmc6M",[951,960,968],{"title":952,"description":953,"heroImage":954,"category":233,"date":955,"authors":956,"slug":959,"externalUrl":237},"Confidential AI for GitLab Self-Hosted","Give developers AI coding agents in GitLab Duo without source code leaving a hardware-encrypted boundary — no GPUs needed.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773866173/vte9qh8rriznvyclhkes.png","2026-08-06",[957,958],"Mathias Ewald","Martin Paloncy, Edgeless Systems","confidential-ai-for-gitlab-self-hosted",{"title":961,"description":962,"heroImage":963,"category":233,"date":964,"authors":965,"slug":967,"externalUrl":237},"Green DevOps: Why carbon measurement belongs in your CI/CD pipeline","CI/CD pipelines have a hidden carbon cost. Here's why measuring it matters, and how you can get started with Eco CI and Carmen in GitLab.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1765809212/noh0mdfn9o94ry9ykura.png","2026-07-09",[966],"Lysanne Pinto","green-devops-carbon-measurement-cicd-pipeline",{"title":969,"description":970,"heroImage":971,"category":233,"date":972,"authors":973,"slug":975,"externalUrl":237},"How to build CI/CD observability at scale","This practical guide to GitLab pipeline analytics helps self-managed users gain operational insights using Prometheus and Grafana.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774465167/n5hlvrsrheadeccyr1oz.png","2026-04-28",[974],"Paul Meresanu","how-to-build-ci-cd-observability-at-scale",{"promotions":977},[978,992,1004,1016],{"id":979,"categories":980,"header":982,"text":983,"button":984,"image":989},"ai-modernization",[981],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":985,"config":986},"Get your AI maturity score",{"href":987,"dataGaName":988,"dataGaLocation":465},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":990},{"src":991},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":993,"categories":994,"header":996,"text":983,"button":997,"image":1001},"devops-modernization",[995,802],"product","Are you just managing tools or shipping innovation?",{"text":998,"config":999},"Get your DevOps maturity score",{"href":1000,"dataGaName":988,"dataGaLocation":465},"/assessments/devops-modernization-assessment/",{"config":1002},{"src":1003},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1005,"categories":1006,"header":1008,"text":983,"button":1009,"image":1013},"security-modernization",[1007],"security","Are you trading speed for security?",{"text":1010,"config":1011},"Get your security maturity score",{"href":1012,"dataGaName":988,"dataGaLocation":465},"/assessments/security-modernization-assessment/",{"config":1014},{"src":1015},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1017,"paths":1018,"header":1021,"text":1022,"button":1023,"image":1028},"github-azure-migration",[1019,1020],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1024,"config":1025},"See how GitLab compares to GitHub",{"href":1026,"dataGaName":1027,"dataGaLocation":465},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1029},{"src":1003},{"header":1031,"blurb":1032,"button":1033,"secondaryButton":1038},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1034,"config":1035},"Get your free trial",{"href":1036,"dataGaName":264,"dataGaLocation":1037},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":738,"config":1039},{"href":590,"dataGaName":269,"dataGaLocation":1037},1786803769935]