[{"data":1,"prerenderedAt":1241},["ShallowReactive",2],{"/blog/how-to-harden-your-self-managed-gitlab-instance":3,"navigation-en-us":456,"banner-en-us":883,"footer-en-us":893,"blog-post-authors-en-us-Ayoub Fandi":1137,"blog-related-posts-en-us-how-to-harden-your-self-managed-gitlab-instance":1152,"blog-promotions-en-us":1178,"next-steps-en-us":1231},{"id":4,"title":5,"authors":6,"body":8,"category":434,"date":435,"description":436,"extension":437,"externalUrl":438,"faq":438,"featured":439,"heroImage":440,"meta":441,"navigation":442,"path":443,"seo":444,"slug":448,"stem":449,"tags":450,"template":454,"updatedDate":438,"__hash__":455},"blogPosts/en-us/blog/how-to-harden-your-self-managed-gitlab-instance.md","How to harden your self-managed GitLab instance",[7],"Ayoub Fandi",{"type":9,"value":10,"toc":414},"minimark",[11,15,18,23,26,31,34,37,41,44,47,50,54,57,60,64,74,78,84,104,121,129,133,138,148,159,187,203,207,212,226,234,238,242,265,278,281,294,298,303,318,326,330,335,350,358,362,366,369,376,379,386,390,398,401],[12,13,14],"p",{},"\"You are as secure as your weakest link\" is a well-understood phrase. If attackers find their way in, they will exploit any gaps in your security configurations. Hardening — the process of turning off unused features and making adjustments to settings that have security implications — is critical to limit your attack surface and reduce potential attack vectors.",[12,16,17],{},"Hardening ensures that your application (in this case GitLab) is as secure as it can be. The goal is simple: minimize risk while still preserving enough functionality for users to remain as productive as possible.",[19,20,22],"h2",{"id":21},"guiding-principles","Guiding principles",[12,24,25],{},"These principles should guide the way you approach hardening. The security activities in the checklist below will tie back to one or another of these principles.",[27,28,30],"h3",{"id":29},"layered-security","Layered security",[12,32,33],{},"The idea behind this is simple. If there are two ways to implement security, both ways should be implemented instead of just one. You can try to combine as many methods as possible.",[12,35,36],{},"For instance, if you are trying to secure access to your service, you could combine a complex password with hardware tokens and multifactor authentication. This approach is also called defense-in-depth.",[27,38,40],{"id":39},"no-security-through-obscurity","No security through obscurity",[12,42,43],{},"The idea of hiding things works in many cases, but not so in the information security world. The premise that if something is hidden then it is more secure isn’t a viable approach today.",[12,45,46],{},"Current scanning capabilities available to attackers shatter through obscurity. It is very easy for anyone to scan for open ports on a system. If you’ve swapped the SSH port TCP 22 to a different port, it would be picked up by a network scanning tool such as Nmap.",[12,48,49],{},"As GitLab is committed to transparency and open source, our approach is at odds with security through obscurity. The goal of security is to remove any security through obscurity. Our documentation is available to all and security best practices are clearly labeled and detailed.",[27,51,53],{"id":52},"reducing-the-attack-surface","Reducing the attack surface",[12,55,56],{},"GitLab comprises numerous components, services, and dependencies. A critical aspect of security is: The more components you have, the more entryways attackers have.",[12,58,59],{},"A good rule to keep in mind is to always disable services that you do not need to run the application. If there are features that aren’t used, disabling the related services will reduce the potential attack surface and make you more secure.",[19,61,63],{"id":62},"_7-steps-to-secure-your-self-managed-instance","7 steps to secure your self-managed instance",[12,65,66,67,73],{},"Let’s go through seven easy steps to quickly harden your self-managed instance. These quick wins are great first steps towards securing your installation. Of course, refer to the ",[68,69,72],"a",{"href":70,"rel":71},"https://docs.gitlab.com/security/",[],"documentation"," for additional details and further guidance on each section.",[27,75,77],{"id":76},"_1-enable-multi-factor-authentication","1. Enable multi-factor authentication",[12,79,80],{},[81,82,83],"strong",{},"Admin > Settings > General > Sign-in restrictions",[12,85,86,87,91,92,95,96,99,100,103],{},"Ensure that the checkbox next to ",[88,89,90],"em",{},"Two-factor authentication"," (2FA) is ",[81,93,94],{},"checked",". The default setting for ",[88,97,98],{},"Two-factor grace period"," is 48 hours. Adjust it to a lower value, such as ",[81,101,102],{},"8 hours",".",[12,105,106,107,110,111,113,114,110,117,120],{},"Ensure the checkbox next to ",[88,108,109],{},"Enable admin mode"," is ",[81,112,94],{}," so that ",[88,115,116],{},"Admin Mode",[81,118,119],{},"active",". Users with Admin access will have to use additional authentication to perform administrative tasks. With 2FA enabled, this will require additional 2FA authentication by the user.",[12,122,123,124,103],{},"For more detailed information, refer to the documentation on ",[68,125,128],{"href":126,"rel":127},"https://docs.gitlab.com/administration/settings/sign_in_restrictions/",[],"sign-in restrictions",[27,130,132],{"id":131},"_2-enforce-additional-sign-up-checks","2. Enforce additional sign-up checks",[12,134,135],{},[81,136,137],{},"Admin > Settings > General > Sign-up restrictions",[12,139,140,141,144,145,103],{},"Next to ",[88,142,143],{},"Sign-up enabled"," ensure the checkbox is ",[81,146,147],{},"unchecked",[12,149,150,151,154,155,158],{},"Under ",[88,152,153],{},"Email confirmation settings"," ensure that ",[81,156,157],{},"Hard"," is selected. This will require the user to verify their email address during the sign-up process before their account is allowed access.",[12,160,161,162,165,166,169,170,169,173,176,177,180,181,186],{},"The ",[88,163,164],{},"Minimum password length (number of characters)"," default setting of 12 characters is fine if additional authentication techniques are enforced. Options available for password complexity include ",[88,167,168],{},"Require numbers",", ",[88,171,172],{},"Require uppercase letters",[88,174,175],{},"Require lowercase letters",", and ",[88,178,179],{},"Require symbols",". Check these boxes depending on your internal password standard (also check out ",[68,182,185],{"href":183,"rel":184},"https://pages.nist.gov/800-63-3/sp800-63b.html",[],"NIST SP 800-63B",").",[12,188,189,190,193,194,197,198,103],{},"If all users' email addresses are under a single domain (e.g., example.com), consider ",[81,191,192],{},"adding it"," to the ",[88,195,196],{},"Allowed domains for sign-ups",". This will prevent those with email addresses associated with other domains from signing up.\nFor more detailed information, refer to the documentation on ",[68,199,202],{"href":200,"rel":201},"https://docs.gitlab.com/administration/settings/sign_up_restrictions/",[],"sign-up restrictions",[27,204,206],{"id":205},"_3-limit-public-visibility-of-your-groups-and-projects","3. Limit public visibility of your groups and projects",[12,208,209],{},[81,210,211],{},"Admin > Settings > General > Visibility and access control",[12,213,161,214,217,218,221,222,225],{},[88,215,216],{},"Default project visibility"," and ",[88,219,220],{},"Default group visibility"," for any newly created project or group should be set to ",[81,223,224],{},"Private"," by default. Only users that are granted specific access to a project or group will be able to access these resources. This can be adjusted later if necessary or when creating a new project or group. This ensures the default mode is secure to prevent accidental disclosure of information.",[12,227,228,229,103],{},"For more details on Visibility and access control ",[68,230,233],{"href":231,"rel":232},"https://docs.gitlab.com/administration/settings/visibility_and_access_controls/",[],"refer to the documentation",[27,235,237],{"id":236},"_4-harden-your-ssh-settings","4. Harden your SSH settings",[12,239,240],{},[81,241,211],{},[12,243,244,245,248,249,252,253,256,257,260,261,264],{},"Typically, under ",[88,246,247],{},"Enabled Git access protocols"," it will be set to ",[88,250,251],{},"Both SSH and HTTP(S)",". If one of the Git protocols is not in use by your users, set it to ",[81,254,255],{},"either"," ",[88,258,259],{},"Only SSH"," or ",[88,262,263],{},"Only HTTP(S)"," accordingly. This will reduce the attack surface by limiting possibilities of compromise through an unused protocol.\nFor SSH key types, the most recommended algorithms to use are, in order:",[266,267,268,272,275],"ol",{},[269,270,271],"li",{},"ED25519",[269,273,274],{},"RSA",[269,276,277],{},"ECDSA",[12,279,280],{},"When configuring default types and lengths for SSH keys, keep in mind the list above.",[12,282,283,284,217,289,293],{},"Specific details on SSH settings can be found ",[68,285,288],{"href":286,"rel":287},"https://docs.gitlab.com/security/ssh_keys_restrictions/",[],"here",[68,290,288],{"href":291,"rel":292},"https://docs.gitlab.com/administration/settings/visibility_and_access_controls/#configure-enabled-git-access-protocols",[]," for Git Access protocols.",[27,295,297],{"id":296},"_5-review-the-account-and-limit-settings","5. Review the account and limit settings",[12,299,300],{},[81,301,302],{},"Admin > Settings > General > Account and limit settings",[12,304,305,306,309,310,313,314,317],{},"This section allows you to limit the size of attachments, pushes, exports, imports, or repositories. As the specific size (in MB) will be tailored to your needs, review these settings and ",[81,307,308],{},"set limits"," in line with your internal policies.\n",[81,311,312],{},"Session duration for users"," (in minutes) and ",[81,315,316],{},"lifetime of SSH keys and all access tokens"," (in days) can also be configured. Ensure the durations are in accordance with your internal policies and security best practices.",[12,319,320,321,325],{},"Review the ",[68,322,72],{"href":323,"rel":324},"https://docs.gitlab.com/administration/settings/account_and_limit_settings/",[]," and apply changes that enforce your own policies.",[27,327,329],{"id":328},"_6-secure-your-ci-secrets","6. Secure your CI secrets",[12,331,332],{},[81,333,334],{},"Admin > Settings > CI",[12,336,337,338,341,342,345,346,103],{},"Passwords, tokens, keys, and other secrets that require any level of protection should never be stored in plaintext. Instead, some type of ",[81,339,340],{},"encrypted container technology (Secrets Manager)"," should be implemented, such as GCP's Secret Manager, AWS Key Management Service (KMS), or HashiCorp Vault. For self-managed and standalone instances, HashiCorp Vault is ",[81,343,344],{},"recommended",", and many GitLab features can take advantage of Vault and are well described in the ",[68,347,72],{"href":348,"rel":349},"https://docs.gitlab.com/search/?query=vault",[],[12,351,352,353,357],{},"For external communications, ensure any connectivity with external hosts in your CI/CD process is using encrypted channels. The use of TLS 1.2 or above is highly recommended and where possible mutual TLS will help things considerably.\nFor details on the use of external secrets for your CI/CD pipeline, check ",[68,354,288],{"href":355,"rel":356},"https://docs.gitlab.com/ci/secrets/",[]," for actual examples and configuration guides.",[27,359,361],{"id":360},"_7-protect-your-pipelines-for-all-branches","7. Protect your pipelines for all branches",[12,363,364],{},[81,365,334],{},[12,367,368],{},"Pipelines are a part of jobs that execute steps in stages to automate tasks on behalf of the users of a project. They are a central component of CI/CD.\nBy default, only the default branch gets a protected pipeline. Configure your other branches with the same level of security by following these simple steps. This considerably hardens your pipelines.",[12,370,371,372,103],{},"The security features enabled by default on protected pipelines are listed in our ",[68,373,72],{"href":374,"rel":375},"https://docs.gitlab.com/ci/pipelines/#pipeline-security-on-protected-branches",[],[12,377,378],{},"Once the pipeline has run, the code will be deployed in an environment. To limit interactions with that environment and to protect it from unauthorized users, you can set your key environments as protected.",[12,380,381,382,103],{},"Prerequisites and full process are available in the ",[68,383,72],{"href":384,"rel":385},"https://docs.gitlab.com/ci/environments/protected_environments/",[],[27,387,389],{"id":388},"learn-more","Learn more",[12,391,392,393,397],{},"This is a high-level overview of the different areas to focus on when hardening your self-managed GitLab instance. A blog post can’t include every single security recommendation. That’s why we maintain detailed ",[68,394,396],{"href":70,"rel":395},[],"security documentation"," on how to secure your installation.",[12,399,400],{},"Please refer to the documentation as the single source of truth on hardening. Hopefully, with the help of the action items highlighted above, you’ll harden your self-managed GitLab instance while preserving agility and speed.",[12,402,403,404,407,408,413],{},"If you want to learn more about how we do security ",[81,405,406],{},"at GitLab",", review the ",[68,409,412],{"href":410,"rel":411},"https://handbook.gitlab.com/handbook/security/",[],"security section"," of the handbook.",{"title":415,"searchDepth":416,"depth":416,"links":417},"",2,[418,424],{"id":21,"depth":416,"text":22,"children":419},[420,422,423],{"id":29,"depth":421,"text":30},3,{"id":39,"depth":421,"text":40},{"id":52,"depth":421,"text":53},{"id":62,"depth":416,"text":63,"children":425},[426,427,428,429,430,431,432,433],{"id":76,"depth":421,"text":77},{"id":131,"depth":421,"text":132},{"id":205,"depth":421,"text":206},{"id":236,"depth":421,"text":237},{"id":296,"depth":421,"text":297},{"id":328,"depth":421,"text":329},{"id":360,"depth":421,"text":361},{"id":388,"depth":421,"text":389},"engineering","2023-05-23","Learn seven easy steps to ensure your self-managed GitLab instance is as secure as possible.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749664923/Blog/Hero%20Images/security-checklist.png",{},true,"/en-us/blog/how-to-harden-your-self-managed-gitlab-instance",{"title":5,"description":436,"ogTitle":5,"ogDescription":436,"noIndex":439,"ogImage":440,"ogUrl":445,"ogSiteName":446,"ogType":447,"canonicalUrls":445},"https://about.gitlab.com/blog/how-to-harden-your-self-managed-gitlab-instance","https://about.gitlab.com","article","how-to-harden-your-self-managed-gitlab-instance","en-us/blog/how-to-harden-your-self-managed-gitlab-instance",[451,452,453],"security","tutorial","DevSecOps","BlogPost","T314bcsSppZksYm0y9zypmI34lpgWC070uJrfn4XxJs",{"logo":457,"freeTrial":462,"sales":467,"login":472,"items":477,"search":803,"minimal":834,"duo":853,"switchNav":862,"pricingDeployment":873},{"config":458},{"href":459,"dataGaName":460,"dataGaLocation":461},"/","gitlab logo","header",{"text":463,"config":464},"Get free trial",{"href":465,"dataGaName":466,"dataGaLocation":461},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":468,"config":469},"Request a demo",{"href":470,"dataGaName":471,"dataGaLocation":461},"/sales/?contact-topic=request-demo","sales",{"text":473,"config":474},"Sign in",{"href":475,"dataGaName":476,"dataGaLocation":461},"https://gitlab.com/users/sign_in/","sign in",[478,506,606,611,725,781],{"text":479,"config":480,"menu":482},"Platform",{"dataNavLevelOne":481},"platform",{"type":483,"columns":484},"cards",[485,491,499],{"title":479,"description":486,"link":487},"The intelligent orchestration platform for DevSecOps",{"text":488,"config":489},"Explore our Platform",{"href":490,"dataGaName":481,"dataGaLocation":461},"/platform/",{"title":492,"description":493,"link":494},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":495,"config":496},"Meet GitLab Duo",{"href":497,"dataGaName":498,"dataGaLocation":461},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":500,"description":501,"link":502},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":389,"config":503},{"href":504,"dataGaName":505,"dataGaLocation":461},"/why-gitlab/","why gitlab",{"text":507,"left":442,"config":508,"menu":510},"Product",{"dataNavLevelOne":509},"solutions",{"type":511,"link":512,"columns":516,"feature":585},"lists",{"text":513,"config":514},"View all Solutions",{"href":515,"dataGaName":509,"dataGaLocation":461},"/solutions/",[517,541,564],{"title":518,"description":519,"link":520,"items":525},"Automation","CI/CD and automation to accelerate deployment",{"config":521},{"icon":522,"href":523,"dataGaName":524,"dataGaLocation":461},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[526,530,533,537],{"text":527,"config":528},"CI/CD",{"href":529,"dataGaLocation":461,"dataGaName":527},"/solutions/continuous-integration/",{"text":492,"config":531},{"href":497,"dataGaLocation":461,"dataGaName":532},"gitlab duo agent platform - product menu",{"text":534,"config":535},"Source Code Management",{"href":536,"dataGaLocation":461,"dataGaName":534},"/solutions/source-code-management/",{"text":538,"config":539},"Automated Software Delivery",{"href":523,"dataGaLocation":461,"dataGaName":540},"Automated software delivery",{"title":542,"description":543,"link":544,"items":549},"Security","Deliver code faster without compromising security",{"config":545},{"href":546,"dataGaName":547,"dataGaLocation":461,"icon":548},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[550,554,559],{"text":551,"config":552},"Application Security Testing",{"href":546,"dataGaName":553,"dataGaLocation":461},"Application security testing",{"text":555,"config":556},"Software Supply Chain Security",{"href":557,"dataGaLocation":461,"dataGaName":558},"/solutions/supply-chain/","Software supply chain security",{"text":560,"config":561},"Software Compliance",{"href":562,"dataGaName":563,"dataGaLocation":461},"/solutions/software-compliance/","software compliance",{"title":565,"link":566,"items":571},"Measurement",{"config":567},{"icon":568,"href":569,"dataGaName":570,"dataGaLocation":461},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[572,576,580],{"text":573,"config":574},"Visibility & Measurement",{"href":569,"dataGaLocation":461,"dataGaName":575},"Visibility and Measurement",{"text":577,"config":578},"Value Stream Management",{"href":579,"dataGaLocation":461,"dataGaName":577},"/solutions/value-stream-management/",{"text":581,"config":582},"Analytics & Insights",{"href":583,"dataGaLocation":461,"dataGaName":584},"/solutions/analytics-and-insights/","Analytics and insights",{"title":586,"type":511,"items":587},"GitLab for",[588,594,600],{"text":589,"config":590},"Enterprise",{"icon":591,"href":592,"dataGaLocation":461,"dataGaName":593},"Building","/enterprise/","enterprise",{"text":595,"config":596},"Small Business",{"icon":597,"href":598,"dataGaLocation":461,"dataGaName":599},"Work","/small-business/","small business",{"text":601,"config":602},"Public Sector",{"icon":603,"href":604,"dataGaLocation":461,"dataGaName":605},"Organization","/solutions/public-sector/","public sector",{"text":607,"config":608},"Pricing",{"href":609,"dataGaName":610,"dataGaLocation":461,"dataNavLevelOne":610},"/pricing/","pricing",{"text":612,"config":613,"menu":615},"Resources",{"dataNavLevelOne":614},"resources",{"type":511,"link":616,"columns":620,"feature":714},{"text":617,"config":618},"View all resources",{"href":619,"dataGaName":614,"dataGaLocation":461},"/resources/",[621,654,681],{"title":622,"items":623},"Getting started",[624,629,634,639,644,649],{"text":625,"config":626},"Install",{"href":627,"dataGaName":628,"dataGaLocation":461},"/install/","install",{"text":630,"config":631},"Quick start guides",{"href":632,"dataGaName":633,"dataGaLocation":461},"/get-started/","quick setup checklists",{"text":635,"config":636},"Learn",{"href":637,"dataGaLocation":461,"dataGaName":638},"https://university.gitlab.com/","learn",{"text":640,"config":641},"Product documentation",{"href":642,"dataGaName":643,"dataGaLocation":461},"https://docs.gitlab.com/","product documentation",{"text":645,"config":646},"Best practice videos",{"href":647,"dataGaName":648,"dataGaLocation":461},"/getting-started-videos/","best practice videos",{"text":650,"config":651},"Integrations",{"href":652,"dataGaName":653,"dataGaLocation":461},"/integrations/","integrations",{"title":655,"items":656},"Discover",[657,662,667,672,676],{"text":658,"config":659},"Customer success stories",{"href":660,"dataGaName":661,"dataGaLocation":461},"/customers/","customer success stories",{"text":663,"config":664},"Blog",{"href":665,"dataGaName":666,"dataGaLocation":461},"/blog/","blog",{"text":668,"config":669},"Demo Hub",{"href":670,"dataGaName":671,"dataGaLocation":461},"/demo-hub/","demo hub",{"text":673,"config":674},"The Source",{"href":675,"dataGaName":666,"dataGaLocation":461},"/the-source/",{"text":677,"config":678},"Remote",{"href":679,"dataGaName":680,"dataGaLocation":461},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":682,"items":683},"Connect",[684,689,694,699,704,709],{"text":685,"config":686},"GitLab Services",{"href":687,"dataGaName":688,"dataGaLocation":461},"/services/","services",{"text":690,"config":691},"Contribute",{"href":692,"dataGaName":693,"dataGaLocation":461},"https://contributors.gitlab.com","contribute",{"text":695,"config":696},"Community",{"href":697,"dataGaName":698,"dataGaLocation":461},"/community/","community",{"text":700,"config":701},"Forum",{"href":702,"dataGaName":703,"dataGaLocation":461},"https://forum.gitlab.com/","forum",{"text":705,"config":706},"Events",{"href":707,"dataGaName":708,"dataGaLocation":461},"/events/","events",{"text":710,"config":711},"Partners",{"href":712,"dataGaName":713,"dataGaLocation":461},"/partners/","partners",{"config":715,"title":718,"text":719,"link":720},{"background":716,"textColor":717},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":721,"config":722},"Read the latest",{"href":723,"dataGaName":724,"dataGaLocation":461},"/whats-new/","whats new",{"text":726,"config":727,"menu":729},"Company",{"dataNavLevelOne":728},"company",{"type":511,"columns":730},[731],{"items":732},[733,738,744,746,751,756,761,766,771,776],{"text":734,"config":735},"About",{"href":736,"dataGaName":737,"dataGaLocation":461},"/company/","about",{"text":739,"config":740,"footerGa":743},"Jobs",{"href":741,"dataGaName":742,"dataGaLocation":461},"/jobs/","jobs",{"dataGaName":742},{"text":705,"config":745},{"href":707,"dataGaName":708,"dataGaLocation":461},{"text":747,"config":748},"Leadership",{"href":749,"dataGaName":750,"dataGaLocation":461},"/company/team/e-group/","leadership",{"text":752,"config":753},"Handbook",{"href":754,"dataGaName":755,"dataGaLocation":461},"https://handbook.gitlab.com/","handbook",{"text":757,"config":758},"Investor relations",{"href":759,"dataGaName":760,"dataGaLocation":461},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":762,"config":763},"Trust Center",{"href":764,"dataGaName":765,"dataGaLocation":461},"/security/","trust center",{"text":767,"config":768},"AI Transparency Center",{"href":769,"dataGaName":770,"dataGaLocation":461},"/ai-transparency-center/","ai transparency center",{"text":772,"config":773},"Newsletter",{"href":774,"dataGaName":775,"dataGaLocation":461},"/company/contact/#contact-forms","newsletter",{"text":777,"config":778},"Press",{"href":779,"dataGaName":780,"dataGaLocation":461},"/press/","press",{"text":782,"config":783,"menu":784},"Contact us",{"dataNavLevelOne":728},{"type":511,"columns":785},[786],{"items":787},[788,793,798],{"text":789,"config":790},"Talk to sales",{"href":791,"dataGaName":792,"dataGaLocation":461},"/sales/","talk to sales",{"text":794,"config":795},"Support portal",{"href":796,"dataGaName":797,"dataGaLocation":461},"https://support.gitlab.com/hc/en-us","support portal",{"text":799,"config":800},"Customer portal",{"href":801,"dataGaName":802,"dataGaLocation":461},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":804,"login":805,"suggestions":812},"Close",{"text":806,"link":807},"To search repositories and projects, login to",{"text":808,"config":809},"gitlab.com",{"href":475,"dataGaName":810,"dataGaLocation":811},"search login","search",{"text":813,"default":814},"Suggestions",[815,817,821,823,827,831],{"text":492,"config":816},{"href":497,"dataGaName":492,"dataGaLocation":811},{"text":818,"config":819},"Code Suggestions (AI)",{"href":820,"dataGaName":818,"dataGaLocation":811},"/solutions/code-suggestions/",{"text":527,"config":822},{"href":529,"dataGaName":527,"dataGaLocation":811},{"text":824,"config":825},"GitLab on AWS",{"href":826,"dataGaName":824,"dataGaLocation":811},"/partners/technology-partners/aws/",{"text":828,"config":829},"GitLab on Google Cloud",{"href":830,"dataGaName":828,"dataGaLocation":811},"/partners/technology-partners/google-cloud-platform/",{"text":832,"config":833},"Why GitLab?",{"href":504,"dataGaName":832,"dataGaLocation":811},{"freeTrial":835,"mobileIcon":840,"desktopIcon":845,"secondaryButton":848},{"text":836,"config":837},"Start free trial",{"href":838,"dataGaName":466,"dataGaLocation":839},"https://gitlab.com/-/trials/new/","nav",{"altText":841,"config":842},"Gitlab Icon",{"src":843,"dataGaName":844,"dataGaLocation":839},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":841,"config":846},{"src":847,"dataGaName":844,"dataGaLocation":839},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":849,"config":850},"Get Started",{"href":851,"dataGaName":852,"dataGaLocation":839},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":854,"mobileIcon":858,"desktopIcon":860},{"text":855,"config":856},"Learn more about GitLab Duo",{"href":497,"dataGaName":857,"dataGaLocation":839},"gitlab duo",{"altText":841,"config":859},{"src":843,"dataGaName":844,"dataGaLocation":839},{"altText":841,"config":861},{"src":847,"dataGaName":844,"dataGaLocation":839},{"button":863,"mobileIcon":868,"desktopIcon":870},{"text":864,"config":865},"/switch",{"href":866,"dataGaName":867,"dataGaLocation":839},"#contact","switch",{"altText":841,"config":869},{"src":843,"dataGaName":844,"dataGaLocation":839},{"altText":841,"config":871},{"src":872,"dataGaName":844,"dataGaLocation":839},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":874,"mobileIcon":879,"desktopIcon":881},{"text":875,"config":876},"Back to pricing",{"href":609,"dataGaName":877,"dataGaLocation":839,"icon":878},"back to pricing","GoBack",{"altText":841,"config":880},{"src":843,"dataGaName":844,"dataGaLocation":839},{"altText":841,"config":882},{"src":847,"dataGaName":844,"dataGaLocation":839},{"title":884,"titleMobile":885,"button":886,"config":891},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":389,"config":887},{"href":888,"dataGaName":889,"dataGaLocation":890},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":892,"disabled":439},"release",{"data":894},{"text":895,"source":896,"edit":902,"contribute":907,"config":912,"items":917,"minimal":1126},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":897,"config":898},"View page source",{"href":899,"dataGaName":900,"dataGaLocation":901},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":903,"config":904},"Edit this page",{"href":905,"dataGaName":906,"dataGaLocation":901},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":908,"config":909},"Please contribute",{"href":910,"dataGaName":911,"dataGaLocation":901},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":913,"facebook":914,"youtube":915,"linkedin":916},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[918,965,1018,1062,1094],{"title":607,"links":919,"subMenu":934},[920,924,929],{"text":921,"config":922},"View plans",{"href":609,"dataGaName":923,"dataGaLocation":901},"view plans",{"text":925,"config":926},"Why Premium?",{"href":927,"dataGaName":928,"dataGaLocation":901},"/pricing/premium/","why premium",{"text":930,"config":931},"Why Ultimate?",{"href":932,"dataGaName":933,"dataGaLocation":901},"/pricing/ultimate/","why ultimate",[935],{"title":936,"links":937},"Contact Us",[938,941,943,945,950,955,960],{"text":939,"config":940},"Contact sales",{"href":791,"dataGaName":471,"dataGaLocation":901},{"text":794,"config":942},{"href":796,"dataGaName":797,"dataGaLocation":901},{"text":799,"config":944},{"href":801,"dataGaName":802,"dataGaLocation":901},{"text":946,"config":947},"Status",{"href":948,"dataGaName":949,"dataGaLocation":901},"https://status.gitlab.com/","status",{"text":951,"config":952},"Terms of use",{"href":953,"dataGaName":954,"dataGaLocation":901},"/terms/","terms of use",{"text":956,"config":957},"Privacy statement",{"href":958,"dataGaName":959,"dataGaLocation":901},"/privacy/","privacy statement",{"text":961,"config":962},"Cookie preferences",{"dataGaName":963,"dataGaLocation":901,"id":964,"isOneTrustButton":442},"cookie preferences","ot-sdk-btn",{"title":507,"links":966,"subMenu":975},[967,971],{"text":968,"config":969},"DevSecOps platform",{"href":490,"dataGaName":970,"dataGaLocation":901},"devsecops platform",{"text":972,"config":973},"AI-Assisted Development",{"href":497,"dataGaName":974,"dataGaLocation":901},"ai-assisted development",[976],{"title":977,"links":978},"Topics",[979,984,989,994,999,1003,1008,1013],{"text":980,"config":981},"CICD",{"href":982,"dataGaName":983,"dataGaLocation":901},"/topics/ci-cd/","cicd",{"text":985,"config":986},"GitOps",{"href":987,"dataGaName":988,"dataGaLocation":901},"/topics/gitops/","gitops",{"text":990,"config":991},"DevOps",{"href":992,"dataGaName":993,"dataGaLocation":901},"/topics/devops/","devops",{"text":995,"config":996},"Version Control",{"href":997,"dataGaName":998,"dataGaLocation":901},"/topics/version-control/","version control",{"text":453,"config":1000},{"href":1001,"dataGaName":1002,"dataGaLocation":901},"/topics/devsecops/","devsecops",{"text":1004,"config":1005},"Cloud Native",{"href":1006,"dataGaName":1007,"dataGaLocation":901},"/topics/cloud-native/","cloud native",{"text":1009,"config":1010},"AI for Coding",{"href":1011,"dataGaName":1012,"dataGaLocation":901},"/topics/devops/ai-for-coding/","ai for coding",{"text":1014,"config":1015},"Agentic AI",{"href":1016,"dataGaName":1017,"dataGaLocation":901},"/topics/agentic-ai/","agentic ai",{"title":1019,"links":1020},"Solutions",[1021,1023,1025,1030,1034,1037,1041,1044,1046,1049,1052,1057],{"text":551,"config":1022},{"href":546,"dataGaName":551,"dataGaLocation":901},{"text":540,"config":1024},{"href":523,"dataGaName":524,"dataGaLocation":901},{"text":1026,"config":1027},"Agile development",{"href":1028,"dataGaName":1029,"dataGaLocation":901},"/solutions/agile-delivery/","agile delivery",{"text":1031,"config":1032},"SCM",{"href":536,"dataGaName":1033,"dataGaLocation":901},"source code management",{"text":980,"config":1035},{"href":529,"dataGaName":1036,"dataGaLocation":901},"continuous integration & delivery",{"text":1038,"config":1039},"Value stream management",{"href":579,"dataGaName":1040,"dataGaLocation":901},"value stream management",{"text":985,"config":1042},{"href":1043,"dataGaName":988,"dataGaLocation":901},"/solutions/gitops/",{"text":589,"config":1045},{"href":592,"dataGaName":593,"dataGaLocation":901},{"text":1047,"config":1048},"Small business",{"href":598,"dataGaName":599,"dataGaLocation":901},{"text":1050,"config":1051},"Public sector",{"href":604,"dataGaName":605,"dataGaLocation":901},{"text":1053,"config":1054},"Education",{"href":1055,"dataGaName":1056,"dataGaLocation":901},"/solutions/education/","education",{"text":1058,"config":1059},"Financial services",{"href":1060,"dataGaName":1061,"dataGaLocation":901},"/solutions/finance/","financial services",{"title":612,"links":1063},[1064,1066,1068,1070,1073,1075,1078,1080,1082,1084,1086,1088,1090,1092],{"text":625,"config":1065},{"href":627,"dataGaName":628,"dataGaLocation":901},{"text":630,"config":1067},{"href":632,"dataGaName":633,"dataGaLocation":901},{"text":635,"config":1069},{"href":637,"dataGaName":638,"dataGaLocation":901},{"text":640,"config":1071},{"href":642,"dataGaName":1072,"dataGaLocation":901},"docs",{"text":663,"config":1074},{"href":665,"dataGaName":666,"dataGaLocation":901},{"text":1076,"config":1077},"What's new",{"href":723,"dataGaName":724,"dataGaLocation":901},{"text":658,"config":1079},{"href":660,"dataGaName":661,"dataGaLocation":901},{"text":677,"config":1081},{"href":679,"dataGaName":680,"dataGaLocation":901},{"text":685,"config":1083},{"href":687,"dataGaName":688,"dataGaLocation":901},{"text":690,"config":1085},{"href":692,"dataGaName":693,"dataGaLocation":901},{"text":695,"config":1087},{"href":697,"dataGaName":698,"dataGaLocation":901},{"text":700,"config":1089},{"href":702,"dataGaName":703,"dataGaLocation":901},{"text":705,"config":1091},{"href":707,"dataGaName":708,"dataGaLocation":901},{"text":710,"config":1093},{"href":712,"dataGaName":713,"dataGaLocation":901},{"title":726,"links":1095},[1096,1098,1100,1102,1104,1106,1110,1115,1117,1119,1121],{"text":734,"config":1097},{"href":736,"dataGaName":728,"dataGaLocation":901},{"text":739,"config":1099},{"href":741,"dataGaName":742,"dataGaLocation":901},{"text":747,"config":1101},{"href":749,"dataGaName":750,"dataGaLocation":901},{"text":752,"config":1103},{"href":754,"dataGaName":755,"dataGaLocation":901},{"text":757,"config":1105},{"href":759,"dataGaName":760,"dataGaLocation":901},{"text":1107,"config":1108},"Sustainability",{"href":1109,"dataGaName":1107,"dataGaLocation":901},"/sustainability/",{"text":1111,"config":1112},"Diversity, inclusion and belonging (DIB)",{"href":1113,"dataGaName":1114,"dataGaLocation":901},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":762,"config":1116},{"href":764,"dataGaName":765,"dataGaLocation":901},{"text":772,"config":1118},{"href":774,"dataGaName":775,"dataGaLocation":901},{"text":777,"config":1120},{"href":779,"dataGaName":780,"dataGaLocation":901},{"text":1122,"config":1123},"Modern Slavery Transparency Statement",{"href":1124,"dataGaName":1125,"dataGaLocation":901},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1127},[1128,1131,1134],{"text":1129,"config":1130},"Terms",{"href":953,"dataGaName":954,"dataGaLocation":901},{"text":1132,"config":1133},"Cookies",{"dataGaName":963,"dataGaLocation":901,"id":964,"isOneTrustButton":442},{"text":1135,"config":1136},"Privacy",{"href":958,"dataGaName":959,"dataGaLocation":901},[1138],{"id":1139,"title":7,"body":438,"config":1140,"content":1142,"description":438,"extension":1146,"meta":1147,"navigation":442,"path":1148,"seo":1149,"stem":1150,"__hash__":1151},"blogAuthors/en-us/blog/authors/ayoub-fandi.yml",{"template":1141},"BlogAuthor",{"name":7,"config":1143},{"headshot":1144,"ctfId":1145},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749664292/Blog/Author%20Headshots/ayofan-headshot.jpg","ayofan","yml",{},"/en-us/blog/authors/ayoub-fandi",{},"en-us/blog/authors/ayoub-fandi","HOoASUQjXSXP48h7q-RWYP5BNbqeyaUzv_JonD4WKCc",[1153,1162,1170],{"title":1154,"description":1155,"heroImage":1156,"category":434,"date":1157,"authors":1158,"slug":1161,"externalUrl":438},"Confidential AI for GitLab Self-Hosted","Give developers AI coding agents in GitLab Duo without source code leaving a hardware-encrypted boundary — no GPUs needed.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773866173/vte9qh8rriznvyclhkes.png","2026-08-06",[1159,1160],"Mathias Ewald","Martin Paloncy, Edgeless Systems","confidential-ai-for-gitlab-self-hosted",{"title":1163,"description":1164,"heroImage":1165,"category":434,"date":1166,"authors":1167,"slug":1169,"externalUrl":438},"Green DevOps: Why carbon measurement belongs in your CI/CD pipeline","CI/CD pipelines have a hidden carbon cost. Here's why measuring it matters, and how you can get started with Eco CI and Carmen in GitLab.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1765809212/noh0mdfn9o94ry9ykura.png","2026-07-09",[1168],"Lysanne Pinto","green-devops-carbon-measurement-cicd-pipeline",{"title":1171,"description":1172,"heroImage":1173,"category":434,"date":1174,"authors":1175,"slug":1177,"externalUrl":438},"How to build CI/CD observability at scale","This practical guide to GitLab pipeline analytics helps self-managed users gain operational insights using Prometheus and Grafana.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774465167/n5hlvrsrheadeccyr1oz.png","2026-04-28",[1176],"Paul Meresanu","how-to-build-ci-cd-observability-at-scale",{"promotions":1179},[1180,1194,1206,1217],{"id":1181,"categories":1182,"header":1184,"text":1185,"button":1186,"image":1191},"ai-modernization",[1183],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1187,"config":1188},"Get your AI maturity score",{"href":1189,"dataGaName":1190,"dataGaLocation":666},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1192},{"src":1193},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1195,"categories":1196,"header":1198,"text":1185,"button":1199,"image":1203},"devops-modernization",[1197,1002],"product","Are you just managing tools or shipping innovation?",{"text":1200,"config":1201},"Get your DevOps maturity score",{"href":1202,"dataGaName":1190,"dataGaLocation":666},"/assessments/devops-modernization-assessment/",{"config":1204},{"src":1205},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1207,"categories":1208,"header":1209,"text":1185,"button":1210,"image":1214},"security-modernization",[451],"Are you trading speed for security?",{"text":1211,"config":1212},"Get your security maturity score",{"href":1213,"dataGaName":1190,"dataGaLocation":666},"/assessments/security-modernization-assessment/",{"config":1215},{"src":1216},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1218,"paths":1219,"header":1222,"text":1223,"button":1224,"image":1229},"github-azure-migration",[1220,1221],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1225,"config":1226},"See how GitLab compares to GitHub",{"href":1227,"dataGaName":1228,"dataGaLocation":666},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1230},{"src":1205},{"header":1232,"blurb":1233,"button":1234,"secondaryButton":1239},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1235,"config":1236},"Get your free trial",{"href":1237,"dataGaName":466,"dataGaLocation":1238},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":939,"config":1240},{"href":791,"dataGaName":471,"dataGaLocation":1238},1786803749782]