[{"data":1,"prerenderedAt":1364},["ShallowReactive",2],{"/blog/how-were-using-dast2-for-easier-scan-configuration":3,"navigation-en-us":578,"banner-en-us":1006,"footer-en-us":1016,"blog-post-authors-en-us-Nikhil George":1261,"blog-related-posts-en-us-how-were-using-dast2-for-easier-scan-configuration":1276,"blog-promotions-en-us":1301,"next-steps-en-us":1354},{"id":4,"title":5,"authors":6,"body":8,"category":559,"date":560,"description":561,"extension":562,"externalUrl":563,"faq":563,"featured":564,"heroImage":565,"meta":566,"navigation":567,"path":568,"seo":569,"slug":573,"stem":574,"tags":575,"template":576,"updatedDate":563,"__hash__":577},"blogPosts/en-us/blog/how-were-using-dast2-for-easier-scan-configuration.md","How we’re using DAST 2 for easier scan configuration and reduced noise",[7],"Nikhil George",{"type":9,"value":10,"toc":542},"minimark",[11,40,53,58,78,81,105,110,113,117,124,128,143,150,154,173,176,200,209,213,216,230,235,247,261,349,355,414,420,424,453,457,473,477,497,501,504,512,521,524,538],[12,13,14,15,21,22,27,28,33,34,39],"p",{},"At GitLab, ",[16,17,20],"a",{"href":18,"rel":19},"https://handbook.gitlab.com/handbook/values/#dogfooding",[],"dogfooding"," is part of our core value of ",[16,23,26],{"href":24,"rel":25},"https://handbook.gitlab.com/handbook/values/#results",[],"results",". Inspired by this principle, we use all GitLab ",[16,29,32],{"href":30,"rel":31},"https://docs.gitlab.com/user/application_security/",[],"security scanning tools available as part of our product"," within our organization to identify security vulnerabilities early in the development phase. One such scanning tool is the ",[16,35,38],{"href":36,"rel":37},"https://docs.gitlab.com/user/application_security/dast/",[],"Dynamic Application Security Testing (DAST)"," scanner, which helps identify security vulnerabilities in web application deployments. The DAST scanner is a black-box testing tool that interacts with a web application like a user and tests for security vulnerabilities.",[12,41,42,43,48,49],{},"We’ve since updated GitLab’s DAST CI job configuration to make use of the latest DAST analyzer features offered in ",[16,44,47],{"href":45,"rel":46},"https://gitlab.com/gitlab-org/gitlab/-/merge_requests/69054",[],"DAST 2",". This blog post details how we configured DAST version 1 to work for our needs, our move to DAST 2 (along with details on our configs) and the benefits we’re seeing so far. ",[50,51,52],"em",{},"Hint: Big wins in efficiency!",[54,55,57],"h2",{"id":56},"how-we-made-dast-1-work-for-us","How we made DAST 1 work for us",[12,59,60,61,65,66,71,72,77],{},"My teammate Dennis Appelt blogged previously about how ",[16,62,64],{"href":63},"/blog/how-to-configure-dast-full-scans-for-complex-web-applications/","we configured DAST scans"," in our ",[16,67,70],{"href":68,"rel":69},"https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/ci/dast.gitlab-ci.yml",[],"pipeline"," to scan the GitLab web application periodically using DAST 1. As detailed in that blog, running a DAST scan on a complex web application like GitLab from the CI pipeline requires a bit of planning to optimize the scan time and prevent CI job ",[16,73,76],{"href":74,"rel":75},"https://docs.gitlab.com/ci/pipelines/settings/#set-a-limit-for-how-long-jobs-can-run",[],"timeouts",". With DAST 1, our approach was to split the DAST scan into multiple, parallel CI jobs and exclude irrelevant scan rules to achieve optimization and prevent job timeouts.",[12,79,80],{},"When configuring a parallel DAST scan, each DAST job is set to execute a mutually exclusive list of scan rules. These scan rules are selected such that they will finish execution within the set CI job timeout.",[12,82,83],{},[50,84,85,86,94,95,98,99,104],{},"note: In the GitLab DAST pipeline line, the ",[16,87,90],{"href":88,"rel":89},"https://docs.gitlab.com/user/application_security/dast/#enable-or-disable-rules",[],[91,92,93],"code",{},"DAST_EXCLUDE_RULES"," CI/CD variable was used to disable specific scan rules as ",[91,96,97],{},"DAST_ONLY_INCLUDE_RULES"," was not available until ",[16,100,103],{"href":101,"rel":102},"https://gitlab.com/gitlab-org/security-products/dast/-/blob/main/CHANGELOG.md#v1530",[],"DAST v1.53.0",".",[106,107,109],"h3",{"id":108},"addressing-challenges-with-job-timeouts","Addressing challenges with job timeouts",[12,111,112],{},"Using an exclusion list, the go-to option for disabling scan rules until DAST v1.53.0, works fine until there’s a new version of DAST analyzer, which comes with a new scan rule. By default, DAST auto-update is turned on and all newly-introduced scan rules get executed in all the DAST jobs. As a result, the DAST jobs could face timeout issues if the addition of a new scan rule increases the scan duration beyond the configured CI job timeout duration. In addition, the default execution of the newly-added scan rules in all the DAST jobs, results in duplicate scans -- a waste of CI cycles.",[106,114,116],{"id":115},"test-verify-and-check-auto-update-status","Test, verify and check auto-update status",[12,118,119,120,123],{},"To prevent default execution of the newly-added scan rules while using a DAST version earlier than 1.53, enable new scan rules in a single DAST job. This single DAST job should be tested to verify that it runs within the set CI job timeout; this is a repetitive and manual effort. A short-term workaround employed by our team in this case was to disable DAST auto-update by pinning the DAST analyzer to a specific release version by mentioning the version number in ",[91,121,122],{},"DAST_VERSION"," CI/CD variable.",[54,125,127],{"id":126},"dast-2-improvements","DAST 2 improvements",[12,129,130,131,136,137,142],{},"DAST 2 was released with ",[16,132,135],{"href":133,"rel":134},"https://docs.gitlab.com/releases/",[],"GitLab 14.0"," in June 2021 and introduced a bunch of ",[16,138,141],{"href":139,"rel":140},"https://gitlab.com/gitlab-org/security-products/dast/-/blob/main/CHANGELOG.md#v200",[],"interesting features and config options"," that made DAST configuration and vulnerability management much easier.",[12,144,145,146,104],{},"As we had disabled DAST auto-update in the GitLab pipeline, we were missing out on all the new features and bug fixes that came with different minor and major version updates. You can see the ",[16,147,149],{"href":45,"rel":148},[],"configuration changes we performed to upgrade the DAST pipeline from version 1.22.1 to 2",[106,151,153],{"id":152},"streamlining-vulnerability-triage","Streamlining vulnerability triage",[12,155,156,157,162,163,168,169,172],{},"One new feature of DAST 2 that we’re finding especially valuable on GitLab is the ",[16,158,161],{"href":159,"rel":160},"https://gitlab.com/gitlab-org/gitlab/-/issues/254043",[],"aggregation of vulnerabilities",". During a DAST scan of a web application, there are many vulnerabilities that are common to multiple web requests. For instance, the ",[16,164,167],{"href":165,"rel":166},"https://www.zaproxy.org/docs/alerts/10020/",[],"X-Frame-Options Header Not Set"," plugin checks if ",[91,170,171],{},"X-Frame-Options"," HTTP headers are present in each response and reports a vulnerability for every applicable request. This resulted in creation of multiple, duplicate, true-positive vulnerabilities in the vulnerability dashboard. The new vulnerability aggregation feature groups vulnerabilities created from plugins like this into a single vulnerability, irrespective of the number of times it is detected in the scan. This makes vulnerability triage much faster as only one vulnerability is now reported for plugins like this.",[12,174,175],{},"Other benefits include:",[177,178,179,188,191],"ul",{},[180,181,182,187],"li",{},[16,183,186],{"href":184,"rel":185},"https://gitlab.com/gitlab-org/security-products/dast/-/merge_requests/520",[],"upgraded versions"," of a browser-based crawler;",[180,189,190],{},"bug fixes; and",[180,192,193,194,199],{},"availability of ",[16,195,198],{"href":196,"rel":197},"https://gitlab.com/gitlab-org/security-products/dast/-/blob/main/CHANGELOG.md#v203",[],"better configuration option"," for the browser-based scans.",[12,201,202,203,208],{},"Take a peek at the ",[16,204,207],{"href":205,"rel":206},"https://gitlab.com/gitlab-org/security-products/dast/-/blob/main/CHANGELOG.md",[],"change log"," to see everything that’s new!",[54,210,212],{"id":211},"how-we-updated-gitlabs-dast-ci-job","How we updated GitLab’s DAST CI job",[12,214,215],{},"Our move to DAST version 2 and updating GitLab's DAST CI job included three steps:",[217,218,219,224,227],"ol",{},[180,220,221,222,104],{},"Move to ",[91,223,97],{},[180,225,226],{},"Update DAST analyzer to version 2 and enable auto-update.",[180,228,229],{},"Remove deprecated DAST configurations.",[106,231,221,233],{"id":232},"move-to-dast_only_include_rules",[91,234,97],{},[12,236,237,238,240,241,243,244,246],{},"The introduction of the ",[91,239,97],{}," CI/CD variable provided a quick way to select ZAP scan rules for execution. Instead of listing out all the rules that need to be excluded from the scan using ",[91,242,93],{},", selected rules for execution could be specified as the value of ",[91,245,97],{},". This made the job configuration easier because, in our case, the exclusion list was long and dynamic (and kept changing from DAST version to version) but the include list is static and small, making the manual effort involved in scanning more efficient.",[12,248,249,250,253,254,257,258,260],{},"For example, to run two selected scan rules, namely ",[91,251,252],{},"10020"," and ",[91,255,256],{},"10021"," in a DAST CI job, one would have to disable all the other rules using ",[91,259,93],{},", as illustrated below:",[262,263,268],"pre",{"className":264,"code":265,"language":266,"meta":267,"style":267},"language-yaml shiki shiki-themes github-light","DAST-fullscan:\n  extends:\n    - .dast_conf\n  variables:\n    DAST_USERNAME: \"user1\"\n    DAST_EXCLUDE_RULES: “10019,10037,10054….(all rules except 10020,10021)\n  script:\n     - /analyze -t $DAST_WEBSITE -d\n\n","yaml","",[91,269,270,283,291,301,309,321,332,340],{"__ignoreMap":267},[271,272,275,279],"span",{"class":273,"line":274},"line",1,[271,276,278],{"class":277},"shJU0","DAST-fullscan",[271,280,282],{"class":281},"sgsFI",":\n",[271,284,286,289],{"class":273,"line":285},2,[271,287,288],{"class":277},"  extends",[271,290,282],{"class":281},[271,292,294,297],{"class":273,"line":293},3,[271,295,296],{"class":281},"    - ",[271,298,300],{"class":299},"sYBdl",".dast_conf\n",[271,302,304,307],{"class":273,"line":303},4,[271,305,306],{"class":277},"  variables",[271,308,282],{"class":281},[271,310,312,315,318],{"class":273,"line":311},5,[271,313,314],{"class":277},"    DAST_USERNAME",[271,316,317],{"class":281},": ",[271,319,320],{"class":299},"\"user1\"\n",[271,322,324,327,329],{"class":273,"line":323},6,[271,325,326],{"class":277},"    DAST_EXCLUDE_RULES",[271,328,317],{"class":281},[271,330,331],{"class":299},"“10019,10037,10054….(all rules except 10020,10021)\n",[271,333,335,338],{"class":273,"line":334},7,[271,336,337],{"class":277},"  script",[271,339,282],{"class":281},[271,341,343,346],{"class":273,"line":342},8,[271,344,345],{"class":281},"     - ",[271,347,348],{"class":299},"/analyze -t $DAST_WEBSITE -d\n",[12,350,351,352,354],{},"However, using ",[91,353,97],{},", the long list of exclude rules could be replaced by a short include list:",[262,356,358],{"className":264,"code":357,"language":266,"meta":267,"style":267},"DAST-fullscan:\n  extends:\n    - .dast_conf\n  variables:\n    DAST_USERNAME: \"user1\"\n    DAST_ONLY_INCLUDE_RULES: “10020,10021”\n  script:\n     - /analyze -t $DAST_WEBSITE -d\n\n",[91,359,360,366,372,378,384,392,402,408],{"__ignoreMap":267},[271,361,362,364],{"class":273,"line":274},[271,363,278],{"class":277},[271,365,282],{"class":281},[271,367,368,370],{"class":273,"line":285},[271,369,288],{"class":277},[271,371,282],{"class":281},[271,373,374,376],{"class":273,"line":293},[271,375,296],{"class":281},[271,377,300],{"class":299},[271,379,380,382],{"class":273,"line":303},[271,381,306],{"class":277},[271,383,282],{"class":281},[271,385,386,388,390],{"class":273,"line":311},[271,387,314],{"class":277},[271,389,317],{"class":281},[271,391,320],{"class":299},[271,393,394,397,399],{"class":273,"line":323},[271,395,396],{"class":277},"    DAST_ONLY_INCLUDE_RULES",[271,398,317],{"class":281},[271,400,401],{"class":299},"“10020,10021”\n",[271,403,404,406],{"class":273,"line":334},[271,405,337],{"class":277},[271,407,282],{"class":281},[271,409,410,412],{"class":273,"line":342},[271,411,345],{"class":281},[271,413,348],{"class":299},[12,415,416,417,419],{},"Also, using ",[91,418,97],{}," ensures there won’t be an unexpected timeout on any DAST job due to the execution of new scan rules that come with the new DAST analyzer versions.",[106,421,423],{"id":422},"update-dast-analyzer-to-version-2-and-enable-auto-update","Update DAST analyzer to version 2 and enable auto-update",[12,425,426,427,432,433,436,437,439,440,442,443,446,447,452],{},"As I mentioned above, the version of the DAST analyzer in ",[16,428,431],{"href":429,"rel":430},"https://gitlab.com/gitlab-org/gitlab",[],"gitlab-org/gitlab’s"," CI/CD pipeline was pinned to ",[91,434,435],{},"1.22.1"," as a workaround for preventing job timeouts. Now, with the introduction of the ",[91,438,97],{}," CI/CD variable, DAST auto-update could be turned on and version upgrade from 1 to 2 could be carried out in the pipeline without any worry of job failures from timeout.  Both of these were achieved by updating the value of ",[91,441,122],{}," CI/CD variable to ",[91,444,445],{},"2",". You can read more about ",[16,448,451],{"href":449,"rel":450},"https://docs.gitlab.com/user/application_security/dast/#include-the-dast-template",[],"configuring the DAST version"," in our docs.",[106,454,456],{"id":455},"remove-deprecated-dast-configurations","Remove deprecated DAST configurations",[12,458,459,460,465,466,469,470,104],{},"In DAST 2.0, ",[16,461,464],{"href":462,"rel":463},"https://gitlab.com/gitlab-org/security-products/dast/-/merge_requests/460",[],"multiple DAST config CI variables were removed",", so any use of them in our pipeline also needed to be removed. One such variable was ",[91,467,468],{},"DAST_AUTH_EXCLUDE_URLS",", which was previously used to specify the URLs to skip during the authenticated scan. This was replaced with ",[91,471,472],{},"DAST_EXCLUDE_URLS",[54,474,476],{"id":475},"dogfooding-for-the-win","Dogfooding for the win",[12,478,479,480,485,486,491,492,104],{},"In addition to being able to reduce CI job complexity in GitLab’s DAST pipeline with the upgrade to version 2, our GitLab Security team was able to identify areas for improvement, including the addition of ",[16,481,484],{"href":482,"rel":483},"https://gitlab.com/gitlab-org/gitlab/-/issues/340814",[],"a misconfiguration detection feature"," and a ",[16,487,490],{"href":488,"rel":489},"https://gitlab.com/gitlab-org/gitlab/-/issues/340420",[],"reusable configuration section in DAST template",", as well as the identification of a ",[16,493,496],{"href":494,"rel":495},"https://gitlab.com/gitlab-org/gitlab/-/issues/341050",[],"bug causing long URLs in the evidence section not to wrap",[54,498,500],{"id":499},"our-next-steps-for-dast","Our next steps for DAST",[12,502,503],{},"Our next goal is to start dogfooding the DAST API scan and beta features like browser-based scans to identify pain points from a user perspective and remediate them.",[12,505,506,507,104],{},"To stay on top of new DAST releases and cool features that come with them, head over to the ",[16,508,511],{"href":509,"rel":510},"https://gitlab.com/gitlab-org/security-products/dast/-/releases",[],"DAST release page",[12,513,514,515,520],{},"Also, are you looking to try out DAST 2, but feeling baffled by the configurations mentioned here? Well, don't be! GitLab also provides quick and easy ways to ",[16,516,519],{"href":517,"rel":518},"https://docs.gitlab.com/user/application_security/dast/#enable-automatic-dast-run",[],"enable automatic DAST scan"," with minimal manual configuration.",[12,522,523],{},"We’d love to hear your experience configuring DAST scans and feedback on ways to improve the user experience. Drop us a comment below!",[12,525,526,527,532,533,104],{},"Cover image by ",[16,528,531],{"href":529,"rel":530},"https://www.pexels.com/@kseniachernaya",[],"Ksenia Chernaya"," on ",[16,534,537],{"href":535,"rel":536},"https://www.pexels.com/photo/modern-professional-equipment-for-checking-eyesight-5752269/",[],"Pexels",[539,540,541],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":267,"searchDepth":285,"depth":285,"links":543},[544,548,551,557,558],{"id":56,"depth":285,"text":57,"children":545},[546,547],{"id":108,"depth":293,"text":109},{"id":115,"depth":293,"text":116},{"id":126,"depth":285,"text":127,"children":549},[550],{"id":152,"depth":293,"text":153},{"id":211,"depth":285,"text":212,"children":552},[553,555,556],{"id":232,"depth":293,"text":554},"Move to DAST_ONLY_INCLUDE_RULES",{"id":422,"depth":293,"text":423},{"id":455,"depth":293,"text":456},{"id":475,"depth":285,"text":476},{"id":499,"depth":285,"text":500},"security","2021-10-27","Our security team upgraded to GitLab’s DAST 2. Here’s how and why we did it.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749682167/Blog/Hero%20Images/pexels-chernaya-575.jpg",{},true,"/en-us/blog/how-were-using-dast2-for-easier-scan-configuration",{"title":5,"description":561,"ogTitle":5,"ogDescription":561,"noIndex":564,"ogImage":565,"ogUrl":570,"ogSiteName":571,"ogType":572,"canonicalUrls":570},"https://about.gitlab.com/blog/how-were-using-dast2-for-easier-scan-configuration","https://about.gitlab.com","article","how-were-using-dast2-for-easier-scan-configuration","en-us/blog/how-were-using-dast2-for-easier-scan-configuration",[559],"BlogPost","bl2sIUeyK4TXmXaCSM5jMN-F6x6lKQIcHooO47l_G-E",{"logo":579,"freeTrial":584,"sales":589,"login":594,"items":599,"search":926,"minimal":957,"duo":976,"switchNav":985,"pricingDeployment":996},{"config":580},{"href":581,"dataGaName":582,"dataGaLocation":583},"/","gitlab logo","header",{"text":585,"config":586},"Get free trial",{"href":587,"dataGaName":588,"dataGaLocation":583},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":590,"config":591},"Request a demo",{"href":592,"dataGaName":593,"dataGaLocation":583},"/sales/?contact-topic=request-demo","sales",{"text":595,"config":596},"Sign in",{"href":597,"dataGaName":598,"dataGaLocation":583},"https://gitlab.com/users/sign_in/","sign in",[600,629,729,734,848,904],{"text":601,"config":602,"menu":604},"Platform",{"dataNavLevelOne":603},"platform",{"type":605,"columns":606},"cards",[607,613,621],{"title":601,"description":608,"link":609},"The intelligent orchestration platform for DevSecOps",{"text":610,"config":611},"Explore our Platform",{"href":612,"dataGaName":603,"dataGaLocation":583},"/platform/",{"title":614,"description":615,"link":616},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":617,"config":618},"Meet GitLab Duo",{"href":619,"dataGaName":620,"dataGaLocation":583},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":622,"description":623,"link":624},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":625,"config":626},"Learn more",{"href":627,"dataGaName":628,"dataGaLocation":583},"/why-gitlab/","why gitlab",{"text":630,"left":567,"config":631,"menu":633},"Product",{"dataNavLevelOne":632},"solutions",{"type":634,"link":635,"columns":639,"feature":708},"lists",{"text":636,"config":637},"View all Solutions",{"href":638,"dataGaName":632,"dataGaLocation":583},"/solutions/",[640,664,687],{"title":641,"description":642,"link":643,"items":648},"Automation","CI/CD and automation to accelerate deployment",{"config":644},{"icon":645,"href":646,"dataGaName":647,"dataGaLocation":583},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[649,653,656,660],{"text":650,"config":651},"CI/CD",{"href":652,"dataGaLocation":583,"dataGaName":650},"/solutions/continuous-integration/",{"text":614,"config":654},{"href":619,"dataGaLocation":583,"dataGaName":655},"gitlab duo agent platform - product menu",{"text":657,"config":658},"Source Code Management",{"href":659,"dataGaLocation":583,"dataGaName":657},"/solutions/source-code-management/",{"text":661,"config":662},"Automated Software Delivery",{"href":646,"dataGaLocation":583,"dataGaName":663},"Automated software delivery",{"title":665,"description":666,"link":667,"items":672},"Security","Deliver code faster without compromising security",{"config":668},{"href":669,"dataGaName":670,"dataGaLocation":583,"icon":671},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[673,677,682],{"text":674,"config":675},"Application Security Testing",{"href":669,"dataGaName":676,"dataGaLocation":583},"Application security testing",{"text":678,"config":679},"Software Supply Chain Security",{"href":680,"dataGaLocation":583,"dataGaName":681},"/solutions/supply-chain/","Software supply chain security",{"text":683,"config":684},"Software Compliance",{"href":685,"dataGaName":686,"dataGaLocation":583},"/solutions/software-compliance/","software compliance",{"title":688,"link":689,"items":694},"Measurement",{"config":690},{"icon":691,"href":692,"dataGaName":693,"dataGaLocation":583},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[695,699,703],{"text":696,"config":697},"Visibility & Measurement",{"href":692,"dataGaLocation":583,"dataGaName":698},"Visibility and Measurement",{"text":700,"config":701},"Value Stream Management",{"href":702,"dataGaLocation":583,"dataGaName":700},"/solutions/value-stream-management/",{"text":704,"config":705},"Analytics & Insights",{"href":706,"dataGaLocation":583,"dataGaName":707},"/solutions/analytics-and-insights/","Analytics and insights",{"title":709,"type":634,"items":710},"GitLab for",[711,717,723],{"text":712,"config":713},"Enterprise",{"icon":714,"href":715,"dataGaLocation":583,"dataGaName":716},"Building","/enterprise/","enterprise",{"text":718,"config":719},"Small Business",{"icon":720,"href":721,"dataGaLocation":583,"dataGaName":722},"Work","/small-business/","small business",{"text":724,"config":725},"Public Sector",{"icon":726,"href":727,"dataGaLocation":583,"dataGaName":728},"Organization","/solutions/public-sector/","public sector",{"text":730,"config":731},"Pricing",{"href":732,"dataGaName":733,"dataGaLocation":583,"dataNavLevelOne":733},"/pricing/","pricing",{"text":735,"config":736,"menu":738},"Resources",{"dataNavLevelOne":737},"resources",{"type":634,"link":739,"columns":743,"feature":837},{"text":740,"config":741},"View all resources",{"href":742,"dataGaName":737,"dataGaLocation":583},"/resources/",[744,777,804],{"title":745,"items":746},"Getting started",[747,752,757,762,767,772],{"text":748,"config":749},"Install",{"href":750,"dataGaName":751,"dataGaLocation":583},"/install/","install",{"text":753,"config":754},"Quick start guides",{"href":755,"dataGaName":756,"dataGaLocation":583},"/get-started/","quick setup checklists",{"text":758,"config":759},"Learn",{"href":760,"dataGaLocation":583,"dataGaName":761},"https://university.gitlab.com/","learn",{"text":763,"config":764},"Product documentation",{"href":765,"dataGaName":766,"dataGaLocation":583},"https://docs.gitlab.com/","product documentation",{"text":768,"config":769},"Best practice videos",{"href":770,"dataGaName":771,"dataGaLocation":583},"/getting-started-videos/","best practice videos",{"text":773,"config":774},"Integrations",{"href":775,"dataGaName":776,"dataGaLocation":583},"/integrations/","integrations",{"title":778,"items":779},"Discover",[780,785,790,795,799],{"text":781,"config":782},"Customer success stories",{"href":783,"dataGaName":784,"dataGaLocation":583},"/customers/","customer success stories",{"text":786,"config":787},"Blog",{"href":788,"dataGaName":789,"dataGaLocation":583},"/blog/","blog",{"text":791,"config":792},"Demo Hub",{"href":793,"dataGaName":794,"dataGaLocation":583},"/demo-hub/","demo hub",{"text":796,"config":797},"The Source",{"href":798,"dataGaName":789,"dataGaLocation":583},"/the-source/",{"text":800,"config":801},"Remote",{"href":802,"dataGaName":803,"dataGaLocation":583},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":805,"items":806},"Connect",[807,812,817,822,827,832],{"text":808,"config":809},"GitLab Services",{"href":810,"dataGaName":811,"dataGaLocation":583},"/services/","services",{"text":813,"config":814},"Contribute",{"href":815,"dataGaName":816,"dataGaLocation":583},"https://contributors.gitlab.com","contribute",{"text":818,"config":819},"Community",{"href":820,"dataGaName":821,"dataGaLocation":583},"/community/","community",{"text":823,"config":824},"Forum",{"href":825,"dataGaName":826,"dataGaLocation":583},"https://forum.gitlab.com/","forum",{"text":828,"config":829},"Events",{"href":830,"dataGaName":831,"dataGaLocation":583},"/events/","events",{"text":833,"config":834},"Partners",{"href":835,"dataGaName":836,"dataGaLocation":583},"/partners/","partners",{"config":838,"title":841,"text":842,"link":843},{"background":839,"textColor":840},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":844,"config":845},"Read the latest",{"href":846,"dataGaName":847,"dataGaLocation":583},"/whats-new/","whats new",{"text":849,"config":850,"menu":852},"Company",{"dataNavLevelOne":851},"company",{"type":634,"columns":853},[854],{"items":855},[856,861,867,869,874,879,884,889,894,899],{"text":857,"config":858},"About",{"href":859,"dataGaName":860,"dataGaLocation":583},"/company/","about",{"text":862,"config":863,"footerGa":866},"Jobs",{"href":864,"dataGaName":865,"dataGaLocation":583},"/jobs/","jobs",{"dataGaName":865},{"text":828,"config":868},{"href":830,"dataGaName":831,"dataGaLocation":583},{"text":870,"config":871},"Leadership",{"href":872,"dataGaName":873,"dataGaLocation":583},"/company/team/e-group/","leadership",{"text":875,"config":876},"Handbook",{"href":877,"dataGaName":878,"dataGaLocation":583},"https://handbook.gitlab.com/","handbook",{"text":880,"config":881},"Investor relations",{"href":882,"dataGaName":883,"dataGaLocation":583},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":885,"config":886},"Trust Center",{"href":887,"dataGaName":888,"dataGaLocation":583},"/security/","trust center",{"text":890,"config":891},"AI Transparency Center",{"href":892,"dataGaName":893,"dataGaLocation":583},"/ai-transparency-center/","ai transparency center",{"text":895,"config":896},"Newsletter",{"href":897,"dataGaName":898,"dataGaLocation":583},"/company/contact/#contact-forms","newsletter",{"text":900,"config":901},"Press",{"href":902,"dataGaName":903,"dataGaLocation":583},"/press/","press",{"text":905,"config":906,"menu":907},"Contact us",{"dataNavLevelOne":851},{"type":634,"columns":908},[909],{"items":910},[911,916,921],{"text":912,"config":913},"Talk to sales",{"href":914,"dataGaName":915,"dataGaLocation":583},"/sales/","talk to sales",{"text":917,"config":918},"Support portal",{"href":919,"dataGaName":920,"dataGaLocation":583},"https://support.gitlab.com/hc/en-us","support portal",{"text":922,"config":923},"Customer portal",{"href":924,"dataGaName":925,"dataGaLocation":583},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":927,"login":928,"suggestions":935},"Close",{"text":929,"link":930},"To search repositories and projects, login to",{"text":931,"config":932},"gitlab.com",{"href":597,"dataGaName":933,"dataGaLocation":934},"search login","search",{"text":936,"default":937},"Suggestions",[938,940,944,946,950,954],{"text":614,"config":939},{"href":619,"dataGaName":614,"dataGaLocation":934},{"text":941,"config":942},"Code Suggestions (AI)",{"href":943,"dataGaName":941,"dataGaLocation":934},"/solutions/code-suggestions/",{"text":650,"config":945},{"href":652,"dataGaName":650,"dataGaLocation":934},{"text":947,"config":948},"GitLab on AWS",{"href":949,"dataGaName":947,"dataGaLocation":934},"/partners/technology-partners/aws/",{"text":951,"config":952},"GitLab on Google Cloud",{"href":953,"dataGaName":951,"dataGaLocation":934},"/partners/technology-partners/google-cloud-platform/",{"text":955,"config":956},"Why GitLab?",{"href":627,"dataGaName":955,"dataGaLocation":934},{"freeTrial":958,"mobileIcon":963,"desktopIcon":968,"secondaryButton":971},{"text":959,"config":960},"Start free trial",{"href":961,"dataGaName":588,"dataGaLocation":962},"https://gitlab.com/-/trials/new/","nav",{"altText":964,"config":965},"Gitlab Icon",{"src":966,"dataGaName":967,"dataGaLocation":962},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":964,"config":969},{"src":970,"dataGaName":967,"dataGaLocation":962},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":972,"config":973},"Get Started",{"href":974,"dataGaName":975,"dataGaLocation":962},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":977,"mobileIcon":981,"desktopIcon":983},{"text":978,"config":979},"Learn more about GitLab Duo",{"href":619,"dataGaName":980,"dataGaLocation":962},"gitlab duo",{"altText":964,"config":982},{"src":966,"dataGaName":967,"dataGaLocation":962},{"altText":964,"config":984},{"src":970,"dataGaName":967,"dataGaLocation":962},{"button":986,"mobileIcon":991,"desktopIcon":993},{"text":987,"config":988},"/switch",{"href":989,"dataGaName":990,"dataGaLocation":962},"#contact","switch",{"altText":964,"config":992},{"src":966,"dataGaName":967,"dataGaLocation":962},{"altText":964,"config":994},{"src":995,"dataGaName":967,"dataGaLocation":962},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":997,"mobileIcon":1002,"desktopIcon":1004},{"text":998,"config":999},"Back to pricing",{"href":732,"dataGaName":1000,"dataGaLocation":962,"icon":1001},"back to pricing","GoBack",{"altText":964,"config":1003},{"src":966,"dataGaName":967,"dataGaLocation":962},{"altText":964,"config":1005},{"src":970,"dataGaName":967,"dataGaLocation":962},{"title":1007,"titleMobile":1008,"button":1009,"config":1014},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":625,"config":1010},{"href":1011,"dataGaName":1012,"dataGaLocation":1013},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1015,"disabled":564},"release",{"data":1017},{"text":1018,"source":1019,"edit":1025,"contribute":1030,"config":1035,"items":1040,"minimal":1250},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1020,"config":1021},"View page source",{"href":1022,"dataGaName":1023,"dataGaLocation":1024},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1026,"config":1027},"Edit this page",{"href":1028,"dataGaName":1029,"dataGaLocation":1024},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1031,"config":1032},"Please contribute",{"href":1033,"dataGaName":1034,"dataGaLocation":1024},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1036,"facebook":1037,"youtube":1038,"linkedin":1039},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1041,1088,1142,1186,1218],{"title":730,"links":1042,"subMenu":1057},[1043,1047,1052],{"text":1044,"config":1045},"View plans",{"href":732,"dataGaName":1046,"dataGaLocation":1024},"view plans",{"text":1048,"config":1049},"Why Premium?",{"href":1050,"dataGaName":1051,"dataGaLocation":1024},"/pricing/premium/","why premium",{"text":1053,"config":1054},"Why Ultimate?",{"href":1055,"dataGaName":1056,"dataGaLocation":1024},"/pricing/ultimate/","why ultimate",[1058],{"title":1059,"links":1060},"Contact Us",[1061,1064,1066,1068,1073,1078,1083],{"text":1062,"config":1063},"Contact sales",{"href":914,"dataGaName":593,"dataGaLocation":1024},{"text":917,"config":1065},{"href":919,"dataGaName":920,"dataGaLocation":1024},{"text":922,"config":1067},{"href":924,"dataGaName":925,"dataGaLocation":1024},{"text":1069,"config":1070},"Status",{"href":1071,"dataGaName":1072,"dataGaLocation":1024},"https://status.gitlab.com/","status",{"text":1074,"config":1075},"Terms of use",{"href":1076,"dataGaName":1077,"dataGaLocation":1024},"/terms/","terms of use",{"text":1079,"config":1080},"Privacy statement",{"href":1081,"dataGaName":1082,"dataGaLocation":1024},"/privacy/","privacy statement",{"text":1084,"config":1085},"Cookie preferences",{"dataGaName":1086,"dataGaLocation":1024,"id":1087,"isOneTrustButton":567},"cookie preferences","ot-sdk-btn",{"title":630,"links":1089,"subMenu":1098},[1090,1094],{"text":1091,"config":1092},"DevSecOps platform",{"href":612,"dataGaName":1093,"dataGaLocation":1024},"devsecops platform",{"text":1095,"config":1096},"AI-Assisted Development",{"href":619,"dataGaName":1097,"dataGaLocation":1024},"ai-assisted development",[1099],{"title":1100,"links":1101},"Topics",[1102,1107,1112,1117,1122,1127,1132,1137],{"text":1103,"config":1104},"CICD",{"href":1105,"dataGaName":1106,"dataGaLocation":1024},"/topics/ci-cd/","cicd",{"text":1108,"config":1109},"GitOps",{"href":1110,"dataGaName":1111,"dataGaLocation":1024},"/topics/gitops/","gitops",{"text":1113,"config":1114},"DevOps",{"href":1115,"dataGaName":1116,"dataGaLocation":1024},"/topics/devops/","devops",{"text":1118,"config":1119},"Version Control",{"href":1120,"dataGaName":1121,"dataGaLocation":1024},"/topics/version-control/","version control",{"text":1123,"config":1124},"DevSecOps",{"href":1125,"dataGaName":1126,"dataGaLocation":1024},"/topics/devsecops/","devsecops",{"text":1128,"config":1129},"Cloud Native",{"href":1130,"dataGaName":1131,"dataGaLocation":1024},"/topics/cloud-native/","cloud native",{"text":1133,"config":1134},"AI for Coding",{"href":1135,"dataGaName":1136,"dataGaLocation":1024},"/topics/devops/ai-for-coding/","ai for coding",{"text":1138,"config":1139},"Agentic AI",{"href":1140,"dataGaName":1141,"dataGaLocation":1024},"/topics/agentic-ai/","agentic ai",{"title":1143,"links":1144},"Solutions",[1145,1147,1149,1154,1158,1161,1165,1168,1170,1173,1176,1181],{"text":674,"config":1146},{"href":669,"dataGaName":674,"dataGaLocation":1024},{"text":663,"config":1148},{"href":646,"dataGaName":647,"dataGaLocation":1024},{"text":1150,"config":1151},"Agile development",{"href":1152,"dataGaName":1153,"dataGaLocation":1024},"/solutions/agile-delivery/","agile delivery",{"text":1155,"config":1156},"SCM",{"href":659,"dataGaName":1157,"dataGaLocation":1024},"source code management",{"text":1103,"config":1159},{"href":652,"dataGaName":1160,"dataGaLocation":1024},"continuous integration & delivery",{"text":1162,"config":1163},"Value stream management",{"href":702,"dataGaName":1164,"dataGaLocation":1024},"value stream management",{"text":1108,"config":1166},{"href":1167,"dataGaName":1111,"dataGaLocation":1024},"/solutions/gitops/",{"text":712,"config":1169},{"href":715,"dataGaName":716,"dataGaLocation":1024},{"text":1171,"config":1172},"Small business",{"href":721,"dataGaName":722,"dataGaLocation":1024},{"text":1174,"config":1175},"Public sector",{"href":727,"dataGaName":728,"dataGaLocation":1024},{"text":1177,"config":1178},"Education",{"href":1179,"dataGaName":1180,"dataGaLocation":1024},"/solutions/education/","education",{"text":1182,"config":1183},"Financial services",{"href":1184,"dataGaName":1185,"dataGaLocation":1024},"/solutions/finance/","financial services",{"title":735,"links":1187},[1188,1190,1192,1194,1197,1199,1202,1204,1206,1208,1210,1212,1214,1216],{"text":748,"config":1189},{"href":750,"dataGaName":751,"dataGaLocation":1024},{"text":753,"config":1191},{"href":755,"dataGaName":756,"dataGaLocation":1024},{"text":758,"config":1193},{"href":760,"dataGaName":761,"dataGaLocation":1024},{"text":763,"config":1195},{"href":765,"dataGaName":1196,"dataGaLocation":1024},"docs",{"text":786,"config":1198},{"href":788,"dataGaName":789,"dataGaLocation":1024},{"text":1200,"config":1201},"What's new",{"href":846,"dataGaName":847,"dataGaLocation":1024},{"text":781,"config":1203},{"href":783,"dataGaName":784,"dataGaLocation":1024},{"text":800,"config":1205},{"href":802,"dataGaName":803,"dataGaLocation":1024},{"text":808,"config":1207},{"href":810,"dataGaName":811,"dataGaLocation":1024},{"text":813,"config":1209},{"href":815,"dataGaName":816,"dataGaLocation":1024},{"text":818,"config":1211},{"href":820,"dataGaName":821,"dataGaLocation":1024},{"text":823,"config":1213},{"href":825,"dataGaName":826,"dataGaLocation":1024},{"text":828,"config":1215},{"href":830,"dataGaName":831,"dataGaLocation":1024},{"text":833,"config":1217},{"href":835,"dataGaName":836,"dataGaLocation":1024},{"title":849,"links":1219},[1220,1222,1224,1226,1228,1230,1234,1239,1241,1243,1245],{"text":857,"config":1221},{"href":859,"dataGaName":851,"dataGaLocation":1024},{"text":862,"config":1223},{"href":864,"dataGaName":865,"dataGaLocation":1024},{"text":870,"config":1225},{"href":872,"dataGaName":873,"dataGaLocation":1024},{"text":875,"config":1227},{"href":877,"dataGaName":878,"dataGaLocation":1024},{"text":880,"config":1229},{"href":882,"dataGaName":883,"dataGaLocation":1024},{"text":1231,"config":1232},"Sustainability",{"href":1233,"dataGaName":1231,"dataGaLocation":1024},"/sustainability/",{"text":1235,"config":1236},"Diversity, inclusion and belonging (DIB)",{"href":1237,"dataGaName":1238,"dataGaLocation":1024},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":885,"config":1240},{"href":887,"dataGaName":888,"dataGaLocation":1024},{"text":895,"config":1242},{"href":897,"dataGaName":898,"dataGaLocation":1024},{"text":900,"config":1244},{"href":902,"dataGaName":903,"dataGaLocation":1024},{"text":1246,"config":1247},"Modern Slavery Transparency Statement",{"href":1248,"dataGaName":1249,"dataGaLocation":1024},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1251},[1252,1255,1258],{"text":1253,"config":1254},"Terms",{"href":1076,"dataGaName":1077,"dataGaLocation":1024},{"text":1256,"config":1257},"Cookies",{"dataGaName":1086,"dataGaLocation":1024,"id":1087,"isOneTrustButton":567},{"text":1259,"config":1260},"Privacy",{"href":1081,"dataGaName":1082,"dataGaLocation":1024},[1262],{"id":1263,"title":7,"body":563,"config":1264,"content":1266,"description":563,"extension":1270,"meta":1271,"navigation":567,"path":1272,"seo":1273,"stem":1274,"__hash__":1275},"blogAuthors/en-us/blog/authors/nikhil-george.yml",{"template":1265},"BlogAuthor",{"name":7,"config":1267},{"headshot":1268,"ctfId":1269},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749666175/Blog/Author%20Headshots/ngeorge1-headshot.jpg","ngeorge1","yml",{},"/en-us/blog/authors/nikhil-george",{},"en-us/blog/authors/nikhil-george","HtdiuBDt8qLguzAQz7PXKrMDsx5GGioCMxQwbVdAwio",[1277,1285,1293],{"title":1278,"description":1279,"heroImage":1280,"category":559,"date":1281,"authors":1282,"slug":1284,"externalUrl":563},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1283],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1286,"description":1287,"heroImage":1280,"category":559,"date":1288,"authors":1289,"slug":1292,"externalUrl":563},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1290,1291],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1294,"description":1295,"heroImage":1296,"category":559,"date":1297,"authors":1298,"slug":1300,"externalUrl":563},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1299],"Alisa Ho","claude-security-and-gitlab",{"promotions":1302},[1303,1317,1329,1340],{"id":1304,"categories":1305,"header":1307,"text":1308,"button":1309,"image":1314},"ai-modernization",[1306],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1310,"config":1311},"Get your AI maturity score",{"href":1312,"dataGaName":1313,"dataGaLocation":789},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1315},{"src":1316},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1318,"categories":1319,"header":1321,"text":1308,"button":1322,"image":1326},"devops-modernization",[1320,1126],"product","Are you just managing tools or shipping innovation?",{"text":1323,"config":1324},"Get your DevOps maturity score",{"href":1325,"dataGaName":1313,"dataGaLocation":789},"/assessments/devops-modernization-assessment/",{"config":1327},{"src":1328},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1330,"categories":1331,"header":1332,"text":1308,"button":1333,"image":1337},"security-modernization",[559],"Are you trading speed for security?",{"text":1334,"config":1335},"Get your security maturity score",{"href":1336,"dataGaName":1313,"dataGaLocation":789},"/assessments/security-modernization-assessment/",{"config":1338},{"src":1339},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1341,"paths":1342,"header":1345,"text":1346,"button":1347,"image":1352},"github-azure-migration",[1343,1344],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1348,"config":1349},"See how GitLab compares to GitHub",{"href":1350,"dataGaName":1351,"dataGaLocation":789},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1353},{"src":1328},{"header":1355,"blurb":1356,"button":1357,"secondaryButton":1362},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1358,"config":1359},"Get your free trial",{"href":1360,"dataGaName":588,"dataGaLocation":1361},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1062,"config":1363},{"href":914,"dataGaName":593,"dataGaLocation":1361},1786803771991]