[{"data":1,"prerenderedAt":1002},["ShallowReactive",2],{"/blog/inside-the-gitlab-public-bug-bounty-program":3,"navigation-en-us":220,"banner-en-us":646,"footer-en-us":656,"blog-post-authors-en-us-Kathy Wang":900,"blog-related-posts-en-us-inside-the-gitlab-public-bug-bounty-program":914,"blog-promotions-en-us":939,"next-steps-en-us":992},{"id":4,"title":5,"authors":6,"body":8,"category":198,"date":199,"description":200,"extension":201,"externalUrl":202,"faq":202,"featured":203,"heroImage":204,"meta":205,"navigation":206,"path":207,"seo":208,"slug":212,"stem":213,"tags":214,"template":218,"updatedDate":202,"__hash__":219},"blogPosts/en-us/blog/inside-the-gitlab-public-bug-bounty-program.md","Inside the GitLab public bug bounty program",[7],"Kathy Wang",{"type":9,"value":10,"toc":185},"minimark",[11,15,25,46,49,61,66,74,77,85,89,92,97,100,104,107,112,145,149,168,172,175,179,182],[12,13,14],"p",{},"At GitLab, our Security Team has two top-level missions that all of our goals must map to:",[16,17,18,22],"ol",{},[19,20,21],"li",{},"Secure the product and service.",[19,23,24],{},"Protect the company.",[12,26,27,28,33,34,39,40,45],{},"We understand that source code is often the crown jewel of any organization. This is true of the ",[29,30,32],"a",{"href":31},"/blog/gitlab-is-open-core-github-is-closed-source/","open core"," code that powers GitLab itself, so we are constantly applying our value of ",[29,35,38],{"href":36,"rel":37},"https://handbook.gitlab.com/handbook/values/#results",[],"results"," and ",[29,41,44],{"href":42,"rel":43},"https://handbook.gitlab.com/handbook/values/#iteration",[],"iteration"," to the benefit of all GitLab users.",[12,47,48],{},"There are a few basic truths about security:",[50,51,52,55,58],"ul",{},[19,53,54],{},"Security is about people, process, and technology. Understanding how to optimally balance those pillars is crucial to an effective strategy and strong security posture.",[19,56,57],{},"Security cannot block business process and the ability to get work done.",[19,59,60],{},"Security is never 100 percent, and a multi-layer approach must be taken to reduce risk.",[62,63,65],"h2",{"id":64},"proactive-and-reactive-security-measures","Proactive and reactive security measures",[12,67,68,69,73],{},"It makes sense to think about security in terms of proactive and reactive measures, as both are required to truly implement defense-in-depth security. When it comes to ",[29,70,72],{"href":71},"/topics/devsecops/","application security",", proactive measures include conducting internal application security reviews and educating developers on secure coding best practices. However, the ratio of developers to application security engineers is high, so the feasibility for organizations to review every single line of code manually is decreasing. Code scanning measures introduce automation in reviewing, but could also miss findings.",[12,75,76],{},"Enter reactive measures, such as internal red teams and public bug bounty programs. These come in after the fact – after the source code is written and committed – and provide another, necessary layer of security to our environment.",[12,78,79,80,84],{},"Since launching GitLab’s ",[29,81,83],{"href":82},"/blog/gitlab-hackerone-bug-bounty-program-is-public-today/","public bug bounty program"," in December 2018, we’ve resolved 95 security findings, awarded more than $300,000 in bounties and rewarded over 35 hackers for those findings. The overarching goal of our bug bounty program is to make our products and services more secure, and we’re proud of the early success we’ve seen to date.",[62,86,88],{"id":87},"how-are-we-measuring-success","How are we measuring success?",[12,90,91],{},"We’re looking at several key metrics and focus areas to determine what’s working and what needs to improve. In fact, our next blog post will dive into some of our early lessons learned, and the process and program improvements we’ve made to ensure we’re meeting our goal.",[93,94,96],"h3",{"id":95},"quantity-of-new-report-submissions","Quantity of new report submissions",[12,98,99],{},"We look at the total number of reports received and the average of new reports created each month to help us ensure we’re moving in the right direction in terms of incentivization and engagement amongst our HackerOne reporters. In just the first three months after making our bug bounty program public, we received 266 new reports. That’s an average of 88.6 reports per month. Of those reported, 76 were triaged as valid and 89 were resolved. We classify triaged reports as those for which we’ve assessed a potential user impact, and resolved reports are those we’ve investigated and resolved.",[93,101,103],{"id":102},"repeat-reporters","Repeat reporters",[12,105,106],{},"When we have reporters who continue to submit findings to our program, that’s another signal that we are on the right track in terms of incentivizing and supporting their efforts so that they keep coming back. Out of a total of 247 reporters from the past year, 38 percent have submitted more than one, 13 percent more than five, and 6 percent more than 10 reports.",[108,109,111],"h4",{"id":110},"check-out-the-top-five-gitlab-reporters-by-bounty","Check out the top five GitLab reporters (by bounty):",[16,113,114,121,128,131,138],{},[19,115,116],{},[29,117,120],{"href":118,"rel":119},"https://hackerone.com/ngalog",[],"ngalog",[19,122,123],{},[29,124,127],{"href":125,"rel":126},"https://hackerone.com/jobert",[]," jobert",[19,129,130],{},"nyangawa",[19,132,133],{},[29,134,137],{"href":135,"rel":136},"https://hackerone.com/fransrosen",[],"fransrosen",[19,139,140],{},[29,141,144],{"href":142,"rel":143},"https://hackerone.com/xanbanx",[],"xanbanx",[93,146,148],{"id":147},"transparency","Transparency",[12,150,151,152,156,157,162,163,167],{},"The majority of reporters want to make their vulnerability reports public to showcase their findings and techniques and, also, just for some good ol’ fashioned bragging rights within the hacker community. There’s also a real need in this community to be constantly challenged and a dedication to learning that public disclosure helps to satisfy. Many other bug bounty programs don’t publicly release the full details of their vulnerability reports and subsequently discourage the HackerOne community from sharing or showing off their findings. However, as one of GitLab's values is ",[29,153,147],{"href":154,"rel":155},"https://handbook.gitlab.com/handbook/values/#transparency",[],", we set all vulnerability details to public in our ",[29,158,161],{"href":159,"rel":160},"https://gitlab.com/groups/gitlab-org/-/issues?scope=all&utf8=%E2%9C%93&state=closed&label_name%5B%5D=security&label_name%5B%5D=HackerOne",[],"issue tracker"," 30 days after a patch has been ",[29,164,166],{"href":165},"/whats-new/","released",".",[93,169,171],{"id":170},"responsiveness","Responsiveness",[12,173,174],{},"The HackerOne community expects responsiveness in the communication of updates and payment of bounties. To help ensure we respond and triage as quickly as possible, we’ve built in automation so that we can provide timely initial and ongoing feedback to reporters, as well as continuous updates on the ETA of fixes for existing reports. We’re working in the area of bounties payment to improve our process and reward bounties immediately after triage, where applicable, rather than when fixed. Expect to hear more on this in forthcoming bug bounty blog posts!",[93,176,178],{"id":177},"competitive-rewards","Competitive rewards",[12,180,181],{},"Our desire is to be the number one paying bounty company in our industry. This aim is to keep reporters incentivized, motivated, and engaged to find bugs on our platform. Our public bug bounty program is as important to the security of our product and company as any other program we run within our Security Team here at GitLab. That's why we’re continually looking to improve our processes and incentive structure to benefit our reporter community.",[12,183,184],{},"  \nWe know a big, fat check speaks volumes, but we also know some cool swag is a nice little pat on the back too. So, we’re putting it out there – if you could put a GitLab Tanuki on any piece of swag – what would it be?  Leave us a comment below!\n  ",{"title":186,"searchDepth":187,"depth":187,"links":188},"",2,[189,190],{"id":64,"depth":187,"text":65},{"id":87,"depth":187,"text":88,"children":191},[192,194,195,196,197],{"id":95,"depth":193,"text":96},3,{"id":102,"depth":193,"text":103},{"id":147,"depth":193,"text":148},{"id":170,"depth":193,"text":171},{"id":177,"depth":193,"text":178},"security","2019-04-29","Four months since going public with our bug bounty program, we dive into where we’re at, what success looks like, and what to expect down the road.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749679034/Blog/Hero%20Images/inside-gitLab-public-bug-bounty-program.png",{},true,"/en-us/blog/inside-the-gitlab-public-bug-bounty-program",{"title":5,"description":200,"ogTitle":5,"ogDescription":200,"noIndex":203,"ogImage":204,"ogUrl":209,"ogSiteName":210,"ogType":211,"canonicalUrls":209},"https://about.gitlab.com/blog/inside-the-gitlab-public-bug-bounty-program","https://about.gitlab.com","article","inside-the-gitlab-public-bug-bounty-program","en-us/blog/inside-the-gitlab-public-bug-bounty-program",[215,198,216,217],"community","open source","bug bounty","BlogPost","N_-Div5EgE4oIFpkQ5Lgnq-2pWSmAMjJYePJnjTBJOc",{"logo":221,"freeTrial":226,"sales":231,"login":236,"items":241,"search":566,"minimal":597,"duo":616,"switchNav":625,"pricingDeployment":636},{"config":222},{"href":223,"dataGaName":224,"dataGaLocation":225},"/","gitlab logo","header",{"text":227,"config":228},"Get free trial",{"href":229,"dataGaName":230,"dataGaLocation":225},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":232,"config":233},"Request a demo",{"href":234,"dataGaName":235,"dataGaLocation":225},"/sales/?contact-topic=request-demo","sales",{"text":237,"config":238},"Sign in",{"href":239,"dataGaName":240,"dataGaLocation":225},"https://gitlab.com/users/sign_in/","sign in",[242,271,371,376,488,544],{"text":243,"config":244,"menu":246},"Platform",{"dataNavLevelOne":245},"platform",{"type":247,"columns":248},"cards",[249,255,263],{"title":243,"description":250,"link":251},"The intelligent orchestration platform for DevSecOps",{"text":252,"config":253},"Explore our Platform",{"href":254,"dataGaName":245,"dataGaLocation":225},"/platform/",{"title":256,"description":257,"link":258},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":259,"config":260},"Meet GitLab Duo",{"href":261,"dataGaName":262,"dataGaLocation":225},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":264,"description":265,"link":266},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":267,"config":268},"Learn more",{"href":269,"dataGaName":270,"dataGaLocation":225},"/why-gitlab/","why gitlab",{"text":272,"left":206,"config":273,"menu":275},"Product",{"dataNavLevelOne":274},"solutions",{"type":276,"link":277,"columns":281,"feature":350},"lists",{"text":278,"config":279},"View all Solutions",{"href":280,"dataGaName":274,"dataGaLocation":225},"/solutions/",[282,306,329],{"title":283,"description":284,"link":285,"items":290},"Automation","CI/CD and automation to accelerate deployment",{"config":286},{"icon":287,"href":288,"dataGaName":289,"dataGaLocation":225},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[291,295,298,302],{"text":292,"config":293},"CI/CD",{"href":294,"dataGaLocation":225,"dataGaName":292},"/solutions/continuous-integration/",{"text":256,"config":296},{"href":261,"dataGaLocation":225,"dataGaName":297},"gitlab duo agent platform - product menu",{"text":299,"config":300},"Source Code Management",{"href":301,"dataGaLocation":225,"dataGaName":299},"/solutions/source-code-management/",{"text":303,"config":304},"Automated Software Delivery",{"href":288,"dataGaLocation":225,"dataGaName":305},"Automated software delivery",{"title":307,"description":308,"link":309,"items":314},"Security","Deliver code faster without compromising security",{"config":310},{"href":311,"dataGaName":312,"dataGaLocation":225,"icon":313},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[315,319,324],{"text":316,"config":317},"Application Security Testing",{"href":311,"dataGaName":318,"dataGaLocation":225},"Application security testing",{"text":320,"config":321},"Software Supply Chain Security",{"href":322,"dataGaLocation":225,"dataGaName":323},"/solutions/supply-chain/","Software supply chain security",{"text":325,"config":326},"Software Compliance",{"href":327,"dataGaName":328,"dataGaLocation":225},"/solutions/software-compliance/","software compliance",{"title":330,"link":331,"items":336},"Measurement",{"config":332},{"icon":333,"href":334,"dataGaName":335,"dataGaLocation":225},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[337,341,345],{"text":338,"config":339},"Visibility & Measurement",{"href":334,"dataGaLocation":225,"dataGaName":340},"Visibility and Measurement",{"text":342,"config":343},"Value Stream Management",{"href":344,"dataGaLocation":225,"dataGaName":342},"/solutions/value-stream-management/",{"text":346,"config":347},"Analytics & Insights",{"href":348,"dataGaLocation":225,"dataGaName":349},"/solutions/analytics-and-insights/","Analytics and insights",{"title":351,"type":276,"items":352},"GitLab for",[353,359,365],{"text":354,"config":355},"Enterprise",{"icon":356,"href":357,"dataGaLocation":225,"dataGaName":358},"Building","/enterprise/","enterprise",{"text":360,"config":361},"Small Business",{"icon":362,"href":363,"dataGaLocation":225,"dataGaName":364},"Work","/small-business/","small business",{"text":366,"config":367},"Public Sector",{"icon":368,"href":369,"dataGaLocation":225,"dataGaName":370},"Organization","/solutions/public-sector/","public sector",{"text":372,"config":373},"Pricing",{"href":374,"dataGaName":375,"dataGaLocation":225,"dataNavLevelOne":375},"/pricing/","pricing",{"text":377,"config":378,"menu":380},"Resources",{"dataNavLevelOne":379},"resources",{"type":276,"link":381,"columns":385,"feature":478},{"text":382,"config":383},"View all resources",{"href":384,"dataGaName":379,"dataGaLocation":225},"/resources/",[386,419,446],{"title":387,"items":388},"Getting started",[389,394,399,404,409,414],{"text":390,"config":391},"Install",{"href":392,"dataGaName":393,"dataGaLocation":225},"/install/","install",{"text":395,"config":396},"Quick start guides",{"href":397,"dataGaName":398,"dataGaLocation":225},"/get-started/","quick setup checklists",{"text":400,"config":401},"Learn",{"href":402,"dataGaLocation":225,"dataGaName":403},"https://university.gitlab.com/","learn",{"text":405,"config":406},"Product documentation",{"href":407,"dataGaName":408,"dataGaLocation":225},"https://docs.gitlab.com/","product documentation",{"text":410,"config":411},"Best practice videos",{"href":412,"dataGaName":413,"dataGaLocation":225},"/getting-started-videos/","best practice videos",{"text":415,"config":416},"Integrations",{"href":417,"dataGaName":418,"dataGaLocation":225},"/integrations/","integrations",{"title":420,"items":421},"Discover",[422,427,432,437,441],{"text":423,"config":424},"Customer success stories",{"href":425,"dataGaName":426,"dataGaLocation":225},"/customers/","customer success stories",{"text":428,"config":429},"Blog",{"href":430,"dataGaName":431,"dataGaLocation":225},"/blog/","blog",{"text":433,"config":434},"Demo Hub",{"href":435,"dataGaName":436,"dataGaLocation":225},"/demo-hub/","demo hub",{"text":438,"config":439},"The Source",{"href":440,"dataGaName":431,"dataGaLocation":225},"/the-source/",{"text":442,"config":443},"Remote",{"href":444,"dataGaName":445,"dataGaLocation":225},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":447,"items":448},"Connect",[449,454,459,463,468,473],{"text":450,"config":451},"GitLab Services",{"href":452,"dataGaName":453,"dataGaLocation":225},"/services/","services",{"text":455,"config":456},"Contribute",{"href":457,"dataGaName":458,"dataGaLocation":225},"https://contributors.gitlab.com","contribute",{"text":460,"config":461},"Community",{"href":462,"dataGaName":215,"dataGaLocation":225},"/community/",{"text":464,"config":465},"Forum",{"href":466,"dataGaName":467,"dataGaLocation":225},"https://forum.gitlab.com/","forum",{"text":469,"config":470},"Events",{"href":471,"dataGaName":472,"dataGaLocation":225},"/events/","events",{"text":474,"config":475},"Partners",{"href":476,"dataGaName":477,"dataGaLocation":225},"/partners/","partners",{"config":479,"title":482,"text":483,"link":484},{"background":480,"textColor":481},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":485,"config":486},"Read the latest",{"href":165,"dataGaName":487,"dataGaLocation":225},"whats new",{"text":489,"config":490,"menu":492},"Company",{"dataNavLevelOne":491},"company",{"type":276,"columns":493},[494],{"items":495},[496,501,507,509,514,519,524,529,534,539],{"text":497,"config":498},"About",{"href":499,"dataGaName":500,"dataGaLocation":225},"/company/","about",{"text":502,"config":503,"footerGa":506},"Jobs",{"href":504,"dataGaName":505,"dataGaLocation":225},"/jobs/","jobs",{"dataGaName":505},{"text":469,"config":508},{"href":471,"dataGaName":472,"dataGaLocation":225},{"text":510,"config":511},"Leadership",{"href":512,"dataGaName":513,"dataGaLocation":225},"/company/team/e-group/","leadership",{"text":515,"config":516},"Handbook",{"href":517,"dataGaName":518,"dataGaLocation":225},"https://handbook.gitlab.com/","handbook",{"text":520,"config":521},"Investor relations",{"href":522,"dataGaName":523,"dataGaLocation":225},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":525,"config":526},"Trust Center",{"href":527,"dataGaName":528,"dataGaLocation":225},"/security/","trust center",{"text":530,"config":531},"AI Transparency Center",{"href":532,"dataGaName":533,"dataGaLocation":225},"/ai-transparency-center/","ai transparency center",{"text":535,"config":536},"Newsletter",{"href":537,"dataGaName":538,"dataGaLocation":225},"/company/contact/#contact-forms","newsletter",{"text":540,"config":541},"Press",{"href":542,"dataGaName":543,"dataGaLocation":225},"/press/","press",{"text":545,"config":546,"menu":547},"Contact us",{"dataNavLevelOne":491},{"type":276,"columns":548},[549],{"items":550},[551,556,561],{"text":552,"config":553},"Talk to sales",{"href":554,"dataGaName":555,"dataGaLocation":225},"/sales/","talk to sales",{"text":557,"config":558},"Support portal",{"href":559,"dataGaName":560,"dataGaLocation":225},"https://support.gitlab.com/hc/en-us","support portal",{"text":562,"config":563},"Customer portal",{"href":564,"dataGaName":565,"dataGaLocation":225},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":567,"login":568,"suggestions":575},"Close",{"text":569,"link":570},"To search repositories and projects, login to",{"text":571,"config":572},"gitlab.com",{"href":239,"dataGaName":573,"dataGaLocation":574},"search login","search",{"text":576,"default":577},"Suggestions",[578,580,584,586,590,594],{"text":256,"config":579},{"href":261,"dataGaName":256,"dataGaLocation":574},{"text":581,"config":582},"Code Suggestions (AI)",{"href":583,"dataGaName":581,"dataGaLocation":574},"/solutions/code-suggestions/",{"text":292,"config":585},{"href":294,"dataGaName":292,"dataGaLocation":574},{"text":587,"config":588},"GitLab on AWS",{"href":589,"dataGaName":587,"dataGaLocation":574},"/partners/technology-partners/aws/",{"text":591,"config":592},"GitLab on Google Cloud",{"href":593,"dataGaName":591,"dataGaLocation":574},"/partners/technology-partners/google-cloud-platform/",{"text":595,"config":596},"Why GitLab?",{"href":269,"dataGaName":595,"dataGaLocation":574},{"freeTrial":598,"mobileIcon":603,"desktopIcon":608,"secondaryButton":611},{"text":599,"config":600},"Start free trial",{"href":601,"dataGaName":230,"dataGaLocation":602},"https://gitlab.com/-/trials/new/","nav",{"altText":604,"config":605},"Gitlab Icon",{"src":606,"dataGaName":607,"dataGaLocation":602},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":604,"config":609},{"src":610,"dataGaName":607,"dataGaLocation":602},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":612,"config":613},"Get Started",{"href":614,"dataGaName":615,"dataGaLocation":602},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":617,"mobileIcon":621,"desktopIcon":623},{"text":618,"config":619},"Learn more about GitLab Duo",{"href":261,"dataGaName":620,"dataGaLocation":602},"gitlab duo",{"altText":604,"config":622},{"src":606,"dataGaName":607,"dataGaLocation":602},{"altText":604,"config":624},{"src":610,"dataGaName":607,"dataGaLocation":602},{"button":626,"mobileIcon":631,"desktopIcon":633},{"text":627,"config":628},"/switch",{"href":629,"dataGaName":630,"dataGaLocation":602},"#contact","switch",{"altText":604,"config":632},{"src":606,"dataGaName":607,"dataGaLocation":602},{"altText":604,"config":634},{"src":635,"dataGaName":607,"dataGaLocation":602},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":637,"mobileIcon":642,"desktopIcon":644},{"text":638,"config":639},"Back to pricing",{"href":374,"dataGaName":640,"dataGaLocation":602,"icon":641},"back to pricing","GoBack",{"altText":604,"config":643},{"src":606,"dataGaName":607,"dataGaLocation":602},{"altText":604,"config":645},{"src":610,"dataGaName":607,"dataGaLocation":602},{"title":647,"titleMobile":648,"button":649,"config":654},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":267,"config":650},{"href":651,"dataGaName":652,"dataGaLocation":653},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":655,"disabled":203},"release",{"data":657},{"text":658,"source":659,"edit":665,"contribute":670,"config":675,"items":680,"minimal":889},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":660,"config":661},"View page source",{"href":662,"dataGaName":663,"dataGaLocation":664},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":666,"config":667},"Edit this page",{"href":668,"dataGaName":669,"dataGaLocation":664},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":671,"config":672},"Please contribute",{"href":673,"dataGaName":674,"dataGaLocation":664},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":676,"facebook":677,"youtube":678,"linkedin":679},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[681,728,781,825,857],{"title":372,"links":682,"subMenu":697},[683,687,692],{"text":684,"config":685},"View plans",{"href":374,"dataGaName":686,"dataGaLocation":664},"view plans",{"text":688,"config":689},"Why Premium?",{"href":690,"dataGaName":691,"dataGaLocation":664},"/pricing/premium/","why premium",{"text":693,"config":694},"Why Ultimate?",{"href":695,"dataGaName":696,"dataGaLocation":664},"/pricing/ultimate/","why ultimate",[698],{"title":699,"links":700},"Contact Us",[701,704,706,708,713,718,723],{"text":702,"config":703},"Contact sales",{"href":554,"dataGaName":235,"dataGaLocation":664},{"text":557,"config":705},{"href":559,"dataGaName":560,"dataGaLocation":664},{"text":562,"config":707},{"href":564,"dataGaName":565,"dataGaLocation":664},{"text":709,"config":710},"Status",{"href":711,"dataGaName":712,"dataGaLocation":664},"https://status.gitlab.com/","status",{"text":714,"config":715},"Terms of use",{"href":716,"dataGaName":717,"dataGaLocation":664},"/terms/","terms of use",{"text":719,"config":720},"Privacy statement",{"href":721,"dataGaName":722,"dataGaLocation":664},"/privacy/","privacy statement",{"text":724,"config":725},"Cookie preferences",{"dataGaName":726,"dataGaLocation":664,"id":727,"isOneTrustButton":206},"cookie preferences","ot-sdk-btn",{"title":272,"links":729,"subMenu":738},[730,734],{"text":731,"config":732},"DevSecOps platform",{"href":254,"dataGaName":733,"dataGaLocation":664},"devsecops platform",{"text":735,"config":736},"AI-Assisted Development",{"href":261,"dataGaName":737,"dataGaLocation":664},"ai-assisted development",[739],{"title":740,"links":741},"Topics",[742,747,752,757,762,766,771,776],{"text":743,"config":744},"CICD",{"href":745,"dataGaName":746,"dataGaLocation":664},"/topics/ci-cd/","cicd",{"text":748,"config":749},"GitOps",{"href":750,"dataGaName":751,"dataGaLocation":664},"/topics/gitops/","gitops",{"text":753,"config":754},"DevOps",{"href":755,"dataGaName":756,"dataGaLocation":664},"/topics/devops/","devops",{"text":758,"config":759},"Version Control",{"href":760,"dataGaName":761,"dataGaLocation":664},"/topics/version-control/","version control",{"text":763,"config":764},"DevSecOps",{"href":71,"dataGaName":765,"dataGaLocation":664},"devsecops",{"text":767,"config":768},"Cloud Native",{"href":769,"dataGaName":770,"dataGaLocation":664},"/topics/cloud-native/","cloud native",{"text":772,"config":773},"AI for Coding",{"href":774,"dataGaName":775,"dataGaLocation":664},"/topics/devops/ai-for-coding/","ai for coding",{"text":777,"config":778},"Agentic AI",{"href":779,"dataGaName":780,"dataGaLocation":664},"/topics/agentic-ai/","agentic ai",{"title":782,"links":783},"Solutions",[784,786,788,793,797,800,804,807,809,812,815,820],{"text":316,"config":785},{"href":311,"dataGaName":316,"dataGaLocation":664},{"text":305,"config":787},{"href":288,"dataGaName":289,"dataGaLocation":664},{"text":789,"config":790},"Agile development",{"href":791,"dataGaName":792,"dataGaLocation":664},"/solutions/agile-delivery/","agile delivery",{"text":794,"config":795},"SCM",{"href":301,"dataGaName":796,"dataGaLocation":664},"source code management",{"text":743,"config":798},{"href":294,"dataGaName":799,"dataGaLocation":664},"continuous integration & delivery",{"text":801,"config":802},"Value stream management",{"href":344,"dataGaName":803,"dataGaLocation":664},"value stream management",{"text":748,"config":805},{"href":806,"dataGaName":751,"dataGaLocation":664},"/solutions/gitops/",{"text":354,"config":808},{"href":357,"dataGaName":358,"dataGaLocation":664},{"text":810,"config":811},"Small business",{"href":363,"dataGaName":364,"dataGaLocation":664},{"text":813,"config":814},"Public sector",{"href":369,"dataGaName":370,"dataGaLocation":664},{"text":816,"config":817},"Education",{"href":818,"dataGaName":819,"dataGaLocation":664},"/solutions/education/","education",{"text":821,"config":822},"Financial services",{"href":823,"dataGaName":824,"dataGaLocation":664},"/solutions/finance/","financial services",{"title":377,"links":826},[827,829,831,833,836,838,841,843,845,847,849,851,853,855],{"text":390,"config":828},{"href":392,"dataGaName":393,"dataGaLocation":664},{"text":395,"config":830},{"href":397,"dataGaName":398,"dataGaLocation":664},{"text":400,"config":832},{"href":402,"dataGaName":403,"dataGaLocation":664},{"text":405,"config":834},{"href":407,"dataGaName":835,"dataGaLocation":664},"docs",{"text":428,"config":837},{"href":430,"dataGaName":431,"dataGaLocation":664},{"text":839,"config":840},"What's new",{"href":165,"dataGaName":487,"dataGaLocation":664},{"text":423,"config":842},{"href":425,"dataGaName":426,"dataGaLocation":664},{"text":442,"config":844},{"href":444,"dataGaName":445,"dataGaLocation":664},{"text":450,"config":846},{"href":452,"dataGaName":453,"dataGaLocation":664},{"text":455,"config":848},{"href":457,"dataGaName":458,"dataGaLocation":664},{"text":460,"config":850},{"href":462,"dataGaName":215,"dataGaLocation":664},{"text":464,"config":852},{"href":466,"dataGaName":467,"dataGaLocation":664},{"text":469,"config":854},{"href":471,"dataGaName":472,"dataGaLocation":664},{"text":474,"config":856},{"href":476,"dataGaName":477,"dataGaLocation":664},{"title":489,"links":858},[859,861,863,865,867,869,873,878,880,882,884],{"text":497,"config":860},{"href":499,"dataGaName":491,"dataGaLocation":664},{"text":502,"config":862},{"href":504,"dataGaName":505,"dataGaLocation":664},{"text":510,"config":864},{"href":512,"dataGaName":513,"dataGaLocation":664},{"text":515,"config":866},{"href":517,"dataGaName":518,"dataGaLocation":664},{"text":520,"config":868},{"href":522,"dataGaName":523,"dataGaLocation":664},{"text":870,"config":871},"Sustainability",{"href":872,"dataGaName":870,"dataGaLocation":664},"/sustainability/",{"text":874,"config":875},"Diversity, inclusion and belonging (DIB)",{"href":876,"dataGaName":877,"dataGaLocation":664},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":525,"config":879},{"href":527,"dataGaName":528,"dataGaLocation":664},{"text":535,"config":881},{"href":537,"dataGaName":538,"dataGaLocation":664},{"text":540,"config":883},{"href":542,"dataGaName":543,"dataGaLocation":664},{"text":885,"config":886},"Modern Slavery Transparency Statement",{"href":887,"dataGaName":888,"dataGaLocation":664},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":890},[891,894,897],{"text":892,"config":893},"Terms",{"href":716,"dataGaName":717,"dataGaLocation":664},{"text":895,"config":896},"Cookies",{"dataGaName":726,"dataGaLocation":664,"id":727,"isOneTrustButton":206},{"text":898,"config":899},"Privacy",{"href":721,"dataGaName":722,"dataGaLocation":664},[901],{"id":902,"title":7,"body":202,"config":903,"content":905,"description":202,"extension":908,"meta":909,"navigation":206,"path":910,"seo":911,"stem":912,"__hash__":913},"blogAuthors/en-us/blog/authors/kathy-wang.yml",{"template":904},"BlogAuthor",{"name":7,"config":906},{"headshot":186,"ctfId":907},"kathyw","yml",{},"/en-us/blog/authors/kathy-wang",{},"en-us/blog/authors/kathy-wang","9HtbcSyKvY4qAK0O9FaKMavRsbbpfjX5DbQTTlumwWc",[915,923,931],{"title":916,"description":917,"heroImage":918,"category":198,"date":919,"authors":920,"slug":922,"externalUrl":202},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[921],"Julian Thome","improved-scope-offset-fingerprinting",{"title":924,"description":925,"heroImage":918,"category":198,"date":926,"authors":927,"slug":930,"externalUrl":202},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[928,929],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":932,"description":933,"heroImage":934,"category":198,"date":935,"authors":936,"slug":938,"externalUrl":202},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[937],"Alisa Ho","claude-security-and-gitlab",{"promotions":940},[941,955,967,978],{"id":942,"categories":943,"header":945,"text":946,"button":947,"image":952},"ai-modernization",[944],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":948,"config":949},"Get your AI maturity score",{"href":950,"dataGaName":951,"dataGaLocation":431},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":953},{"src":954},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":956,"categories":957,"header":959,"text":946,"button":960,"image":964},"devops-modernization",[958,765],"product","Are you just managing tools or shipping innovation?",{"text":961,"config":962},"Get your DevOps maturity score",{"href":963,"dataGaName":951,"dataGaLocation":431},"/assessments/devops-modernization-assessment/",{"config":965},{"src":966},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":968,"categories":969,"header":970,"text":946,"button":971,"image":975},"security-modernization",[198],"Are you trading speed for security?",{"text":972,"config":973},"Get your security maturity score",{"href":974,"dataGaName":951,"dataGaLocation":431},"/assessments/security-modernization-assessment/",{"config":976},{"src":977},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":979,"paths":980,"header":983,"text":984,"button":985,"image":990},"github-azure-migration",[981,982],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":986,"config":987},"See how GitLab compares to GitHub",{"href":988,"dataGaName":989,"dataGaLocation":431},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":991},{"src":966},{"header":993,"blurb":994,"button":995,"secondaryButton":1000},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":996,"config":997},"Get your free trial",{"href":998,"dataGaName":230,"dataGaLocation":999},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":702,"config":1001},{"href":554,"dataGaName":235,"dataGaLocation":999},1786803770576]