[{"data":1,"prerenderedAt":1055},["ShallowReactive",2],{"/blog/masked-variable-vulnerability-in-runner-ver-13-9-0-rc1":3,"navigation-en-us":269,"banner-en-us":697,"footer-en-us":707,"blog-post-authors-en-us-Lee Matos":952,"blog-related-posts-en-us-masked-variable-vulnerability-in-runner-ver-13-9-0-rc1":967,"blog-promotions-en-us":992,"next-steps-en-us":1045},{"id":4,"title":5,"authors":6,"body":8,"category":250,"date":251,"description":252,"extension":253,"externalUrl":254,"faq":254,"featured":255,"heroImage":256,"meta":257,"navigation":258,"path":259,"seo":260,"slug":264,"stem":265,"tags":266,"template":267,"updatedDate":254,"__hash__":268},"blogPosts/en-us/blog/masked-variable-vulnerability-in-runner-ver-13-9-0-rc1.md","Masked variable vulnerability in Runner version 13.9.0-rc1",[7],"Lee Matos",{"type":9,"value":10,"toc":234},"minimark",[11,28,33,50,55,58,69,73,76,81,84,87,95,109,113,128,137,144,148,152,155,159,162,165,169,177,180,191,203,208,212,221,225],[12,13,14,15,21,22,27],"p",{},"We’re sharing details on a vulnerability that caused CI jobs containing ",[16,17,20],"a",{"href":18,"rel":19},"https://docs.gitlab.com/ci/variables/#mask-a-custom-variable",[],"masked CI variables"," to be revealed. We’re communicating here to ensure affected users are aware and take action as well as to uphold our ",[16,23,26],{"href":24,"rel":25},"https://handbook.gitlab.com/handbook/values/#transparency",[],"transparency value",".",[29,30,32],"h2",{"id":31},"am-i-affected","Am I affected?",[34,35,36,40,47],"ul",{},[37,38,39],"li",{},"If you have masked variables on Gitlab.com, you could be affected. These variables could be at either the project or group level.",[37,41,42,43],{},"If you ran a CI pipeline between February 11th 13:00 through Feb 16 01:16am UTC on GitLab.com shared runners that output masked variables,",[44,45,46],"strong",{},"you are affected.",[37,48,49],{},"If you are a self-managed customer who has deployed runner version 13.9.0-rc1, pipelines that are run by that runner which output masked variables are affected.",[51,52,54],"h3",{"id":53},"how-could-my-masked-variables-be-printed-in-the-build-logs","How could my masked variables be printed in the build logs?",[12,56,57],{},"Any mechanism that show the variable would have been done in an unmasked state while using runner version 13.9.0-rc1. Example commands include:",[34,59,60,63,66],{},[37,61,62],{},"echo $variable_name",[37,64,65],{},"echo $variable_name > variable.txt; cat variable.txt",[37,67,68],{},"some-command $masked_variable -> If this command outputs the parameters passed, it would have been unmasked.",[51,70,72],{"id":71},"if-i-am-affected-what-should-i-do","If I am affected, what should I do?",[12,74,75],{},"All users who may be affected by this should review their jobs for any printed variables and rotate any secrets contained in masked variables immediately.",[77,78,80],"h4",{"id":79},"gitlabcom-users","GitLab.com users",[12,82,83],{},"GitLab.com projects using shared runners between February 11th 13:00 until Feb 16 01:16am UTC and printed masked variables are affected by this regression and should rotate any secrets contained in masked variables immediately.",[12,85,86],{},"If you are using your own runner on gitlab.com, you should validate that you are not using runner version 13.9.0-rc1",[12,88,89],{},[90,91,92],"em",{},[44,93,94],{},"Please note:",[34,96,97,100,103,106],{},[37,98,99],{},"Project visibility settings were not affected. If your project or project’s pipelines section was private, the masked variables would only be visible to members of your project with access to CI pipelines.",[37,101,102],{},"If your jobs ran on a self-managed (not shared) runner using any version aside from 13.9.0-rc1, you should not be affected by this regression.",[37,104,105],{},"If your jobs did not print any masked variables during this time, you should not be affected by this regression.",[37,107,108],{},"In any of these cases, you may choose to use this opportunity to rotate your secrets out of caution, or as part of your regular security hygiene.",[77,110,112],{"id":111},"self-managed-users","Self-managed users",[12,114,115,116,121,122,127],{},"If you are using 13.9.0-rc1, please upgrade to ",[16,117,120],{"href":118,"rel":119},"https://gitlab.com/gitlab-org/gitlab-runner/-/releases/v13.9.0-rc2",[],"v13.9.0-rc2"," or downgrade to ",[16,123,126],{"href":124,"rel":125},"https://gitlab.com/gitlab-org/gitlab-runner/-/releases/v13.8.0",[],"13.8.0"," as soon as possible. You only need to upgrade to v13.9.0-rc2 if you are using 13.9.0rc1 and want to continue using the latest release candidate at your own risk.",[12,129,130,132,133,136],{},[90,131,94],{}," The latest stable version v13.8.0 of GitLab Runner ",[44,134,135],{},"does not have"," this vulnerability so you do not need to upgrade to 13.9.0-rc2 if you are using 13.8.0.",[12,138,139,140,27],{},"For additional information and guidance on how to secure your GitLab instance, you can review the blog post ",[16,141,143],{"href":142},"/blog/gitlab-instance-security-best-practices/","\"GitLab instance: security best practices\"",[29,145,147],{"id":146},"some-background-on-this-vulnerability","Some background on this vulnerability",[29,149,151],{"id":150},"what-does-rc1-mean","What does rc1 mean?",[12,153,154],{},"As part of our release process, runner release candidates (RC) are constantly deployed to and monitored within GitLab.com infrastructure. We roll out code in a scaled process, starting with our internal private runner managers, then move to the remainder of the shared runner fleet – allowing for a day in between deployments. Self-managed users can elect to use the latest RCs if they want to get code changes as fast as possible or test the latest code for regressions in their environments.",[51,156,158],{"id":157},"details-about-our-deployment-timeline","Details about our deployment timeline",[12,160,161],{},"On February 11th 13:00 until Feb 16 01:16am UTC, GitLab deployed version 13.9.0-rc1 of GitLab Runner on GitLab.com’s Shared Runners fleet.",[12,163,164],{},"Self-managed customers who are testing latest release candidates may have deployed 13.9.0-rc1 during that timeframe and should update immediately to either runner version 13.8.0 (latest stable) or 13.9.0-rc2 (latest release candidate). We have removed runner version 13.9.0-rc1 from distribution.",[51,166,168],{"id":167},"actions-gitlab-has-taken","Actions GitLab has taken",[12,170,171,172,176],{},"We learned of the regression on Feb 15, and deployed a ",[16,173,175],{"href":118,"rel":174},[],"new version of runners v13.9.0-rc2"," across the Shared Runners fleet to mitigate the issue.",[12,178,179],{},"We have contacted GitLab.com project owners who may be affected by this regression directly via email between Feb 16-18 with information on the regression and the instructions to rotate tokens. We are also sharing that information here. The emails were titled:",[34,181,182,185,188],{},[37,183,184],{},"Security Alert: Your public GitLab.com project needs your attention",[37,186,187],{},"Security Alert: Your private GitLab.com project needs your attention",[37,189,190],{},"Security Alert: Masked group variable vulnerability in Runner version 13.9.0-rc1",[12,192,193,194,197,198,202],{},"For self-managed users, we sent out a security alert email to all members of our security alerts mailing list. This email was titled ",[90,195,196],{},"\"Security Alert: Runner version 13.9.0-rc1 has a masked variable vulnerability\"."," The same information is shared in this blog post. You can ",[16,199,201],{"href":200},"/company/contact/","subscribe to our security alerts"," to receive similar alerts, as well as notices of when regular and critical security releases are published.",[204,205,207],"h1",{"id":206},"what-to-do-if-you-have-questions","What to do if you have questions",[29,209,211],{"id":210},"for-gitlabcom-customers","For GitLab.com customers",[12,213,214,215,220],{},"For GitLab.com customers with questions on how to determine if you are affected, please ",[16,216,219],{"href":217,"rel":218},"https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=334447",[],"open a GitLab.com support ticket"," so a support engineer can help you.",[29,222,224],{"id":223},"for-self-managed-customers","For self-managed customers",[12,226,227,228,233],{},"If you are a self-managed customer that used runner version 13.9.0-rc1 and have questions on how to determine the scope of impact, you can ",[16,229,232],{"href":230,"rel":231},"https://support.gitlab.com/hc/en-us/requests/new?ticket_form_id=426148",[],"open a self-managed support ticket"," and a support engineer can help you investigate in your specific environment.",{"title":235,"searchDepth":236,"depth":236,"links":237},"",2,[238,243,244,248,249],{"id":31,"depth":236,"text":32,"children":239},[240,242],{"id":53,"depth":241,"text":54},3,{"id":71,"depth":241,"text":72},{"id":146,"depth":236,"text":147},{"id":150,"depth":236,"text":151,"children":245},[246,247],{"id":157,"depth":241,"text":158},{"id":167,"depth":241,"text":168},{"id":210,"depth":236,"text":211},{"id":223,"depth":236,"text":224},"security","2021-02-18","How we responded to a masked variable vulnerability in GitLab Runner version 13.9.0-rc1 and actions users should take.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749666816/Blog/Hero%20Images/security-cover.png",{},true,"/en-us/blog/masked-variable-vulnerability-in-runner-ver-13-9-0-rc1",{"title":5,"description":252,"ogTitle":5,"ogDescription":252,"noIndex":255,"ogImage":256,"ogUrl":261,"ogSiteName":262,"ogType":263,"canonicalUrls":261},"https://about.gitlab.com/blog/masked-variable-vulnerability-in-runner-ver-13-9-0-rc1","https://about.gitlab.com","article","masked-variable-vulnerability-in-runner-ver-13-9-0-rc1","en-us/blog/masked-variable-vulnerability-in-runner-ver-13-9-0-rc1",[250],"BlogPost","vlKtcOqXpe5Jwu4hvPS3XmNYlEZyk9irJt0EvYCRF5U",{"logo":270,"freeTrial":275,"sales":280,"login":285,"items":290,"search":617,"minimal":648,"duo":667,"switchNav":676,"pricingDeployment":687},{"config":271},{"href":272,"dataGaName":273,"dataGaLocation":274},"/","gitlab logo","header",{"text":276,"config":277},"Get free trial",{"href":278,"dataGaName":279,"dataGaLocation":274},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":281,"config":282},"Request a demo",{"href":283,"dataGaName":284,"dataGaLocation":274},"/sales/?contact-topic=request-demo","sales",{"text":286,"config":287},"Sign in",{"href":288,"dataGaName":289,"dataGaLocation":274},"https://gitlab.com/users/sign_in/","sign in",[291,320,420,425,539,595],{"text":292,"config":293,"menu":295},"Platform",{"dataNavLevelOne":294},"platform",{"type":296,"columns":297},"cards",[298,304,312],{"title":292,"description":299,"link":300},"The intelligent orchestration platform for DevSecOps",{"text":301,"config":302},"Explore our Platform",{"href":303,"dataGaName":294,"dataGaLocation":274},"/platform/",{"title":305,"description":306,"link":307},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":308,"config":309},"Meet GitLab Duo",{"href":310,"dataGaName":311,"dataGaLocation":274},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":313,"description":314,"link":315},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":316,"config":317},"Learn more",{"href":318,"dataGaName":319,"dataGaLocation":274},"/why-gitlab/","why gitlab",{"text":321,"left":258,"config":322,"menu":324},"Product",{"dataNavLevelOne":323},"solutions",{"type":325,"link":326,"columns":330,"feature":399},"lists",{"text":327,"config":328},"View all Solutions",{"href":329,"dataGaName":323,"dataGaLocation":274},"/solutions/",[331,355,378],{"title":332,"description":333,"link":334,"items":339},"Automation","CI/CD and automation to accelerate deployment",{"config":335},{"icon":336,"href":337,"dataGaName":338,"dataGaLocation":274},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[340,344,347,351],{"text":341,"config":342},"CI/CD",{"href":343,"dataGaLocation":274,"dataGaName":341},"/solutions/continuous-integration/",{"text":305,"config":345},{"href":310,"dataGaLocation":274,"dataGaName":346},"gitlab duo agent platform - product menu",{"text":348,"config":349},"Source Code Management",{"href":350,"dataGaLocation":274,"dataGaName":348},"/solutions/source-code-management/",{"text":352,"config":353},"Automated Software Delivery",{"href":337,"dataGaLocation":274,"dataGaName":354},"Automated software delivery",{"title":356,"description":357,"link":358,"items":363},"Security","Deliver code faster without compromising security",{"config":359},{"href":360,"dataGaName":361,"dataGaLocation":274,"icon":362},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[364,368,373],{"text":365,"config":366},"Application Security Testing",{"href":360,"dataGaName":367,"dataGaLocation":274},"Application security testing",{"text":369,"config":370},"Software Supply Chain Security",{"href":371,"dataGaLocation":274,"dataGaName":372},"/solutions/supply-chain/","Software supply chain security",{"text":374,"config":375},"Software Compliance",{"href":376,"dataGaName":377,"dataGaLocation":274},"/solutions/software-compliance/","software compliance",{"title":379,"link":380,"items":385},"Measurement",{"config":381},{"icon":382,"href":383,"dataGaName":384,"dataGaLocation":274},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[386,390,394],{"text":387,"config":388},"Visibility & Measurement",{"href":383,"dataGaLocation":274,"dataGaName":389},"Visibility and Measurement",{"text":391,"config":392},"Value Stream Management",{"href":393,"dataGaLocation":274,"dataGaName":391},"/solutions/value-stream-management/",{"text":395,"config":396},"Analytics & Insights",{"href":397,"dataGaLocation":274,"dataGaName":398},"/solutions/analytics-and-insights/","Analytics and insights",{"title":400,"type":325,"items":401},"GitLab for",[402,408,414],{"text":403,"config":404},"Enterprise",{"icon":405,"href":406,"dataGaLocation":274,"dataGaName":407},"Building","/enterprise/","enterprise",{"text":409,"config":410},"Small Business",{"icon":411,"href":412,"dataGaLocation":274,"dataGaName":413},"Work","/small-business/","small business",{"text":415,"config":416},"Public Sector",{"icon":417,"href":418,"dataGaLocation":274,"dataGaName":419},"Organization","/solutions/public-sector/","public sector",{"text":421,"config":422},"Pricing",{"href":423,"dataGaName":424,"dataGaLocation":274,"dataNavLevelOne":424},"/pricing/","pricing",{"text":426,"config":427,"menu":429},"Resources",{"dataNavLevelOne":428},"resources",{"type":325,"link":430,"columns":434,"feature":528},{"text":431,"config":432},"View all resources",{"href":433,"dataGaName":428,"dataGaLocation":274},"/resources/",[435,468,495],{"title":436,"items":437},"Getting started",[438,443,448,453,458,463],{"text":439,"config":440},"Install",{"href":441,"dataGaName":442,"dataGaLocation":274},"/install/","install",{"text":444,"config":445},"Quick start guides",{"href":446,"dataGaName":447,"dataGaLocation":274},"/get-started/","quick setup checklists",{"text":449,"config":450},"Learn",{"href":451,"dataGaLocation":274,"dataGaName":452},"https://university.gitlab.com/","learn",{"text":454,"config":455},"Product documentation",{"href":456,"dataGaName":457,"dataGaLocation":274},"https://docs.gitlab.com/","product documentation",{"text":459,"config":460},"Best practice videos",{"href":461,"dataGaName":462,"dataGaLocation":274},"/getting-started-videos/","best practice videos",{"text":464,"config":465},"Integrations",{"href":466,"dataGaName":467,"dataGaLocation":274},"/integrations/","integrations",{"title":469,"items":470},"Discover",[471,476,481,486,490],{"text":472,"config":473},"Customer success stories",{"href":474,"dataGaName":475,"dataGaLocation":274},"/customers/","customer success stories",{"text":477,"config":478},"Blog",{"href":479,"dataGaName":480,"dataGaLocation":274},"/blog/","blog",{"text":482,"config":483},"Demo Hub",{"href":484,"dataGaName":485,"dataGaLocation":274},"/demo-hub/","demo hub",{"text":487,"config":488},"The Source",{"href":489,"dataGaName":480,"dataGaLocation":274},"/the-source/",{"text":491,"config":492},"Remote",{"href":493,"dataGaName":494,"dataGaLocation":274},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":496,"items":497},"Connect",[498,503,508,513,518,523],{"text":499,"config":500},"GitLab Services",{"href":501,"dataGaName":502,"dataGaLocation":274},"/services/","services",{"text":504,"config":505},"Contribute",{"href":506,"dataGaName":507,"dataGaLocation":274},"https://contributors.gitlab.com","contribute",{"text":509,"config":510},"Community",{"href":511,"dataGaName":512,"dataGaLocation":274},"/community/","community",{"text":514,"config":515},"Forum",{"href":516,"dataGaName":517,"dataGaLocation":274},"https://forum.gitlab.com/","forum",{"text":519,"config":520},"Events",{"href":521,"dataGaName":522,"dataGaLocation":274},"/events/","events",{"text":524,"config":525},"Partners",{"href":526,"dataGaName":527,"dataGaLocation":274},"/partners/","partners",{"config":529,"title":532,"text":533,"link":534},{"background":530,"textColor":531},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":535,"config":536},"Read the latest",{"href":537,"dataGaName":538,"dataGaLocation":274},"/whats-new/","whats new",{"text":540,"config":541,"menu":543},"Company",{"dataNavLevelOne":542},"company",{"type":325,"columns":544},[545],{"items":546},[547,552,558,560,565,570,575,580,585,590],{"text":548,"config":549},"About",{"href":550,"dataGaName":551,"dataGaLocation":274},"/company/","about",{"text":553,"config":554,"footerGa":557},"Jobs",{"href":555,"dataGaName":556,"dataGaLocation":274},"/jobs/","jobs",{"dataGaName":556},{"text":519,"config":559},{"href":521,"dataGaName":522,"dataGaLocation":274},{"text":561,"config":562},"Leadership",{"href":563,"dataGaName":564,"dataGaLocation":274},"/company/team/e-group/","leadership",{"text":566,"config":567},"Handbook",{"href":568,"dataGaName":569,"dataGaLocation":274},"https://handbook.gitlab.com/","handbook",{"text":571,"config":572},"Investor relations",{"href":573,"dataGaName":574,"dataGaLocation":274},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":576,"config":577},"Trust Center",{"href":578,"dataGaName":579,"dataGaLocation":274},"/security/","trust center",{"text":581,"config":582},"AI Transparency Center",{"href":583,"dataGaName":584,"dataGaLocation":274},"/ai-transparency-center/","ai transparency center",{"text":586,"config":587},"Newsletter",{"href":588,"dataGaName":589,"dataGaLocation":274},"/company/contact/#contact-forms","newsletter",{"text":591,"config":592},"Press",{"href":593,"dataGaName":594,"dataGaLocation":274},"/press/","press",{"text":596,"config":597,"menu":598},"Contact us",{"dataNavLevelOne":542},{"type":325,"columns":599},[600],{"items":601},[602,607,612],{"text":603,"config":604},"Talk to sales",{"href":605,"dataGaName":606,"dataGaLocation":274},"/sales/","talk to sales",{"text":608,"config":609},"Support portal",{"href":610,"dataGaName":611,"dataGaLocation":274},"https://support.gitlab.com/hc/en-us","support portal",{"text":613,"config":614},"Customer portal",{"href":615,"dataGaName":616,"dataGaLocation":274},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":618,"login":619,"suggestions":626},"Close",{"text":620,"link":621},"To search repositories and projects, login to",{"text":622,"config":623},"gitlab.com",{"href":288,"dataGaName":624,"dataGaLocation":625},"search login","search",{"text":627,"default":628},"Suggestions",[629,631,635,637,641,645],{"text":305,"config":630},{"href":310,"dataGaName":305,"dataGaLocation":625},{"text":632,"config":633},"Code Suggestions (AI)",{"href":634,"dataGaName":632,"dataGaLocation":625},"/solutions/code-suggestions/",{"text":341,"config":636},{"href":343,"dataGaName":341,"dataGaLocation":625},{"text":638,"config":639},"GitLab on AWS",{"href":640,"dataGaName":638,"dataGaLocation":625},"/partners/technology-partners/aws/",{"text":642,"config":643},"GitLab on Google Cloud",{"href":644,"dataGaName":642,"dataGaLocation":625},"/partners/technology-partners/google-cloud-platform/",{"text":646,"config":647},"Why GitLab?",{"href":318,"dataGaName":646,"dataGaLocation":625},{"freeTrial":649,"mobileIcon":654,"desktopIcon":659,"secondaryButton":662},{"text":650,"config":651},"Start free trial",{"href":652,"dataGaName":279,"dataGaLocation":653},"https://gitlab.com/-/trials/new/","nav",{"altText":655,"config":656},"Gitlab Icon",{"src":657,"dataGaName":658,"dataGaLocation":653},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":655,"config":660},{"src":661,"dataGaName":658,"dataGaLocation":653},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":663,"config":664},"Get Started",{"href":665,"dataGaName":666,"dataGaLocation":653},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":668,"mobileIcon":672,"desktopIcon":674},{"text":669,"config":670},"Learn more about GitLab Duo",{"href":310,"dataGaName":671,"dataGaLocation":653},"gitlab duo",{"altText":655,"config":673},{"src":657,"dataGaName":658,"dataGaLocation":653},{"altText":655,"config":675},{"src":661,"dataGaName":658,"dataGaLocation":653},{"button":677,"mobileIcon":682,"desktopIcon":684},{"text":678,"config":679},"/switch",{"href":680,"dataGaName":681,"dataGaLocation":653},"#contact","switch",{"altText":655,"config":683},{"src":657,"dataGaName":658,"dataGaLocation":653},{"altText":655,"config":685},{"src":686,"dataGaName":658,"dataGaLocation":653},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":688,"mobileIcon":693,"desktopIcon":695},{"text":689,"config":690},"Back to pricing",{"href":423,"dataGaName":691,"dataGaLocation":653,"icon":692},"back to pricing","GoBack",{"altText":655,"config":694},{"src":657,"dataGaName":658,"dataGaLocation":653},{"altText":655,"config":696},{"src":661,"dataGaName":658,"dataGaLocation":653},{"title":698,"titleMobile":699,"button":700,"config":705},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":316,"config":701},{"href":702,"dataGaName":703,"dataGaLocation":704},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":706,"disabled":255},"release",{"data":708},{"text":709,"source":710,"edit":716,"contribute":721,"config":726,"items":731,"minimal":941},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":711,"config":712},"View page source",{"href":713,"dataGaName":714,"dataGaLocation":715},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":717,"config":718},"Edit this page",{"href":719,"dataGaName":720,"dataGaLocation":715},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":722,"config":723},"Please contribute",{"href":724,"dataGaName":725,"dataGaLocation":715},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":727,"facebook":728,"youtube":729,"linkedin":730},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[732,779,833,877,909],{"title":421,"links":733,"subMenu":748},[734,738,743],{"text":735,"config":736},"View plans",{"href":423,"dataGaName":737,"dataGaLocation":715},"view plans",{"text":739,"config":740},"Why Premium?",{"href":741,"dataGaName":742,"dataGaLocation":715},"/pricing/premium/","why premium",{"text":744,"config":745},"Why Ultimate?",{"href":746,"dataGaName":747,"dataGaLocation":715},"/pricing/ultimate/","why ultimate",[749],{"title":750,"links":751},"Contact Us",[752,755,757,759,764,769,774],{"text":753,"config":754},"Contact sales",{"href":605,"dataGaName":284,"dataGaLocation":715},{"text":608,"config":756},{"href":610,"dataGaName":611,"dataGaLocation":715},{"text":613,"config":758},{"href":615,"dataGaName":616,"dataGaLocation":715},{"text":760,"config":761},"Status",{"href":762,"dataGaName":763,"dataGaLocation":715},"https://status.gitlab.com/","status",{"text":765,"config":766},"Terms of use",{"href":767,"dataGaName":768,"dataGaLocation":715},"/terms/","terms of use",{"text":770,"config":771},"Privacy statement",{"href":772,"dataGaName":773,"dataGaLocation":715},"/privacy/","privacy statement",{"text":775,"config":776},"Cookie preferences",{"dataGaName":777,"dataGaLocation":715,"id":778,"isOneTrustButton":258},"cookie preferences","ot-sdk-btn",{"title":321,"links":780,"subMenu":789},[781,785],{"text":782,"config":783},"DevSecOps platform",{"href":303,"dataGaName":784,"dataGaLocation":715},"devsecops platform",{"text":786,"config":787},"AI-Assisted Development",{"href":310,"dataGaName":788,"dataGaLocation":715},"ai-assisted development",[790],{"title":791,"links":792},"Topics",[793,798,803,808,813,818,823,828],{"text":794,"config":795},"CICD",{"href":796,"dataGaName":797,"dataGaLocation":715},"/topics/ci-cd/","cicd",{"text":799,"config":800},"GitOps",{"href":801,"dataGaName":802,"dataGaLocation":715},"/topics/gitops/","gitops",{"text":804,"config":805},"DevOps",{"href":806,"dataGaName":807,"dataGaLocation":715},"/topics/devops/","devops",{"text":809,"config":810},"Version Control",{"href":811,"dataGaName":812,"dataGaLocation":715},"/topics/version-control/","version control",{"text":814,"config":815},"DevSecOps",{"href":816,"dataGaName":817,"dataGaLocation":715},"/topics/devsecops/","devsecops",{"text":819,"config":820},"Cloud Native",{"href":821,"dataGaName":822,"dataGaLocation":715},"/topics/cloud-native/","cloud native",{"text":824,"config":825},"AI for Coding",{"href":826,"dataGaName":827,"dataGaLocation":715},"/topics/devops/ai-for-coding/","ai for coding",{"text":829,"config":830},"Agentic AI",{"href":831,"dataGaName":832,"dataGaLocation":715},"/topics/agentic-ai/","agentic ai",{"title":834,"links":835},"Solutions",[836,838,840,845,849,852,856,859,861,864,867,872],{"text":365,"config":837},{"href":360,"dataGaName":365,"dataGaLocation":715},{"text":354,"config":839},{"href":337,"dataGaName":338,"dataGaLocation":715},{"text":841,"config":842},"Agile development",{"href":843,"dataGaName":844,"dataGaLocation":715},"/solutions/agile-delivery/","agile delivery",{"text":846,"config":847},"SCM",{"href":350,"dataGaName":848,"dataGaLocation":715},"source code management",{"text":794,"config":850},{"href":343,"dataGaName":851,"dataGaLocation":715},"continuous integration & delivery",{"text":853,"config":854},"Value stream management",{"href":393,"dataGaName":855,"dataGaLocation":715},"value stream management",{"text":799,"config":857},{"href":858,"dataGaName":802,"dataGaLocation":715},"/solutions/gitops/",{"text":403,"config":860},{"href":406,"dataGaName":407,"dataGaLocation":715},{"text":862,"config":863},"Small business",{"href":412,"dataGaName":413,"dataGaLocation":715},{"text":865,"config":866},"Public sector",{"href":418,"dataGaName":419,"dataGaLocation":715},{"text":868,"config":869},"Education",{"href":870,"dataGaName":871,"dataGaLocation":715},"/solutions/education/","education",{"text":873,"config":874},"Financial services",{"href":875,"dataGaName":876,"dataGaLocation":715},"/solutions/finance/","financial services",{"title":426,"links":878},[879,881,883,885,888,890,893,895,897,899,901,903,905,907],{"text":439,"config":880},{"href":441,"dataGaName":442,"dataGaLocation":715},{"text":444,"config":882},{"href":446,"dataGaName":447,"dataGaLocation":715},{"text":449,"config":884},{"href":451,"dataGaName":452,"dataGaLocation":715},{"text":454,"config":886},{"href":456,"dataGaName":887,"dataGaLocation":715},"docs",{"text":477,"config":889},{"href":479,"dataGaName":480,"dataGaLocation":715},{"text":891,"config":892},"What's new",{"href":537,"dataGaName":538,"dataGaLocation":715},{"text":472,"config":894},{"href":474,"dataGaName":475,"dataGaLocation":715},{"text":491,"config":896},{"href":493,"dataGaName":494,"dataGaLocation":715},{"text":499,"config":898},{"href":501,"dataGaName":502,"dataGaLocation":715},{"text":504,"config":900},{"href":506,"dataGaName":507,"dataGaLocation":715},{"text":509,"config":902},{"href":511,"dataGaName":512,"dataGaLocation":715},{"text":514,"config":904},{"href":516,"dataGaName":517,"dataGaLocation":715},{"text":519,"config":906},{"href":521,"dataGaName":522,"dataGaLocation":715},{"text":524,"config":908},{"href":526,"dataGaName":527,"dataGaLocation":715},{"title":540,"links":910},[911,913,915,917,919,921,925,930,932,934,936],{"text":548,"config":912},{"href":550,"dataGaName":542,"dataGaLocation":715},{"text":553,"config":914},{"href":555,"dataGaName":556,"dataGaLocation":715},{"text":561,"config":916},{"href":563,"dataGaName":564,"dataGaLocation":715},{"text":566,"config":918},{"href":568,"dataGaName":569,"dataGaLocation":715},{"text":571,"config":920},{"href":573,"dataGaName":574,"dataGaLocation":715},{"text":922,"config":923},"Sustainability",{"href":924,"dataGaName":922,"dataGaLocation":715},"/sustainability/",{"text":926,"config":927},"Diversity, inclusion and belonging (DIB)",{"href":928,"dataGaName":929,"dataGaLocation":715},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":576,"config":931},{"href":578,"dataGaName":579,"dataGaLocation":715},{"text":586,"config":933},{"href":588,"dataGaName":589,"dataGaLocation":715},{"text":591,"config":935},{"href":593,"dataGaName":594,"dataGaLocation":715},{"text":937,"config":938},"Modern Slavery Transparency Statement",{"href":939,"dataGaName":940,"dataGaLocation":715},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":942},[943,946,949],{"text":944,"config":945},"Terms",{"href":767,"dataGaName":768,"dataGaLocation":715},{"text":947,"config":948},"Cookies",{"dataGaName":777,"dataGaLocation":715,"id":778,"isOneTrustButton":258},{"text":950,"config":951},"Privacy",{"href":772,"dataGaName":773,"dataGaLocation":715},[953],{"id":954,"title":7,"body":254,"config":955,"content":957,"description":254,"extension":961,"meta":962,"navigation":258,"path":963,"seo":964,"stem":965,"__hash__":966},"blogAuthors/en-us/blog/authors/lee-matos.yml",{"template":956},"BlogAuthor",{"name":7,"config":958},{"headshot":959,"ctfId":960},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749670430/Blog/Author%20Headshots/lbot-headshot.jpg","lbot","yml",{},"/en-us/blog/authors/lee-matos",{},"en-us/blog/authors/lee-matos","pr5sqICzd0jbCWXsR8dQVKu1l-sqXaCQ3w0uTPizr54",[968,976,984],{"title":969,"description":970,"heroImage":971,"category":250,"date":972,"authors":973,"slug":975,"externalUrl":254},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[974],"Julian Thome","improved-scope-offset-fingerprinting",{"title":977,"description":978,"heroImage":971,"category":250,"date":979,"authors":980,"slug":983,"externalUrl":254},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[981,982],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":985,"description":986,"heroImage":987,"category":250,"date":988,"authors":989,"slug":991,"externalUrl":254},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[990],"Alisa Ho","claude-security-and-gitlab",{"promotions":993},[994,1008,1020,1031],{"id":995,"categories":996,"header":998,"text":999,"button":1000,"image":1005},"ai-modernization",[997],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1001,"config":1002},"Get your AI maturity score",{"href":1003,"dataGaName":1004,"dataGaLocation":480},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1006},{"src":1007},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1009,"categories":1010,"header":1012,"text":999,"button":1013,"image":1017},"devops-modernization",[1011,817],"product","Are you just managing tools or shipping innovation?",{"text":1014,"config":1015},"Get your DevOps maturity score",{"href":1016,"dataGaName":1004,"dataGaLocation":480},"/assessments/devops-modernization-assessment/",{"config":1018},{"src":1019},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1021,"categories":1022,"header":1023,"text":999,"button":1024,"image":1028},"security-modernization",[250],"Are you trading speed for security?",{"text":1025,"config":1026},"Get your security maturity score",{"href":1027,"dataGaName":1004,"dataGaLocation":480},"/assessments/security-modernization-assessment/",{"config":1029},{"src":1030},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1032,"paths":1033,"header":1036,"text":1037,"button":1038,"image":1043},"github-azure-migration",[1034,1035],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1039,"config":1040},"See how GitLab compares to GitHub",{"href":1041,"dataGaName":1042,"dataGaLocation":480},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1044},{"src":1019},{"header":1046,"blurb":1047,"button":1048,"secondaryButton":1053},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1049,"config":1050},"Get your free trial",{"href":1051,"dataGaName":279,"dataGaLocation":1052},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":753,"config":1054},{"href":605,"dataGaName":284,"dataGaLocation":1052},1786803753112]