[{"data":1,"prerenderedAt":957},["ShallowReactive",2],{"/blog/secure-pipeline-with-single-sign-in":3,"navigation-en-us":172,"banner-en-us":600,"footer-en-us":610,"blog-post-authors-en-us-Eddie Glenn":855,"blog-related-posts-en-us-secure-pipeline-with-single-sign-in":869,"blog-promotions-en-us":894,"next-steps-en-us":947},{"id":4,"title":5,"authors":6,"body":8,"category":153,"date":154,"description":155,"extension":156,"externalUrl":157,"faq":157,"featured":158,"heroImage":159,"meta":160,"navigation":161,"path":162,"seo":163,"slug":167,"stem":168,"tags":169,"template":170,"updatedDate":157,"__hash__":171},"blogPosts/en-us/blog/secure-pipeline-with-single-sign-in.md","How to secure your software build pipeline using code signing",[7],"Eddie Glenn",{"type":9,"value":10,"toc":139},"minimark",[11,15,18,21,31,34,42,45,48,53,56,59,62,67,70,74,77,80,83,86,90,93,97,100,104,119,123,126],[12,13,14],"p",{},"If there is one thing that recent cyberattacks at companies such as SolarWinds, Codecov, and Kaseya have taught us, it's that software build pipelines are being targeted for attacks more than ever before. Hackers are no longer just attacking the bits and bytes of source code that go into our products, but also the development, testing, and build infrastructure tools that are used to build these products.",[12,16,17],{},"Even if you believe your company is at low risk of an attack, it's also important to think about your customers. Businesses with high profile customers – like government agencies or large, multinational corporations that use your products – might have attackers target them by hacking your company, or more specifically, the software you provide them.",[12,19,20],{},"The incidents at Solarwinds, Codecov, and Kaseya show that traditional approaches to security are often failing to prevent attacks. Instead of targeting the software that these companies used, attackers targeted software developed by these companies. Hackers may be targeting the source code you write, the open source code your team uses, and the development tools that you rely on. This is why companies like Venafi and GitLab are partnering to make it easier for developers to prevent attacks and make software supply chains more secure.",[12,22,23,24,30],{},"At ",[25,26,29],"a",{"href":27,"rel":28},"https://www.venafi.com/",[],"Venafi",", we believe that a new approach is necessary to secure the software supply chain, especially in the development stage. We also believe it is imperative that engineers incorporate more security controls in the development, build, test, and delivery pipelines.",[12,32,33],{},"No single security measure can prevent future attacks. Instead, engineers must adopt multiple software development measures, including a change in mindset about the security of the development infrastructure and who has the ultimate responsibility. Any lasting solution requires collaboration between industry leaders in software development, software security, and application provisioning, but successful collaboration must be led from an engineering-first perspective.",[12,35,36,41],{},[37,38],"img",{"alt":39,"src":40},"How Venafi secures software build pipelines with code signing","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782399273/blog/Content%20Images/venafi_image.jpg","\nSecure modern software build pipelines with code signing.",[12,43,44],{},"One effective approach software teams can take is to 'sign early, sign often' on all artifacts used by the software build process. A digital signature is an electronic signature that is used to authenticate the identity of the individual or organization that signed a file (for example a program, a document, etc). The digital signature will also make sure that the original content of the file has not been changed. While most people think of digitally signing (code signing) program executables (because operating systems often require it), digital signatures can be applied to any intermediate artifact like source code, build scripts, recipes, deployment containers, and third-party tools used by the development team.",[12,46,47],{},"Code signing uses cryptographic hashing that can validate the authenticity of software and ensure the integrity of code by verifying it has not been tampered with since being published. Code signing plays an important role in verifying the integrity of software used or distributed by organizations and individuals.",[49,50,52],"h2",{"id":51},"why-sign-early-often","Why sign early & often?",[12,54,55],{},"Even if you've checked in a piece of source code to your repository, anyone else could alter that source code later – perhaps even someone pretending to be you. But if the source code was digitally signed, then a malicious actor could not introduce a change without also obtaining the digital code signing key used.",[12,57,58],{},"Another scenario to consider is if a development team member downloads the latest version of a third-party app but doesn't run it through your security team's protocols first. If the app contains malware, then your build system was just infected. By ensuring that only authorized versions of tools, libraries, and source code (which have passed security checks) are digitally signed by your company, sources of malware can be minimized.",[12,60,61],{},"Now consider automated build infrastructure, such as GitLab. If your pipeline doesn't require digital signatures of all artifacts used to build your products, then anyone could slip in a malicious change that is incorporated automatically, producing a malware-infected executable that could be delivered to your customers.",[63,64,66],"h3",{"id":65},"its-convenient-for-developers","It's convenient for developers",[12,68,69],{},"It's easy enough to say 'sign early & often'. But, why aren't more development teams doing it? It's actually pretty simple to invoke a command line code signing tool such as 'jarsigner' or 'signtool'.",[63,71,73],{"id":72},"the-devil-is-in-the-details","The devil is in the details",[12,75,76],{},"Managing PKI, managing code signing certificates, and configuring encryption keys is complicated. Code signing done incorrectly is simply not effective. Also, most code signing tools require easy access to the encryption private key, ending up on the build server or a developer's laptop. Here, hackers have easy access to misuse them.",[12,78,79],{},"The code signing process must also be convenient for developers. One way to make things easy on developers is to integrate code signing tools with the technology they use every day, like GitLab. We've found that if code signing technology is difficult, inconvenient, or in any way slows down a build pipeline, developers will avoid it.",[12,81,82],{},"Finally, if code signing is to be used as a security measure, your company's security teams need visibility into the process and the ability to define security policies.",[12,84,85],{},"Venafi and GitLab partnered together to make it easy for developers to sign source code and other artifacts, all from within your GitLab environment.",[49,87,89],{"id":88},"about-venafi-codesign-protect","About Venafi CodeSign Protect",[12,91,92],{},"Venafi CodeSign Protect is a unique solution that focuses on both the needs of software development teams as well as security teams. Venafi is integrated within the GitLab environment so developers can easily sign their source code and other build artifacts without needing to know anything about PKI, code signing certificates, or code signing keys.",[63,94,96],{"id":95},"its-time-to-shift-left","It's time to shift left",[12,98,99],{},"'Shift-left' type of attacks are the new generation of cyberattacks. Today, hackers are sophisticated software developers that target build infrastructure. This is why it is essential that engineering teams take action using security measures like code signing.",[49,101,103],{"id":102},"whats-next","What's next?",[12,105,106,107,112,113,118],{},"Venafi and GitLab can help you avoid these costly incidents. Start by reading this brief to learn more about ",[25,108,111],{"href":109,"rel":110},"https://www.venafi.com/resource/Codesigning-CI-CD-pipelines",[],"Securing Code Signing in CI/CD Pipelines",". Then visit the Venafi Marketplace to download ",[25,114,117],{"href":115,"rel":116},"https://marketplace.venafi.com/apps/?query=Gitlab",[],"Venafi and Gitlab Plugins",", all ready for deployment.",[49,120,122],{"id":121},"watch-the-demo","Watch the demo",[12,124,125],{},"More of a video person? Watch the demo on how to implement code signing using GitLab and Venafi.",[127,128,131,132],"figure",{"className":129},[130],"video_container","\n  ",[133,134,138],"iframe",{"src":135,"frameBorder":136,"allowFullScreen":137},"https://www.youtube.com/embed/F2IonOX2rOo","0","true"," ",{"title":140,"searchDepth":141,"depth":141,"links":142},"",2,[143,148,151,152],{"id":51,"depth":141,"text":52,"children":144},[145,147],{"id":65,"depth":146,"text":66},3,{"id":72,"depth":146,"text":73},{"id":88,"depth":141,"text":89,"children":149},[150],{"id":95,"depth":146,"text":96},{"id":102,"depth":141,"text":103},{"id":121,"depth":141,"text":122},"security","2021-08-30","The Venafi plugin for GitLab enables single sign-on and digital signatures to better secure your app.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749682125/Blog/Hero%20Images/venafi_coverimage.jpg",{},true,"/en-us/blog/secure-pipeline-with-single-sign-in",{"title":5,"description":155,"ogTitle":5,"ogDescription":155,"noIndex":158,"ogImage":159,"ogUrl":164,"ogSiteName":165,"ogType":166,"canonicalUrls":164},"https://about.gitlab.com/blog/secure-pipeline-with-single-sign-in","https://about.gitlab.com","article","secure-pipeline-with-single-sign-in","en-us/blog/secure-pipeline-with-single-sign-in",[153],"BlogPost","BYHSn0ha0bPDBOWx6xBdxbG0HRIOYjgGu11anam4RYo",{"logo":173,"freeTrial":178,"sales":183,"login":188,"items":193,"search":520,"minimal":551,"duo":570,"switchNav":579,"pricingDeployment":590},{"config":174},{"href":175,"dataGaName":176,"dataGaLocation":177},"/","gitlab logo","header",{"text":179,"config":180},"Get free trial",{"href":181,"dataGaName":182,"dataGaLocation":177},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":184,"config":185},"Request a demo",{"href":186,"dataGaName":187,"dataGaLocation":177},"/sales/?contact-topic=request-demo","sales",{"text":189,"config":190},"Sign in",{"href":191,"dataGaName":192,"dataGaLocation":177},"https://gitlab.com/users/sign_in/","sign in",[194,223,323,328,442,498],{"text":195,"config":196,"menu":198},"Platform",{"dataNavLevelOne":197},"platform",{"type":199,"columns":200},"cards",[201,207,215],{"title":195,"description":202,"link":203},"The intelligent orchestration platform for DevSecOps",{"text":204,"config":205},"Explore our Platform",{"href":206,"dataGaName":197,"dataGaLocation":177},"/platform/",{"title":208,"description":209,"link":210},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":211,"config":212},"Meet GitLab Duo",{"href":213,"dataGaName":214,"dataGaLocation":177},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":216,"description":217,"link":218},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":219,"config":220},"Learn more",{"href":221,"dataGaName":222,"dataGaLocation":177},"/why-gitlab/","why gitlab",{"text":224,"left":161,"config":225,"menu":227},"Product",{"dataNavLevelOne":226},"solutions",{"type":228,"link":229,"columns":233,"feature":302},"lists",{"text":230,"config":231},"View all Solutions",{"href":232,"dataGaName":226,"dataGaLocation":177},"/solutions/",[234,258,281],{"title":235,"description":236,"link":237,"items":242},"Automation","CI/CD and automation to accelerate deployment",{"config":238},{"icon":239,"href":240,"dataGaName":241,"dataGaLocation":177},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[243,247,250,254],{"text":244,"config":245},"CI/CD",{"href":246,"dataGaLocation":177,"dataGaName":244},"/solutions/continuous-integration/",{"text":208,"config":248},{"href":213,"dataGaLocation":177,"dataGaName":249},"gitlab duo agent platform - product menu",{"text":251,"config":252},"Source Code Management",{"href":253,"dataGaLocation":177,"dataGaName":251},"/solutions/source-code-management/",{"text":255,"config":256},"Automated Software Delivery",{"href":240,"dataGaLocation":177,"dataGaName":257},"Automated software delivery",{"title":259,"description":260,"link":261,"items":266},"Security","Deliver code faster without compromising security",{"config":262},{"href":263,"dataGaName":264,"dataGaLocation":177,"icon":265},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[267,271,276],{"text":268,"config":269},"Application Security Testing",{"href":263,"dataGaName":270,"dataGaLocation":177},"Application security testing",{"text":272,"config":273},"Software Supply Chain Security",{"href":274,"dataGaLocation":177,"dataGaName":275},"/solutions/supply-chain/","Software supply chain security",{"text":277,"config":278},"Software Compliance",{"href":279,"dataGaName":280,"dataGaLocation":177},"/solutions/software-compliance/","software compliance",{"title":282,"link":283,"items":288},"Measurement",{"config":284},{"icon":285,"href":286,"dataGaName":287,"dataGaLocation":177},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[289,293,297],{"text":290,"config":291},"Visibility & Measurement",{"href":286,"dataGaLocation":177,"dataGaName":292},"Visibility and Measurement",{"text":294,"config":295},"Value Stream Management",{"href":296,"dataGaLocation":177,"dataGaName":294},"/solutions/value-stream-management/",{"text":298,"config":299},"Analytics & Insights",{"href":300,"dataGaLocation":177,"dataGaName":301},"/solutions/analytics-and-insights/","Analytics and insights",{"title":303,"type":228,"items":304},"GitLab for",[305,311,317],{"text":306,"config":307},"Enterprise",{"icon":308,"href":309,"dataGaLocation":177,"dataGaName":310},"Building","/enterprise/","enterprise",{"text":312,"config":313},"Small Business",{"icon":314,"href":315,"dataGaLocation":177,"dataGaName":316},"Work","/small-business/","small business",{"text":318,"config":319},"Public Sector",{"icon":320,"href":321,"dataGaLocation":177,"dataGaName":322},"Organization","/solutions/public-sector/","public sector",{"text":324,"config":325},"Pricing",{"href":326,"dataGaName":327,"dataGaLocation":177,"dataNavLevelOne":327},"/pricing/","pricing",{"text":329,"config":330,"menu":332},"Resources",{"dataNavLevelOne":331},"resources",{"type":228,"link":333,"columns":337,"feature":431},{"text":334,"config":335},"View all resources",{"href":336,"dataGaName":331,"dataGaLocation":177},"/resources/",[338,371,398],{"title":339,"items":340},"Getting started",[341,346,351,356,361,366],{"text":342,"config":343},"Install",{"href":344,"dataGaName":345,"dataGaLocation":177},"/install/","install",{"text":347,"config":348},"Quick start guides",{"href":349,"dataGaName":350,"dataGaLocation":177},"/get-started/","quick setup checklists",{"text":352,"config":353},"Learn",{"href":354,"dataGaLocation":177,"dataGaName":355},"https://university.gitlab.com/","learn",{"text":357,"config":358},"Product documentation",{"href":359,"dataGaName":360,"dataGaLocation":177},"https://docs.gitlab.com/","product documentation",{"text":362,"config":363},"Best practice videos",{"href":364,"dataGaName":365,"dataGaLocation":177},"/getting-started-videos/","best practice videos",{"text":367,"config":368},"Integrations",{"href":369,"dataGaName":370,"dataGaLocation":177},"/integrations/","integrations",{"title":372,"items":373},"Discover",[374,379,384,389,393],{"text":375,"config":376},"Customer success stories",{"href":377,"dataGaName":378,"dataGaLocation":177},"/customers/","customer success stories",{"text":380,"config":381},"Blog",{"href":382,"dataGaName":383,"dataGaLocation":177},"/blog/","blog",{"text":385,"config":386},"Demo Hub",{"href":387,"dataGaName":388,"dataGaLocation":177},"/demo-hub/","demo hub",{"text":390,"config":391},"The Source",{"href":392,"dataGaName":383,"dataGaLocation":177},"/the-source/",{"text":394,"config":395},"Remote",{"href":396,"dataGaName":397,"dataGaLocation":177},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":399,"items":400},"Connect",[401,406,411,416,421,426],{"text":402,"config":403},"GitLab Services",{"href":404,"dataGaName":405,"dataGaLocation":177},"/services/","services",{"text":407,"config":408},"Contribute",{"href":409,"dataGaName":410,"dataGaLocation":177},"https://contributors.gitlab.com","contribute",{"text":412,"config":413},"Community",{"href":414,"dataGaName":415,"dataGaLocation":177},"/community/","community",{"text":417,"config":418},"Forum",{"href":419,"dataGaName":420,"dataGaLocation":177},"https://forum.gitlab.com/","forum",{"text":422,"config":423},"Events",{"href":424,"dataGaName":425,"dataGaLocation":177},"/events/","events",{"text":427,"config":428},"Partners",{"href":429,"dataGaName":430,"dataGaLocation":177},"/partners/","partners",{"config":432,"title":435,"text":436,"link":437},{"background":433,"textColor":434},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":438,"config":439},"Read the latest",{"href":440,"dataGaName":441,"dataGaLocation":177},"/whats-new/","whats new",{"text":443,"config":444,"menu":446},"Company",{"dataNavLevelOne":445},"company",{"type":228,"columns":447},[448],{"items":449},[450,455,461,463,468,473,478,483,488,493],{"text":451,"config":452},"About",{"href":453,"dataGaName":454,"dataGaLocation":177},"/company/","about",{"text":456,"config":457,"footerGa":460},"Jobs",{"href":458,"dataGaName":459,"dataGaLocation":177},"/jobs/","jobs",{"dataGaName":459},{"text":422,"config":462},{"href":424,"dataGaName":425,"dataGaLocation":177},{"text":464,"config":465},"Leadership",{"href":466,"dataGaName":467,"dataGaLocation":177},"/company/team/e-group/","leadership",{"text":469,"config":470},"Handbook",{"href":471,"dataGaName":472,"dataGaLocation":177},"https://handbook.gitlab.com/","handbook",{"text":474,"config":475},"Investor relations",{"href":476,"dataGaName":477,"dataGaLocation":177},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":479,"config":480},"Trust Center",{"href":481,"dataGaName":482,"dataGaLocation":177},"/security/","trust center",{"text":484,"config":485},"AI Transparency Center",{"href":486,"dataGaName":487,"dataGaLocation":177},"/ai-transparency-center/","ai transparency center",{"text":489,"config":490},"Newsletter",{"href":491,"dataGaName":492,"dataGaLocation":177},"/company/contact/#contact-forms","newsletter",{"text":494,"config":495},"Press",{"href":496,"dataGaName":497,"dataGaLocation":177},"/press/","press",{"text":499,"config":500,"menu":501},"Contact us",{"dataNavLevelOne":445},{"type":228,"columns":502},[503],{"items":504},[505,510,515],{"text":506,"config":507},"Talk to sales",{"href":508,"dataGaName":509,"dataGaLocation":177},"/sales/","talk to sales",{"text":511,"config":512},"Support portal",{"href":513,"dataGaName":514,"dataGaLocation":177},"https://support.gitlab.com/hc/en-us","support portal",{"text":516,"config":517},"Customer portal",{"href":518,"dataGaName":519,"dataGaLocation":177},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":521,"login":522,"suggestions":529},"Close",{"text":523,"link":524},"To search repositories and projects, login to",{"text":525,"config":526},"gitlab.com",{"href":191,"dataGaName":527,"dataGaLocation":528},"search login","search",{"text":530,"default":531},"Suggestions",[532,534,538,540,544,548],{"text":208,"config":533},{"href":213,"dataGaName":208,"dataGaLocation":528},{"text":535,"config":536},"Code Suggestions (AI)",{"href":537,"dataGaName":535,"dataGaLocation":528},"/solutions/code-suggestions/",{"text":244,"config":539},{"href":246,"dataGaName":244,"dataGaLocation":528},{"text":541,"config":542},"GitLab on AWS",{"href":543,"dataGaName":541,"dataGaLocation":528},"/partners/technology-partners/aws/",{"text":545,"config":546},"GitLab on Google Cloud",{"href":547,"dataGaName":545,"dataGaLocation":528},"/partners/technology-partners/google-cloud-platform/",{"text":549,"config":550},"Why GitLab?",{"href":221,"dataGaName":549,"dataGaLocation":528},{"freeTrial":552,"mobileIcon":557,"desktopIcon":562,"secondaryButton":565},{"text":553,"config":554},"Start free trial",{"href":555,"dataGaName":182,"dataGaLocation":556},"https://gitlab.com/-/trials/new/","nav",{"altText":558,"config":559},"Gitlab Icon",{"src":560,"dataGaName":561,"dataGaLocation":556},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":558,"config":563},{"src":564,"dataGaName":561,"dataGaLocation":556},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":566,"config":567},"Get Started",{"href":568,"dataGaName":569,"dataGaLocation":556},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":571,"mobileIcon":575,"desktopIcon":577},{"text":572,"config":573},"Learn more about GitLab Duo",{"href":213,"dataGaName":574,"dataGaLocation":556},"gitlab duo",{"altText":558,"config":576},{"src":560,"dataGaName":561,"dataGaLocation":556},{"altText":558,"config":578},{"src":564,"dataGaName":561,"dataGaLocation":556},{"button":580,"mobileIcon":585,"desktopIcon":587},{"text":581,"config":582},"/switch",{"href":583,"dataGaName":584,"dataGaLocation":556},"#contact","switch",{"altText":558,"config":586},{"src":560,"dataGaName":561,"dataGaLocation":556},{"altText":558,"config":588},{"src":589,"dataGaName":561,"dataGaLocation":556},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":591,"mobileIcon":596,"desktopIcon":598},{"text":592,"config":593},"Back to pricing",{"href":326,"dataGaName":594,"dataGaLocation":556,"icon":595},"back to pricing","GoBack",{"altText":558,"config":597},{"src":560,"dataGaName":561,"dataGaLocation":556},{"altText":558,"config":599},{"src":564,"dataGaName":561,"dataGaLocation":556},{"title":601,"titleMobile":602,"button":603,"config":608},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":219,"config":604},{"href":605,"dataGaName":606,"dataGaLocation":607},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":609,"disabled":158},"release",{"data":611},{"text":612,"source":613,"edit":619,"contribute":624,"config":629,"items":634,"minimal":844},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":614,"config":615},"View page source",{"href":616,"dataGaName":617,"dataGaLocation":618},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":620,"config":621},"Edit this page",{"href":622,"dataGaName":623,"dataGaLocation":618},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":625,"config":626},"Please contribute",{"href":627,"dataGaName":628,"dataGaLocation":618},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":630,"facebook":631,"youtube":632,"linkedin":633},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[635,682,736,780,812],{"title":324,"links":636,"subMenu":651},[637,641,646],{"text":638,"config":639},"View plans",{"href":326,"dataGaName":640,"dataGaLocation":618},"view plans",{"text":642,"config":643},"Why Premium?",{"href":644,"dataGaName":645,"dataGaLocation":618},"/pricing/premium/","why premium",{"text":647,"config":648},"Why Ultimate?",{"href":649,"dataGaName":650,"dataGaLocation":618},"/pricing/ultimate/","why ultimate",[652],{"title":653,"links":654},"Contact Us",[655,658,660,662,667,672,677],{"text":656,"config":657},"Contact sales",{"href":508,"dataGaName":187,"dataGaLocation":618},{"text":511,"config":659},{"href":513,"dataGaName":514,"dataGaLocation":618},{"text":516,"config":661},{"href":518,"dataGaName":519,"dataGaLocation":618},{"text":663,"config":664},"Status",{"href":665,"dataGaName":666,"dataGaLocation":618},"https://status.gitlab.com/","status",{"text":668,"config":669},"Terms of use",{"href":670,"dataGaName":671,"dataGaLocation":618},"/terms/","terms of use",{"text":673,"config":674},"Privacy statement",{"href":675,"dataGaName":676,"dataGaLocation":618},"/privacy/","privacy statement",{"text":678,"config":679},"Cookie preferences",{"dataGaName":680,"dataGaLocation":618,"id":681,"isOneTrustButton":161},"cookie preferences","ot-sdk-btn",{"title":224,"links":683,"subMenu":692},[684,688],{"text":685,"config":686},"DevSecOps platform",{"href":206,"dataGaName":687,"dataGaLocation":618},"devsecops platform",{"text":689,"config":690},"AI-Assisted Development",{"href":213,"dataGaName":691,"dataGaLocation":618},"ai-assisted development",[693],{"title":694,"links":695},"Topics",[696,701,706,711,716,721,726,731],{"text":697,"config":698},"CICD",{"href":699,"dataGaName":700,"dataGaLocation":618},"/topics/ci-cd/","cicd",{"text":702,"config":703},"GitOps",{"href":704,"dataGaName":705,"dataGaLocation":618},"/topics/gitops/","gitops",{"text":707,"config":708},"DevOps",{"href":709,"dataGaName":710,"dataGaLocation":618},"/topics/devops/","devops",{"text":712,"config":713},"Version Control",{"href":714,"dataGaName":715,"dataGaLocation":618},"/topics/version-control/","version control",{"text":717,"config":718},"DevSecOps",{"href":719,"dataGaName":720,"dataGaLocation":618},"/topics/devsecops/","devsecops",{"text":722,"config":723},"Cloud Native",{"href":724,"dataGaName":725,"dataGaLocation":618},"/topics/cloud-native/","cloud native",{"text":727,"config":728},"AI for Coding",{"href":729,"dataGaName":730,"dataGaLocation":618},"/topics/devops/ai-for-coding/","ai for coding",{"text":732,"config":733},"Agentic AI",{"href":734,"dataGaName":735,"dataGaLocation":618},"/topics/agentic-ai/","agentic ai",{"title":737,"links":738},"Solutions",[739,741,743,748,752,755,759,762,764,767,770,775],{"text":268,"config":740},{"href":263,"dataGaName":268,"dataGaLocation":618},{"text":257,"config":742},{"href":240,"dataGaName":241,"dataGaLocation":618},{"text":744,"config":745},"Agile development",{"href":746,"dataGaName":747,"dataGaLocation":618},"/solutions/agile-delivery/","agile delivery",{"text":749,"config":750},"SCM",{"href":253,"dataGaName":751,"dataGaLocation":618},"source code management",{"text":697,"config":753},{"href":246,"dataGaName":754,"dataGaLocation":618},"continuous integration & delivery",{"text":756,"config":757},"Value stream management",{"href":296,"dataGaName":758,"dataGaLocation":618},"value stream management",{"text":702,"config":760},{"href":761,"dataGaName":705,"dataGaLocation":618},"/solutions/gitops/",{"text":306,"config":763},{"href":309,"dataGaName":310,"dataGaLocation":618},{"text":765,"config":766},"Small business",{"href":315,"dataGaName":316,"dataGaLocation":618},{"text":768,"config":769},"Public sector",{"href":321,"dataGaName":322,"dataGaLocation":618},{"text":771,"config":772},"Education",{"href":773,"dataGaName":774,"dataGaLocation":618},"/solutions/education/","education",{"text":776,"config":777},"Financial services",{"href":778,"dataGaName":779,"dataGaLocation":618},"/solutions/finance/","financial services",{"title":329,"links":781},[782,784,786,788,791,793,796,798,800,802,804,806,808,810],{"text":342,"config":783},{"href":344,"dataGaName":345,"dataGaLocation":618},{"text":347,"config":785},{"href":349,"dataGaName":350,"dataGaLocation":618},{"text":352,"config":787},{"href":354,"dataGaName":355,"dataGaLocation":618},{"text":357,"config":789},{"href":359,"dataGaName":790,"dataGaLocation":618},"docs",{"text":380,"config":792},{"href":382,"dataGaName":383,"dataGaLocation":618},{"text":794,"config":795},"What's new",{"href":440,"dataGaName":441,"dataGaLocation":618},{"text":375,"config":797},{"href":377,"dataGaName":378,"dataGaLocation":618},{"text":394,"config":799},{"href":396,"dataGaName":397,"dataGaLocation":618},{"text":402,"config":801},{"href":404,"dataGaName":405,"dataGaLocation":618},{"text":407,"config":803},{"href":409,"dataGaName":410,"dataGaLocation":618},{"text":412,"config":805},{"href":414,"dataGaName":415,"dataGaLocation":618},{"text":417,"config":807},{"href":419,"dataGaName":420,"dataGaLocation":618},{"text":422,"config":809},{"href":424,"dataGaName":425,"dataGaLocation":618},{"text":427,"config":811},{"href":429,"dataGaName":430,"dataGaLocation":618},{"title":443,"links":813},[814,816,818,820,822,824,828,833,835,837,839],{"text":451,"config":815},{"href":453,"dataGaName":445,"dataGaLocation":618},{"text":456,"config":817},{"href":458,"dataGaName":459,"dataGaLocation":618},{"text":464,"config":819},{"href":466,"dataGaName":467,"dataGaLocation":618},{"text":469,"config":821},{"href":471,"dataGaName":472,"dataGaLocation":618},{"text":474,"config":823},{"href":476,"dataGaName":477,"dataGaLocation":618},{"text":825,"config":826},"Sustainability",{"href":827,"dataGaName":825,"dataGaLocation":618},"/sustainability/",{"text":829,"config":830},"Diversity, inclusion and belonging (DIB)",{"href":831,"dataGaName":832,"dataGaLocation":618},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":479,"config":834},{"href":481,"dataGaName":482,"dataGaLocation":618},{"text":489,"config":836},{"href":491,"dataGaName":492,"dataGaLocation":618},{"text":494,"config":838},{"href":496,"dataGaName":497,"dataGaLocation":618},{"text":840,"config":841},"Modern Slavery Transparency Statement",{"href":842,"dataGaName":843,"dataGaLocation":618},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":845},[846,849,852],{"text":847,"config":848},"Terms",{"href":670,"dataGaName":671,"dataGaLocation":618},{"text":850,"config":851},"Cookies",{"dataGaName":680,"dataGaLocation":618,"id":681,"isOneTrustButton":161},{"text":853,"config":854},"Privacy",{"href":675,"dataGaName":676,"dataGaLocation":618},[856],{"id":857,"title":7,"body":157,"config":858,"content":860,"description":157,"extension":863,"meta":864,"navigation":161,"path":865,"seo":866,"stem":867,"__hash__":868},"blogAuthors/en-us/blog/authors/eddie-glenn.yml",{"template":859},"BlogAuthor",{"name":7,"config":861},{"headshot":140,"ctfId":862},"eglenn","yml",{},"/en-us/blog/authors/eddie-glenn",{},"en-us/blog/authors/eddie-glenn","7ZXgSsAvVbTsiOUiXEt14kim3eM4h0vm9PTu5ht3cMo",[870,878,886],{"title":871,"description":872,"heroImage":873,"category":153,"date":874,"authors":875,"slug":877,"externalUrl":157},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[876],"Julian Thome","improved-scope-offset-fingerprinting",{"title":879,"description":880,"heroImage":873,"category":153,"date":881,"authors":882,"slug":885,"externalUrl":157},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[883,884],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":887,"description":888,"heroImage":889,"category":153,"date":890,"authors":891,"slug":893,"externalUrl":157},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[892],"Alisa Ho","claude-security-and-gitlab",{"promotions":895},[896,910,922,933],{"id":897,"categories":898,"header":900,"text":901,"button":902,"image":907},"ai-modernization",[899],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":903,"config":904},"Get your AI maturity score",{"href":905,"dataGaName":906,"dataGaLocation":383},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":908},{"src":909},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":911,"categories":912,"header":914,"text":901,"button":915,"image":919},"devops-modernization",[913,720],"product","Are you just managing tools or shipping innovation?",{"text":916,"config":917},"Get your DevOps maturity score",{"href":918,"dataGaName":906,"dataGaLocation":383},"/assessments/devops-modernization-assessment/",{"config":920},{"src":921},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":923,"categories":924,"header":925,"text":901,"button":926,"image":930},"security-modernization",[153],"Are you trading speed for security?",{"text":927,"config":928},"Get your security maturity score",{"href":929,"dataGaName":906,"dataGaLocation":383},"/assessments/security-modernization-assessment/",{"config":931},{"src":932},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":934,"paths":935,"header":938,"text":939,"button":940,"image":945},"github-azure-migration",[936,937],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":941,"config":942},"See how GitLab compares to GitHub",{"href":943,"dataGaName":944,"dataGaLocation":383},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":946},{"src":921},{"header":948,"blurb":949,"button":950,"secondaryButton":955},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":951,"config":952},"Get your free trial",{"href":953,"dataGaName":182,"dataGaLocation":954},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":656,"config":956},{"href":508,"dataGaName":187,"dataGaLocation":954},1786803752472]