[{"data":1,"prerenderedAt":1183},["ShallowReactive",2],{"/blog/securing-your-code-on-gitlab":3,"navigation-en-us":401,"banner-en-us":828,"footer-en-us":838,"blog-post-authors-en-us-Steve Grossman":1080,"blog-related-posts-en-us-securing-your-code-on-gitlab":1095,"blog-promotions-en-us":1120,"next-steps-en-us":1173},{"id":4,"title":5,"authors":6,"body":8,"category":380,"date":381,"description":382,"extension":383,"externalUrl":384,"faq":384,"featured":385,"heroImage":386,"meta":387,"navigation":388,"path":389,"seo":390,"slug":394,"stem":395,"tags":396,"template":399,"updatedDate":384,"__hash__":400},"blogPosts/en-us/blog/securing-your-code-on-gitlab.md","The ultimate guide to securing your code on GitLab.com",[7],"Steve Grossman",{"type":9,"value":10,"toc":359},"minimark",[11,21,26,29,34,37,42,45,49,52,117,121,128,139,143,151,155,172,176,179,182,186,189,206,210,217,234,238,241,245,248,251,255,263,267,270,274,277,281,284,288,292,296,323,327,330,339,343],[12,13,14,15,20],"p",{},"A critical aspect of a DevSecOps methodology is to apply best practices to secure your development environment. Your software should be protected from malicious and accidental exposure or modification. This blog explains how to control and manage access to GitLab.com and, in turn, source code, build pipelines, dependency and package repositories, and deployment keys involved in the ",[16,17,19],"a",{"href":18},"/blog/the-ultimate-guide-to-software-supply-chain-security/","software supply chain",". The best practices specifically address the capabilities for end users on multi-tenant GitLab.com and are written for the Ultimate license tier. Not all of these capabilities are available at the Premium tier.",[22,23,25],"h2",{"id":24},"_1-group-settings","1. Group settings",[12,27,28],{},"Many security-related settings can be set on the top-level group and will cascade down into all subgroups and projects. They are the easiest and most important in securing your GitLab.com instance.",[30,31,33],"h3",{"id":32},"general-settings","General settings",[12,35,36],{},"In the top-level group, the following settings should be applied to provide the best security for the code within that group:",[38,39,41],"h4",{"id":40},"make-the-group-visibility-level-private","Make the group visibility level private",[12,43,44],{},"This is likely the most important setting among general settings. By marking the group “private\", anyone who is not explicitly a member of the group will not be able to access it. Additionally, by making the top-level group private, all subgroups and projects will also be private and cannot be exposed.",[38,46,48],{"id":47},"permissions-and-group-features","Permissions and group features",[12,50,51],{},"Under permissions:",[53,54,55,59,62,79,87,90,93,102,105,114],"ul",{},[56,57,58],"li",{},"Set “Prevent members from sending invitations to outside groups”. This will prevent accidentally adding people who should not belong to the group.",[56,60,61],{},"Set “Prevent sharing a project with other groups”. This prevents accidental or malicious exfiltration of code by sharing or moving a project to another group outside the control of the top-level group owner.",[56,63,64,65,70,71],{},"Allow project and group access token creation. Project and group access tokens are much like ",[16,66,69],{"href":67,"rel":68},"https://docs.gitlab.com/user/profile/personal_access_tokens/",[],"personal access tokens"," with the following improvements:\n",[53,72,73,76],{},[56,74,75],{},"They are visible to and manageable by group owners and maintainers, which means they can be revoked and have expiration dates set by an administrator to limit the opportunity for abuse.",[56,77,78],{},"They create a virtual “bot” user that does not count against your license count.",[56,80,81,82,86],{},"Enable ",[16,83,85],{"href":84},"/blog/delayed-deletion/","delayed project deletion",". This will give you a seven-day grace period to catch and prevent accidental or malicious removal of a repo. GitLab.com, like self-managed GitLab, does not have the ability to restore an individual project without significant expense for professional services.",[56,88,89],{},"Allowlist the Classless Inter-Domain Routing (CIDR) or supernetting from which users should be accessing the code.",[56,91,92],{},"Restrict membership to only those email domains belonging to your organization and contractors.",[56,94,95,96,101],{},"Restrict creation of subgroups to Owners. This will help keep the structure of the top-level group within your policies and make ",[16,97,100],{"href":98,"rel":99},"https://docs.gitlab.com/user/group/saml_sso/group_sync/",[],"SAML Group Sync"," for membership easier to manage.",[56,103,104],{},"Block forking projects outside of this group hierarchy. This will help prevent code exfiltration.",[56,106,107,108,113],{},"Require ",[16,109,112],{"href":110,"rel":111},"https://docs.gitlab.com/user/profile/account/two_factor_authentication/",[],"two-factor authentication",". This disables the ability to use password authentication with Git over HTTPS.",[56,115,116],{},"Disallow adding new members to projects within this group. All members must be inherited from the group.",[38,118,120],{"id":119},"merge-request-approvals","Merge request approvals",[12,122,123,127],{},[16,124,120],{"href":125,"rel":126},"https://docs.gitlab.com/user/project/merge_requests/approvals/",[]," help prevent injection of malicious code into the repository by having people other than the author review them. Enable merge request approvals for all projects in your group to:",[53,129,130,133,136],{},[56,131,132],{},"Prevent approval by authors.",[56,134,135],{},"Prevent approvals by users who add commits.",[56,137,138],{},"Prevent editing approval rules in projects and on individual merge requests.",[30,140,142],{"id":141},"saml-sso","SAML SSO",[12,144,145,146,150],{},"To more tightly control who can access your code in GitLab.com, set up ",[16,147,142],{"href":148,"rel":149},"https://docs.gitlab.com/user/group/saml_sso/",[],". This will ensure that everyone who accesses it is approved by someone in authority.",[38,152,154],{"id":153},"to-configure-saml-sso","To configure SAML SSO:",[53,156,157,160,163,166,169],{},[56,158,159],{},"Enable SAML authentication for this group.",[56,161,162],{},"Enforce SSO-only authentication for web activity for this group.",[56,164,165],{},"Enforce SSO-only authentication for Git and Dependency Proxy activity for this group.",[56,167,168],{},"Set the Default membership role to Minimal Access. Roles can be increased as needed in subgroups or individual projects, minimal access prevents any visibility to projects or subgroups where the user is not explicitly granted another role.",[56,170,171],{},"Tightly control access to the Maintainer and Owner roles; every developer does not need to have a Maintainer role.",[22,173,175],{"id":174},"_2-group-auditing-and-compliance","2. Group auditing and compliance",[12,177,178],{},"Regularly and periodically review the compliance reports to verify who is approving merge requests and what MRs are getting approved.",[12,180,181],{},"Set up streaming group audit events to your corporate security information and event management (SIEM) system and monitor them for unusual activity. This needs to be repeated for each group and project in the hierarchy to get the maximum number of audit events.",[22,183,185],{"id":184},"_3-group-level-push-rules","3. Group-level push rules",[12,187,188],{},"Setting restrictive push rules at the group level will help ensure malicious code is not injected into the repository:",[53,190,191,194,197,200,203],{},[56,192,193],{},"Require committers be verified.",[56,195,196],{},"Reject unsigned commits.",[56,198,199],{},"Ensure the commit author is a GitLab user.",[56,201,202],{},"Prevent pushing secret files.",[56,204,205],{},"Require commit author’s email to be from your email domain.",[22,207,209],{"id":208},"cicd","CI/CD",[12,211,212,213,216],{},"The following settings can help insure the integrity of ",[16,214,209],{"href":215},"/topics/ci-cd/"," pipelines and reduce the opportunities for abuse and malice:",[53,218,219,222,225,228,231],{},[56,220,221],{},"Register runners at the lowest practical level to reduce the blast radius of any malicious use.",[56,223,224],{},"Require tags to use all runners to reduce the opportunity for abuse.",[56,226,227],{},"Define CI/CD variables – especially if they contain secrets – at the lowest practical level to reduce the blast radius of any malicious use.",[56,229,230],{},"Use protected runners with protected variables and protected branches to significantly limit who can deploy into production environments or misuse cloud resources.",[56,232,233],{},"Access to change the .gitlab-ci.yml pipeline definition file should be tightly controlled in all repos through the CODEOWNERS file to prevent malicious use of the CI/CD system.",[22,235,237],{"id":236},"_4-project-settings","4. Project settings",[12,239,240],{},"Some settings do not cascade down from the group or are not available at the group level and must be set on individual projects instead. These include some repo-specific settings.",[30,242,244],{"id":243},"repository","Repository",[12,246,247],{},"Set up protected branches and protected tags to go along with the protected runners and protected variables defined above.",[30,249,209],{"id":250},"cicd-1",[38,252,254],{"id":253},"general","General",[53,256,257,260],{},[56,258,259],{},"Disable public pipelines.",[56,261,262],{},"Use separate caches for protected branches.",[30,264,266],{"id":265},"protected-environments","Protected environments",[12,268,269],{},"Use protected environments and tightly limit who can deploy and require approvals for deploying.",[38,271,273],{"id":272},"token-access","Token access",[12,275,276],{},"Restrict access to this project’s CI_JOB_TOKEN to only individual projects to ensure malicious projects to not retrieve the token and use it to access the API.",[38,278,280],{"id":279},"secure-files","Secure files",[12,282,283],{},"Store keystores, provisioning profiles and signing certificates in the Secure Files storage rather than the repository.",[22,285,287],{"id":286},"_5-project-level-security-testing-and-compliance","5. Project-level security testing and compliance",[30,289,291],{"id":290},"configuration","Configuration",[38,293,295],{"id":294},"security-testing","Security testing",[53,297,298,307,315],{},[56,299,300,301,306],{},"Enable static application security testing ",[16,302,305],{"href":303,"rel":304},"https://docs.gitlab.com/user/application_security/sast/",[],"SAST"," to help prevent insertion of malicious code into the application.",[56,308,309,310,314],{},"Enable dependency scanning and regularly review the dependency list or software, or software bill of materials (",[16,311,313],{"href":312},"/blog/the-ultimate-guide-to-sboms/","SBOM","], generated by dependency scanning for vulnerabilities and malicious components.",[56,316,81,317,322],{},[16,318,321],{"href":319,"rel":320},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"container scanning"," and cluster image scanning.",[38,324,326],{"id":325},"policies","Policies",[12,328,329],{},"As an alternative to the security testing section above, you may choose to enable scan execution policies.\nEnable test scan result policies to prevent merging code with critical vulnerabilities.",[12,331,332,333,338],{},"Following these best practices will help ensure that your code hosted on GitLab.com is safe from tampering and\n",[16,334,337],{"href":335,"rel":336},"https://www.engadget.com/okta-stolen-source-code-205601214.html",[],"public exposure"," and that your\nsoftware supply chain is secure and only authorized users\nare accessing your software assets.",[22,340,342],{"id":341},"more-resources","More resources",[53,344,345,352],{},[56,346,347],{},[16,348,351],{"href":349,"rel":350},"https://docs.gitlab.com/user/group/",[],"Group level settings documentation",[56,353,354],{},[16,355,358],{"href":356,"rel":357},"https://docs.gitlab.com/user/project/settings/",[],"Project level settings documentation",{"title":360,"searchDepth":361,"depth":361,"links":362},"",2,[363,368,369,370,371,376,379],{"id":24,"depth":361,"text":25,"children":364},[365,367],{"id":32,"depth":366,"text":33},3,{"id":141,"depth":366,"text":142},{"id":174,"depth":361,"text":175},{"id":184,"depth":361,"text":185},{"id":208,"depth":361,"text":209},{"id":236,"depth":361,"text":237,"children":372},[373,374,375],{"id":243,"depth":366,"text":244},{"id":250,"depth":366,"text":209},{"id":265,"depth":366,"text":266},{"id":286,"depth":361,"text":287,"children":377},[378],{"id":290,"depth":366,"text":291},{"id":341,"depth":361,"text":342},"security","2023-05-31","This in-depth tutorial, complete with best practices, will help you secure your development environment.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669863/Blog/Hero%20Images/security-pipelines.jpg",{},true,"/en-us/blog/securing-your-code-on-gitlab",{"title":5,"description":382,"ogTitle":5,"ogDescription":382,"noIndex":385,"ogImage":386,"ogUrl":391,"ogSiteName":392,"ogType":393,"canonicalUrls":391},"https://about.gitlab.com/blog/securing-your-code-on-gitlab","https://about.gitlab.com","article","securing-your-code-on-gitlab","en-us/blog/securing-your-code-on-gitlab",[397,398],"tutorial","DevSecOps platform","BlogPost","0z1YF70cRu5rlXEp3E5NKoNa1CwoSnhZfBGprwi4Vk8",{"logo":402,"freeTrial":407,"sales":412,"login":417,"items":422,"search":748,"minimal":779,"duo":798,"switchNav":807,"pricingDeployment":818},{"config":403},{"href":404,"dataGaName":405,"dataGaLocation":406},"/","gitlab logo","header",{"text":408,"config":409},"Get free trial",{"href":410,"dataGaName":411,"dataGaLocation":406},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":413,"config":414},"Request a demo",{"href":415,"dataGaName":416,"dataGaLocation":406},"/sales/?contact-topic=request-demo","sales",{"text":418,"config":419},"Sign in",{"href":420,"dataGaName":421,"dataGaLocation":406},"https://gitlab.com/users/sign_in/","sign in",[423,452,551,556,670,726],{"text":424,"config":425,"menu":427},"Platform",{"dataNavLevelOne":426},"platform",{"type":428,"columns":429},"cards",[430,436,444],{"title":424,"description":431,"link":432},"The intelligent orchestration platform for DevSecOps",{"text":433,"config":434},"Explore our Platform",{"href":435,"dataGaName":426,"dataGaLocation":406},"/platform/",{"title":437,"description":438,"link":439},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":440,"config":441},"Meet GitLab Duo",{"href":442,"dataGaName":443,"dataGaLocation":406},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":445,"description":446,"link":447},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":448,"config":449},"Learn more",{"href":450,"dataGaName":451,"dataGaLocation":406},"/why-gitlab/","why gitlab",{"text":453,"left":388,"config":454,"menu":456},"Product",{"dataNavLevelOne":455},"solutions",{"type":457,"link":458,"columns":462,"feature":530},"lists",{"text":459,"config":460},"View all Solutions",{"href":461,"dataGaName":455,"dataGaLocation":406},"/solutions/",[463,486,509],{"title":464,"description":465,"link":466,"items":471},"Automation","CI/CD and automation to accelerate deployment",{"config":467},{"icon":468,"href":469,"dataGaName":470,"dataGaLocation":406},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[472,475,478,482],{"text":209,"config":473},{"href":474,"dataGaLocation":406,"dataGaName":209},"/solutions/continuous-integration/",{"text":437,"config":476},{"href":442,"dataGaLocation":406,"dataGaName":477},"gitlab duo agent platform - product menu",{"text":479,"config":480},"Source Code Management",{"href":481,"dataGaLocation":406,"dataGaName":479},"/solutions/source-code-management/",{"text":483,"config":484},"Automated Software Delivery",{"href":469,"dataGaLocation":406,"dataGaName":485},"Automated software delivery",{"title":487,"description":488,"link":489,"items":494},"Security","Deliver code faster without compromising security",{"config":490},{"href":491,"dataGaName":492,"dataGaLocation":406,"icon":493},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[495,499,504],{"text":496,"config":497},"Application Security Testing",{"href":491,"dataGaName":498,"dataGaLocation":406},"Application security testing",{"text":500,"config":501},"Software Supply Chain Security",{"href":502,"dataGaLocation":406,"dataGaName":503},"/solutions/supply-chain/","Software supply chain security",{"text":505,"config":506},"Software Compliance",{"href":507,"dataGaName":508,"dataGaLocation":406},"/solutions/software-compliance/","software compliance",{"title":510,"link":511,"items":516},"Measurement",{"config":512},{"icon":513,"href":514,"dataGaName":515,"dataGaLocation":406},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[517,521,525],{"text":518,"config":519},"Visibility & Measurement",{"href":514,"dataGaLocation":406,"dataGaName":520},"Visibility and Measurement",{"text":522,"config":523},"Value Stream Management",{"href":524,"dataGaLocation":406,"dataGaName":522},"/solutions/value-stream-management/",{"text":526,"config":527},"Analytics & Insights",{"href":528,"dataGaLocation":406,"dataGaName":529},"/solutions/analytics-and-insights/","Analytics and insights",{"title":531,"type":457,"items":532},"GitLab for",[533,539,545],{"text":534,"config":535},"Enterprise",{"icon":536,"href":537,"dataGaLocation":406,"dataGaName":538},"Building","/enterprise/","enterprise",{"text":540,"config":541},"Small Business",{"icon":542,"href":543,"dataGaLocation":406,"dataGaName":544},"Work","/small-business/","small business",{"text":546,"config":547},"Public Sector",{"icon":548,"href":549,"dataGaLocation":406,"dataGaName":550},"Organization","/solutions/public-sector/","public sector",{"text":552,"config":553},"Pricing",{"href":554,"dataGaName":555,"dataGaLocation":406,"dataNavLevelOne":555},"/pricing/","pricing",{"text":557,"config":558,"menu":560},"Resources",{"dataNavLevelOne":559},"resources",{"type":457,"link":561,"columns":565,"feature":659},{"text":562,"config":563},"View all resources",{"href":564,"dataGaName":559,"dataGaLocation":406},"/resources/",[566,599,626],{"title":567,"items":568},"Getting started",[569,574,579,584,589,594],{"text":570,"config":571},"Install",{"href":572,"dataGaName":573,"dataGaLocation":406},"/install/","install",{"text":575,"config":576},"Quick start guides",{"href":577,"dataGaName":578,"dataGaLocation":406},"/get-started/","quick setup checklists",{"text":580,"config":581},"Learn",{"href":582,"dataGaLocation":406,"dataGaName":583},"https://university.gitlab.com/","learn",{"text":585,"config":586},"Product documentation",{"href":587,"dataGaName":588,"dataGaLocation":406},"https://docs.gitlab.com/","product documentation",{"text":590,"config":591},"Best practice videos",{"href":592,"dataGaName":593,"dataGaLocation":406},"/getting-started-videos/","best practice videos",{"text":595,"config":596},"Integrations",{"href":597,"dataGaName":598,"dataGaLocation":406},"/integrations/","integrations",{"title":600,"items":601},"Discover",[602,607,612,617,621],{"text":603,"config":604},"Customer success stories",{"href":605,"dataGaName":606,"dataGaLocation":406},"/customers/","customer success stories",{"text":608,"config":609},"Blog",{"href":610,"dataGaName":611,"dataGaLocation":406},"/blog/","blog",{"text":613,"config":614},"Demo Hub",{"href":615,"dataGaName":616,"dataGaLocation":406},"/demo-hub/","demo hub",{"text":618,"config":619},"The Source",{"href":620,"dataGaName":611,"dataGaLocation":406},"/the-source/",{"text":622,"config":623},"Remote",{"href":624,"dataGaName":625,"dataGaLocation":406},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":627,"items":628},"Connect",[629,634,639,644,649,654],{"text":630,"config":631},"GitLab Services",{"href":632,"dataGaName":633,"dataGaLocation":406},"/services/","services",{"text":635,"config":636},"Contribute",{"href":637,"dataGaName":638,"dataGaLocation":406},"https://contributors.gitlab.com","contribute",{"text":640,"config":641},"Community",{"href":642,"dataGaName":643,"dataGaLocation":406},"/community/","community",{"text":645,"config":646},"Forum",{"href":647,"dataGaName":648,"dataGaLocation":406},"https://forum.gitlab.com/","forum",{"text":650,"config":651},"Events",{"href":652,"dataGaName":653,"dataGaLocation":406},"/events/","events",{"text":655,"config":656},"Partners",{"href":657,"dataGaName":658,"dataGaLocation":406},"/partners/","partners",{"config":660,"title":663,"text":664,"link":665},{"background":661,"textColor":662},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":666,"config":667},"Read the latest",{"href":668,"dataGaName":669,"dataGaLocation":406},"/whats-new/","whats new",{"text":671,"config":672,"menu":674},"Company",{"dataNavLevelOne":673},"company",{"type":457,"columns":675},[676],{"items":677},[678,683,689,691,696,701,706,711,716,721],{"text":679,"config":680},"About",{"href":681,"dataGaName":682,"dataGaLocation":406},"/company/","about",{"text":684,"config":685,"footerGa":688},"Jobs",{"href":686,"dataGaName":687,"dataGaLocation":406},"/jobs/","jobs",{"dataGaName":687},{"text":650,"config":690},{"href":652,"dataGaName":653,"dataGaLocation":406},{"text":692,"config":693},"Leadership",{"href":694,"dataGaName":695,"dataGaLocation":406},"/company/team/e-group/","leadership",{"text":697,"config":698},"Handbook",{"href":699,"dataGaName":700,"dataGaLocation":406},"https://handbook.gitlab.com/","handbook",{"text":702,"config":703},"Investor relations",{"href":704,"dataGaName":705,"dataGaLocation":406},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":707,"config":708},"Trust Center",{"href":709,"dataGaName":710,"dataGaLocation":406},"/security/","trust center",{"text":712,"config":713},"AI Transparency Center",{"href":714,"dataGaName":715,"dataGaLocation":406},"/ai-transparency-center/","ai transparency center",{"text":717,"config":718},"Newsletter",{"href":719,"dataGaName":720,"dataGaLocation":406},"/company/contact/#contact-forms","newsletter",{"text":722,"config":723},"Press",{"href":724,"dataGaName":725,"dataGaLocation":406},"/press/","press",{"text":727,"config":728,"menu":729},"Contact us",{"dataNavLevelOne":673},{"type":457,"columns":730},[731],{"items":732},[733,738,743],{"text":734,"config":735},"Talk to sales",{"href":736,"dataGaName":737,"dataGaLocation":406},"/sales/","talk to sales",{"text":739,"config":740},"Support portal",{"href":741,"dataGaName":742,"dataGaLocation":406},"https://support.gitlab.com/hc/en-us","support portal",{"text":744,"config":745},"Customer portal",{"href":746,"dataGaName":747,"dataGaLocation":406},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":749,"login":750,"suggestions":757},"Close",{"text":751,"link":752},"To search repositories and projects, login to",{"text":753,"config":754},"gitlab.com",{"href":420,"dataGaName":755,"dataGaLocation":756},"search login","search",{"text":758,"default":759},"Suggestions",[760,762,766,768,772,776],{"text":437,"config":761},{"href":442,"dataGaName":437,"dataGaLocation":756},{"text":763,"config":764},"Code Suggestions (AI)",{"href":765,"dataGaName":763,"dataGaLocation":756},"/solutions/code-suggestions/",{"text":209,"config":767},{"href":474,"dataGaName":209,"dataGaLocation":756},{"text":769,"config":770},"GitLab on AWS",{"href":771,"dataGaName":769,"dataGaLocation":756},"/partners/technology-partners/aws/",{"text":773,"config":774},"GitLab on Google Cloud",{"href":775,"dataGaName":773,"dataGaLocation":756},"/partners/technology-partners/google-cloud-platform/",{"text":777,"config":778},"Why GitLab?",{"href":450,"dataGaName":777,"dataGaLocation":756},{"freeTrial":780,"mobileIcon":785,"desktopIcon":790,"secondaryButton":793},{"text":781,"config":782},"Start free trial",{"href":783,"dataGaName":411,"dataGaLocation":784},"https://gitlab.com/-/trials/new/","nav",{"altText":786,"config":787},"Gitlab Icon",{"src":788,"dataGaName":789,"dataGaLocation":784},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":786,"config":791},{"src":792,"dataGaName":789,"dataGaLocation":784},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":794,"config":795},"Get Started",{"href":796,"dataGaName":797,"dataGaLocation":784},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":799,"mobileIcon":803,"desktopIcon":805},{"text":800,"config":801},"Learn more about GitLab Duo",{"href":442,"dataGaName":802,"dataGaLocation":784},"gitlab duo",{"altText":786,"config":804},{"src":788,"dataGaName":789,"dataGaLocation":784},{"altText":786,"config":806},{"src":792,"dataGaName":789,"dataGaLocation":784},{"button":808,"mobileIcon":813,"desktopIcon":815},{"text":809,"config":810},"/switch",{"href":811,"dataGaName":812,"dataGaLocation":784},"#contact","switch",{"altText":786,"config":814},{"src":788,"dataGaName":789,"dataGaLocation":784},{"altText":786,"config":816},{"src":817,"dataGaName":789,"dataGaLocation":784},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":819,"mobileIcon":824,"desktopIcon":826},{"text":820,"config":821},"Back to pricing",{"href":554,"dataGaName":822,"dataGaLocation":784,"icon":823},"back to pricing","GoBack",{"altText":786,"config":825},{"src":788,"dataGaName":789,"dataGaLocation":784},{"altText":786,"config":827},{"src":792,"dataGaName":789,"dataGaLocation":784},{"title":829,"titleMobile":830,"button":831,"config":836},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":448,"config":832},{"href":833,"dataGaName":834,"dataGaLocation":835},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":837,"disabled":385},"release",{"data":839},{"text":840,"source":841,"edit":847,"contribute":852,"config":857,"items":862,"minimal":1069},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":842,"config":843},"View page source",{"href":844,"dataGaName":845,"dataGaLocation":846},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":848,"config":849},"Edit this page",{"href":850,"dataGaName":851,"dataGaLocation":846},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":853,"config":854},"Please contribute",{"href":855,"dataGaName":856,"dataGaLocation":846},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":858,"facebook":859,"youtube":860,"linkedin":861},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[863,910,961,1005,1037],{"title":552,"links":864,"subMenu":879},[865,869,874],{"text":866,"config":867},"View plans",{"href":554,"dataGaName":868,"dataGaLocation":846},"view plans",{"text":870,"config":871},"Why Premium?",{"href":872,"dataGaName":873,"dataGaLocation":846},"/pricing/premium/","why premium",{"text":875,"config":876},"Why Ultimate?",{"href":877,"dataGaName":878,"dataGaLocation":846},"/pricing/ultimate/","why ultimate",[880],{"title":881,"links":882},"Contact Us",[883,886,888,890,895,900,905],{"text":884,"config":885},"Contact sales",{"href":736,"dataGaName":416,"dataGaLocation":846},{"text":739,"config":887},{"href":741,"dataGaName":742,"dataGaLocation":846},{"text":744,"config":889},{"href":746,"dataGaName":747,"dataGaLocation":846},{"text":891,"config":892},"Status",{"href":893,"dataGaName":894,"dataGaLocation":846},"https://status.gitlab.com/","status",{"text":896,"config":897},"Terms of use",{"href":898,"dataGaName":899,"dataGaLocation":846},"/terms/","terms of use",{"text":901,"config":902},"Privacy statement",{"href":903,"dataGaName":904,"dataGaLocation":846},"/privacy/","privacy statement",{"text":906,"config":907},"Cookie preferences",{"dataGaName":908,"dataGaLocation":846,"id":909,"isOneTrustButton":388},"cookie preferences","ot-sdk-btn",{"title":453,"links":911,"subMenu":919},[912,915],{"text":398,"config":913},{"href":435,"dataGaName":914,"dataGaLocation":846},"devsecops platform",{"text":916,"config":917},"AI-Assisted Development",{"href":442,"dataGaName":918,"dataGaLocation":846},"ai-assisted development",[920],{"title":921,"links":922},"Topics",[923,926,931,936,941,946,951,956],{"text":924,"config":925},"CICD",{"href":215,"dataGaName":208,"dataGaLocation":846},{"text":927,"config":928},"GitOps",{"href":929,"dataGaName":930,"dataGaLocation":846},"/topics/gitops/","gitops",{"text":932,"config":933},"DevOps",{"href":934,"dataGaName":935,"dataGaLocation":846},"/topics/devops/","devops",{"text":937,"config":938},"Version Control",{"href":939,"dataGaName":940,"dataGaLocation":846},"/topics/version-control/","version control",{"text":942,"config":943},"DevSecOps",{"href":944,"dataGaName":945,"dataGaLocation":846},"/topics/devsecops/","devsecops",{"text":947,"config":948},"Cloud Native",{"href":949,"dataGaName":950,"dataGaLocation":846},"/topics/cloud-native/","cloud native",{"text":952,"config":953},"AI for Coding",{"href":954,"dataGaName":955,"dataGaLocation":846},"/topics/devops/ai-for-coding/","ai for coding",{"text":957,"config":958},"Agentic AI",{"href":959,"dataGaName":960,"dataGaLocation":846},"/topics/agentic-ai/","agentic ai",{"title":962,"links":963},"Solutions",[964,966,968,973,977,980,984,987,989,992,995,1000],{"text":496,"config":965},{"href":491,"dataGaName":496,"dataGaLocation":846},{"text":485,"config":967},{"href":469,"dataGaName":470,"dataGaLocation":846},{"text":969,"config":970},"Agile development",{"href":971,"dataGaName":972,"dataGaLocation":846},"/solutions/agile-delivery/","agile delivery",{"text":974,"config":975},"SCM",{"href":481,"dataGaName":976,"dataGaLocation":846},"source code management",{"text":924,"config":978},{"href":474,"dataGaName":979,"dataGaLocation":846},"continuous integration & delivery",{"text":981,"config":982},"Value stream management",{"href":524,"dataGaName":983,"dataGaLocation":846},"value stream management",{"text":927,"config":985},{"href":986,"dataGaName":930,"dataGaLocation":846},"/solutions/gitops/",{"text":534,"config":988},{"href":537,"dataGaName":538,"dataGaLocation":846},{"text":990,"config":991},"Small business",{"href":543,"dataGaName":544,"dataGaLocation":846},{"text":993,"config":994},"Public sector",{"href":549,"dataGaName":550,"dataGaLocation":846},{"text":996,"config":997},"Education",{"href":998,"dataGaName":999,"dataGaLocation":846},"/solutions/education/","education",{"text":1001,"config":1002},"Financial services",{"href":1003,"dataGaName":1004,"dataGaLocation":846},"/solutions/finance/","financial services",{"title":557,"links":1006},[1007,1009,1011,1013,1016,1018,1021,1023,1025,1027,1029,1031,1033,1035],{"text":570,"config":1008},{"href":572,"dataGaName":573,"dataGaLocation":846},{"text":575,"config":1010},{"href":577,"dataGaName":578,"dataGaLocation":846},{"text":580,"config":1012},{"href":582,"dataGaName":583,"dataGaLocation":846},{"text":585,"config":1014},{"href":587,"dataGaName":1015,"dataGaLocation":846},"docs",{"text":608,"config":1017},{"href":610,"dataGaName":611,"dataGaLocation":846},{"text":1019,"config":1020},"What's new",{"href":668,"dataGaName":669,"dataGaLocation":846},{"text":603,"config":1022},{"href":605,"dataGaName":606,"dataGaLocation":846},{"text":622,"config":1024},{"href":624,"dataGaName":625,"dataGaLocation":846},{"text":630,"config":1026},{"href":632,"dataGaName":633,"dataGaLocation":846},{"text":635,"config":1028},{"href":637,"dataGaName":638,"dataGaLocation":846},{"text":640,"config":1030},{"href":642,"dataGaName":643,"dataGaLocation":846},{"text":645,"config":1032},{"href":647,"dataGaName":648,"dataGaLocation":846},{"text":650,"config":1034},{"href":652,"dataGaName":653,"dataGaLocation":846},{"text":655,"config":1036},{"href":657,"dataGaName":658,"dataGaLocation":846},{"title":671,"links":1038},[1039,1041,1043,1045,1047,1049,1053,1058,1060,1062,1064],{"text":679,"config":1040},{"href":681,"dataGaName":673,"dataGaLocation":846},{"text":684,"config":1042},{"href":686,"dataGaName":687,"dataGaLocation":846},{"text":692,"config":1044},{"href":694,"dataGaName":695,"dataGaLocation":846},{"text":697,"config":1046},{"href":699,"dataGaName":700,"dataGaLocation":846},{"text":702,"config":1048},{"href":704,"dataGaName":705,"dataGaLocation":846},{"text":1050,"config":1051},"Sustainability",{"href":1052,"dataGaName":1050,"dataGaLocation":846},"/sustainability/",{"text":1054,"config":1055},"Diversity, inclusion and belonging (DIB)",{"href":1056,"dataGaName":1057,"dataGaLocation":846},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":707,"config":1059},{"href":709,"dataGaName":710,"dataGaLocation":846},{"text":717,"config":1061},{"href":719,"dataGaName":720,"dataGaLocation":846},{"text":722,"config":1063},{"href":724,"dataGaName":725,"dataGaLocation":846},{"text":1065,"config":1066},"Modern Slavery Transparency Statement",{"href":1067,"dataGaName":1068,"dataGaLocation":846},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1070},[1071,1074,1077],{"text":1072,"config":1073},"Terms",{"href":898,"dataGaName":899,"dataGaLocation":846},{"text":1075,"config":1076},"Cookies",{"dataGaName":908,"dataGaLocation":846,"id":909,"isOneTrustButton":388},{"text":1078,"config":1079},"Privacy",{"href":903,"dataGaName":904,"dataGaLocation":846},[1081],{"id":1082,"title":7,"body":384,"config":1083,"content":1085,"description":384,"extension":1089,"meta":1090,"navigation":388,"path":1091,"seo":1092,"stem":1093,"__hash__":1094},"blogAuthors/en-us/blog/authors/steve-grossman.yml",{"template":1084},"BlogAuthor",{"name":7,"config":1086},{"headshot":1087,"ctfId":1088},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749682744/Blog/Author%20Headshots/Steevo-headshot.jpg","Steevo","yml",{},"/en-us/blog/authors/steve-grossman",{},"en-us/blog/authors/steve-grossman","7B4OLPLLa6CAJbGrt2j42CWJA-gEF1-0UXhRgeN-IzY",[1096,1104,1112],{"title":1097,"description":1098,"heroImage":1099,"category":380,"date":1100,"authors":1101,"slug":1103,"externalUrl":384},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1102],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1105,"description":1106,"heroImage":1099,"category":380,"date":1107,"authors":1108,"slug":1111,"externalUrl":384},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1109,1110],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1113,"description":1114,"heroImage":1115,"category":380,"date":1116,"authors":1117,"slug":1119,"externalUrl":384},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1118],"Alisa Ho","claude-security-and-gitlab",{"promotions":1121},[1122,1136,1148,1159],{"id":1123,"categories":1124,"header":1126,"text":1127,"button":1128,"image":1133},"ai-modernization",[1125],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1129,"config":1130},"Get your AI maturity score",{"href":1131,"dataGaName":1132,"dataGaLocation":611},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1134},{"src":1135},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1137,"categories":1138,"header":1140,"text":1127,"button":1141,"image":1145},"devops-modernization",[1139,945],"product","Are you just managing tools or shipping innovation?",{"text":1142,"config":1143},"Get your DevOps maturity score",{"href":1144,"dataGaName":1132,"dataGaLocation":611},"/assessments/devops-modernization-assessment/",{"config":1146},{"src":1147},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1149,"categories":1150,"header":1151,"text":1127,"button":1152,"image":1156},"security-modernization",[380],"Are you trading speed for security?",{"text":1153,"config":1154},"Get your security maturity score",{"href":1155,"dataGaName":1132,"dataGaLocation":611},"/assessments/security-modernization-assessment/",{"config":1157},{"src":1158},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1160,"paths":1161,"header":1164,"text":1165,"button":1166,"image":1171},"github-azure-migration",[1162,1163],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1167,"config":1168},"See how GitLab compares to GitHub",{"href":1169,"dataGaName":1170,"dataGaLocation":611},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1172},{"src":1147},{"header":1174,"blurb":1175,"button":1176,"secondaryButton":1181},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1177,"config":1178},"Get your free trial",{"href":1179,"dataGaName":411,"dataGaLocation":1180},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":884,"config":1182},{"href":736,"dataGaName":416,"dataGaLocation":1180},1786734867030]