[{"data":1,"prerenderedAt":1367},["ShallowReactive",2],{"/blog/tips-to-configure-browser-based-dast-scans":3,"navigation-en-us":569,"banner-en-us":997,"footer-en-us":1007,"blog-post-authors-en-us-Julie Byrne|Jerez Solis":1252,"blog-related-posts-en-us-tips-to-configure-browser-based-dast-scans":1279,"blog-promotions-en-us":1304,"next-steps-en-us":1357},{"id":4,"title":5,"authors":6,"body":9,"category":548,"date":549,"description":550,"extension":551,"externalUrl":552,"faq":552,"featured":553,"heroImage":554,"meta":555,"navigation":556,"path":557,"seo":558,"slug":562,"stem":563,"tags":564,"template":567,"updatedDate":552,"__hash__":568},"blogPosts/en-us/blog/tips-to-configure-browser-based-dast-scans.md","Tips to configure browser-based DAST scans",[7,8],"Julie Byrne","Jerez Solis",{"type":10,"value":11,"toc":538},"minimark",[12,23,28,55,75,79,82,95,98,101,116,121,124,138,146,155,159,165,182,185,198,205,210,217,227,272,275,307,312,318,321,335,348,371,375,378,384,391,395,398,411,486,502,505,514,518,534],[13,14,15,16,22],"p",{},"The GitLab Dynamic Application Security Testing (",[17,18,21],"a",{"href":19,"rel":20},"https://docs.gitlab.com/user/application_security/dast/",[],"DAST",") scan uses an actively running environment to crawl the application and find misconfigurations of your application server or incorrect assumptions about security controls that may not be visible from the source code. GitLab now provides a proprietary browser-based analyzer for scanning applications that make heavy use of JavaScript, including single-page web applications. The DAST scan needs to be configured properly to account for various web application attributes, including authentication mechanism, authenticated landing page, and page load times. In this tutorial, you will learn common configurations that have helped our customers use the browser-based analyzer to successfully implement DAST scans.",[24,25,27],"h2",{"id":26},"general-considerations","General considerations",[13,29,30,31,35,36,39,40,45,46,48,49,54],{},"The browser-based DAST scan takes the URL of the application it's supposed to scan from the ",[32,33,34],"code",{},"DAST_WEBSITE"," environment variable. This should point to a test environment - you should not run a DAST scan against a production environment, even if you are only running a passive scan. For ephemeral environments that are deployed as part of the CI/CD pipeline, you can save the URL of the environment as an artifact ",[32,37,38],{},"environment_url.txt",", which will then be used by the ",[17,41,44],{"href":42,"rel":43},"https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/DAST.gitlab-ci.yml",[],"DAST scan template job"," to set the ",[32,47,34],{}," variable.  The ",[17,50,53],{"href":51,"rel":52},"https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml",[],"GitLab Auto DevOps deploy template job"," has an example of this.",[13,56,57,58,63,64,69,70,74],{},"Depending on the size of the web application, a DAST scan may take an hour or more to complete. You will want to ensure that whatever runner is used to perform the DAST scan has a ",[17,59,62],{"href":60,"rel":61},"https://docs.gitlab.com/ci/runners/configure_runners/#set-maximum-job-timeout-for-a-runner",[],"job timeout value"," set to be long enough to allow the scan to complete. Similarly, you should ensure that the ",[17,65,68],{"href":66,"rel":67},"https://docs.gitlab.com/ci/pipelines/settings/#set-a-limit-for-how-long-jobs-can-run",[],"project level CI/CD timeout"," is sufficient to allow the job to complete. ",[71,72,73],"strong",{},"Note:"," Shared runners on gitlab.com have a runner timeout of 180 minutes, regardless of the project CI/CD timeout set.",[24,76,78],{"id":77},"configuration-options-for-websites-requiring-authentication","Configuration options for websites requiring authentication",[13,80,81],{},"Many web applications require a user to log in to access the site. Logins can be implemented as basic http authentication or, more commonly, as form authentication.  For form authentication, the login form might be implemented in one of several ways:",[83,84,85,89,92],"ol",{},[86,87,88],"li",{},"username and password fields on the main website landing page",[86,90,91],{},"a login button that opens a modal (also called a modal window or lightbox) that displays in front of the page and disables all other page content until the login is completed or the modal is closed; there is not a separate URL associated with a modal window",[86,93,94],{},"a login button that opens a new window, with its own URL",[13,96,97],{},"Additionally, the form may be either a single-step form, where the username and password fields are on the same page, or a multi-step form, where the username and password fields are on separate pages.",[13,99,100],{},"When running a DAST scan, the analyzer must know how to authenticate.  We need to specify these details via the appropriate variables.",[13,102,103,104,107,108,111,112,115],{},"The ",[32,105,106],{},"DAST_USERNAME"," and ",[32,109,110],{},"DAST_PASSWORD"," variables specify the login credentials to be used. The variable values should be set via masked variables at the project level, not included within the ",[32,113,114],{},".gitlab-ci.yml"," file.",[117,118,120],"h3",{"id":119},"url-variable-values","URL variable values",[13,122,123],{},"Various URL values must also be specified:",[125,126,127,133],"ul",{},[86,128,129,132],{},[32,130,131],{},"DAST_AUTH_URL"," - the URL of the login page",[86,134,135,137],{},[32,136,34],{}," - specifies the URL of the page the user is redirected to after logging in",[13,139,140,142,143,145],{},[71,141,73],{}," If your website uses authentication with a login button that opens a new window with its own URL, you should specify the URL of that new window as the ",[32,144,131],{}," value.",[13,147,148,149,154],{},"GitLab enhancements are currently being implemented to support cases where additional actions must be taken post-login prior to being brought to the main site. See ",[17,150,153],{"href":151,"rel":152},"https://gitlab.com/groups/gitlab-org/-/epics/11585",[],"this epic","  for details: DAST browser-based analyzer multi-step login form does not support 'keep me signed in' workflow (AzureAD).",[117,156,158],{"id":157},"field-variable-values","Field variable values",[13,160,161,164],{},[32,162,163],{},"FIELD"," variables specify the page elements used. These values can typically be identified by inspecting the page source. For single-step login pages, you will need to specify:",[125,166,167,172,177],{},[86,168,169],{},[32,170,171],{},"DAST_USERNAME_FIELD",[86,173,174],{},[32,175,176],{},"DAST_PASSWORD_FIELD",[86,178,179],{},[32,180,181],{},"DAST_SUBMIT_FIELD",[13,183,184],{},"For multi-step logins, you would instead specify:",[125,186,187,193],{},[86,188,189,192],{},[32,190,191],{},"DAST_FIRST_SUBMIT_FIELD"," - the button clicked after entering the username",[86,194,195,197],{},[32,196,181],{}," - the button clicked after entering the password",[13,199,200,201,204],{},"If your login button opens a modal, you should also specify ",[32,202,203],{},"DAST_BROWSER_PATH_TO_LOGIN_FORM",", which provides the path of elements to click to get from the initial login URL to the login fields.",[206,207,209],"h4",{"id":208},"examples","Examples",[13,211,212],{},[213,214],"img",{"alt":215,"src":216},"username email field","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749683113/Blog/Content%20Images/username_email_field.png",[13,218,219,220,107,223,226],{},"In this example, you can target the input element for the username field in different ways. Keep in mind that the selector you chose should be resilient to the application changing. We recommend to use the ",[32,221,222],{},"id",[32,224,225],{},"name"," attributes, as these are generally unique on a page and rarely change.",[228,229,234],"pre",{"className":230,"code":231,"language":232,"meta":233,"style":233},"language-yaml shiki shiki-themes github-light","DAST_USERNAME_FIELD: \"id:user_login\"\nDAST_USERNAME_FIELD: \"name:user[login]\"\nDAST_USERNAME_FIELD: \"css:input[type=text]\"\n","yaml","",[32,235,236,252,262],{"__ignoreMap":233},[237,238,241,244,248],"span",{"class":239,"line":240},"line",1,[237,242,171],{"class":243},"shJU0",[237,245,247],{"class":246},"sgsFI",": ",[237,249,251],{"class":250},"sYBdl","\"id:user_login\"\n",[237,253,255,257,259],{"class":239,"line":254},2,[237,256,171],{"class":243},[237,258,247],{"class":246},[237,260,261],{"class":250},"\"name:user[login]\"\n",[237,263,265,267,269],{"class":239,"line":264},3,[237,266,171],{"class":243},[237,268,247],{"class":246},[237,270,271],{"class":250},"\"css:input[type=text]\"\n",[13,273,274],{},"The same process can be followed for the password field. For example:",[228,276,278],{"className":230,"code":277,"language":232,"meta":233,"style":233},"DAST_PASSWORD_FIELD: \"id:user_password\"\nDAST_PASSWORD_FIELD: \"name:user[password]\"\nDAST_PASSWORD_FIELD: \"css:input[type=password]\"\n",[32,279,280,289,298],{"__ignoreMap":233},[237,281,282,284,286],{"class":239,"line":240},[237,283,176],{"class":243},[237,285,247],{"class":246},[237,287,288],{"class":250},"\"id:user_password\"\n",[237,290,291,293,295],{"class":239,"line":254},[237,292,176],{"class":243},[237,294,247],{"class":246},[237,296,297],{"class":250},"\"name:user[password]\"\n",[237,299,300,302,304],{"class":239,"line":264},[237,301,176],{"class":243},[237,303,247],{"class":246},[237,305,306],{"class":250},"\"css:input[type=password]\"\n",[13,308,309],{},[71,310,311],{},"Submit/Sign in/Login button",[13,313,314],{},[213,315],{"alt":316,"src":317},"login","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749683114/Blog/Content%20Images/login.png",[13,319,320],{},"You can target the submit/sign in/login button using this selector:",[228,322,324],{"className":230,"code":323,"language":232,"meta":233,"style":233},"DAST_SUBMIT_FIELD: \"css:button[type=submit]\"\n",[32,325,326],{"__ignoreMap":233},[237,327,328,330,332],{"class":239,"line":240},[237,329,181],{"class":243},[237,331,247],{"class":246},[237,333,334],{"class":250},"\"css:button[type=submit]\"\n",[13,336,337,339,340,343,344,347],{},[71,338,73],{}," If the submit button is not a ",[32,341,342],{},"\u003Cbutton>",", but an input element in the form of ",[32,345,346],{},"\u003Cinput type=\"submit\" name=\"login\">",", you can use one of the following selectors:",[228,349,351],{"className":230,"code":350,"language":232,"meta":233,"style":233},"DAST_SUBMIT_FIELD: \"css:input[type=submit]\"\nDAST_SUBMIT_FIELD: \"css:input[name=login]\"\n",[32,352,353,362],{"__ignoreMap":233},[237,354,355,357,359],{"class":239,"line":240},[237,356,181],{"class":243},[237,358,247],{"class":246},[237,360,361],{"class":250},"\"css:input[type=submit]\"\n",[237,363,364,366,368],{"class":239,"line":254},[237,365,181],{"class":243},[237,367,247],{"class":246},[237,369,370],{"class":250},"\"css:input[name=login]\"\n",[117,372,374],{"id":373},"other-variables-to-set","Other variables to set",[13,376,377],{},"If the username and password fields are on separate pages, DAST has to wait after submitting the username before looking for the password field.",[13,379,103,380,383],{},[32,381,382],{},"DAST_BROWSER_ACTION_STABILITY_TIMEOUT"," variable, with a default value of 800ms, specifies the wait time. This time can be increased if the login response time is slow.",[13,385,386,387,390],{},"If the website has a large JavaScript file that is required to load the target application, it is recommended that you use the variable ",[32,388,389],{},"DAST_BROWSER_MAX_RESPONSE_SIZE_MB"," to increase the limit for response sizes. The default is 10MB but can be increased for 50MB or more, if necessary.",[24,392,394],{"id":393},"tools-for-troubleshooting","Tools for troubleshooting",[13,396,397],{},"Several tools will help with DAST scan troubleshooting:",[125,399,400],{},[86,401,402,403,406,407,410],{},"authentication report - This report can be produced during the scan and saved as a CI/CD job artifact to assist with understanding the cause of an authentication failure. The report contains steps performed during the login process, HTTP requests and responses, the Document Object Model (DOM), and screenshots. To configure the report, set ",[32,404,405],{},"DAST_AUTH_REPORT"," to ",[32,408,409],{},"true"," and configure an artifacts attribute for the DAST job, e.g.:",[228,412,414],{"className":230,"code":413,"language":232,"meta":233,"style":233},"dast:\n   variables:\n      DAST_WEBSITE: \"https://example.com\"\n      DAST_AUTH_REPORT: \"true\"\n    artifacts:\n      paths: [gl-dast-debug-auth-report.html]\n      when: always\n\n",[32,415,416,424,431,441,452,460,475],{"__ignoreMap":233},[237,417,418,421],{"class":239,"line":240},[237,419,420],{"class":243},"dast",[237,422,423],{"class":246},":\n",[237,425,426,429],{"class":239,"line":254},[237,427,428],{"class":243},"   variables",[237,430,423],{"class":246},[237,432,433,436,438],{"class":239,"line":264},[237,434,435],{"class":243},"      DAST_WEBSITE",[237,437,247],{"class":246},[237,439,440],{"class":250},"\"https://example.com\"\n",[237,442,444,447,449],{"class":239,"line":443},4,[237,445,446],{"class":243},"      DAST_AUTH_REPORT",[237,448,247],{"class":246},[237,450,451],{"class":250},"\"true\"\n",[237,453,455,458],{"class":239,"line":454},5,[237,456,457],{"class":243},"    artifacts",[237,459,423],{"class":246},[237,461,463,466,469,472],{"class":239,"line":462},6,[237,464,465],{"class":243},"      paths",[237,467,468],{"class":246},": [",[237,470,471],{"class":250},"gl-dast-debug-auth-report.html",[237,473,474],{"class":246},"]\n",[237,476,478,481,483],{"class":239,"line":477},7,[237,479,480],{"class":243},"      when",[237,482,247],{"class":246},[237,484,485],{"class":250},"always\n",[125,487,488],{},[86,489,490,491,406,494,497,498,501],{},"analyzer logs - Setting ",[32,492,493],{},"DAST_BROWSER_LOG",[32,495,496],{},"auth:debug"," or ",[32,499,500],{},"auth:trace"," will provide additional logging that may help identify an issue with the scan.",[13,503,504],{},"The browser-based DAST scan configuration depends on the specific attributes of the web application you're testing, including how authentication is implemented to access the web site, what buttons are used, and how fast your browser loads once the user has authenticated. Using the appropriate variables to guide the analyzer through the authentication process will ensure that you are able to run a successful scan. And robust error logging and the authentication report will provide additional pointers to where the configuration might be incorrect and need to be adjusted.",[13,506,507,508,513],{},"Try DAST scanning with ",[17,509,512],{"href":510,"rel":511},"https://about.gitlab.com/free-trial/",[],"a free trial of GitLab Ultimate",".",[24,515,517],{"id":516},"read-more","Read more",[125,519,520,527],{},[86,521,522],{},[17,523,526],{"href":524,"rel":525},"https://about.gitlab.com/blog/how-to-configure-dast-full-scans-for-complex-web-applications/",[],"How to configure DAST full scans for complex web applications",[86,528,529],{},[17,530,533],{"href":531,"rel":532},"https://about.gitlab.com/blog/how-were-using-dast2-for-easier-scan-configuration/",[],"How we're using DAST 2 for easier scan configuration",[535,536,537],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":233,"searchDepth":254,"depth":254,"links":539},[540,541,546,547],{"id":26,"depth":254,"text":27},{"id":77,"depth":254,"text":78,"children":542},[543,544,545],{"id":119,"depth":264,"text":120},{"id":157,"depth":264,"text":158},{"id":373,"depth":264,"text":374},{"id":393,"depth":254,"text":394},{"id":516,"depth":254,"text":517},"security","2023-11-14","Learn how to use the browser-based analyzer with common dynamic application security testing settings, based on web application attributes, to ensure successful scans.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659561/Blog/Hero%20Images/securitycheck.png",{},true,"/en-us/blog/tips-to-configure-browser-based-dast-scans",{"title":5,"description":550,"ogTitle":5,"ogDescription":550,"noIndex":553,"ogImage":554,"ogUrl":559,"ogSiteName":560,"ogType":561,"canonicalUrls":559},"https://about.gitlab.com/blog/tips-to-configure-browser-based-dast-scans","https://about.gitlab.com","article","tips-to-configure-browser-based-dast-scans","en-us/blog/tips-to-configure-browser-based-dast-scans",[548,565,565,566],"testing","tutorial","BlogPost","g9Ejc8bqOefUevBWDkiBvJjw_SeRYgSeVBH53gTXRmY",{"logo":570,"freeTrial":575,"sales":580,"login":585,"items":590,"search":917,"minimal":948,"duo":967,"switchNav":976,"pricingDeployment":987},{"config":571},{"href":572,"dataGaName":573,"dataGaLocation":574},"/","gitlab logo","header",{"text":576,"config":577},"Get free trial",{"href":578,"dataGaName":579,"dataGaLocation":574},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":581,"config":582},"Request a demo",{"href":583,"dataGaName":584,"dataGaLocation":574},"/sales/?contact-topic=request-demo","sales",{"text":586,"config":587},"Sign in",{"href":588,"dataGaName":589,"dataGaLocation":574},"https://gitlab.com/users/sign_in/","sign in",[591,620,720,725,839,895],{"text":592,"config":593,"menu":595},"Platform",{"dataNavLevelOne":594},"platform",{"type":596,"columns":597},"cards",[598,604,612],{"title":592,"description":599,"link":600},"The intelligent orchestration platform for DevSecOps",{"text":601,"config":602},"Explore our Platform",{"href":603,"dataGaName":594,"dataGaLocation":574},"/platform/",{"title":605,"description":606,"link":607},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":608,"config":609},"Meet GitLab Duo",{"href":610,"dataGaName":611,"dataGaLocation":574},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":613,"description":614,"link":615},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":616,"config":617},"Learn more",{"href":618,"dataGaName":619,"dataGaLocation":574},"/why-gitlab/","why gitlab",{"text":621,"left":556,"config":622,"menu":624},"Product",{"dataNavLevelOne":623},"solutions",{"type":625,"link":626,"columns":630,"feature":699},"lists",{"text":627,"config":628},"View all Solutions",{"href":629,"dataGaName":623,"dataGaLocation":574},"/solutions/",[631,655,678],{"title":632,"description":633,"link":634,"items":639},"Automation","CI/CD and automation to accelerate deployment",{"config":635},{"icon":636,"href":637,"dataGaName":638,"dataGaLocation":574},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[640,644,647,651],{"text":641,"config":642},"CI/CD",{"href":643,"dataGaLocation":574,"dataGaName":641},"/solutions/continuous-integration/",{"text":605,"config":645},{"href":610,"dataGaLocation":574,"dataGaName":646},"gitlab duo agent platform - product menu",{"text":648,"config":649},"Source Code Management",{"href":650,"dataGaLocation":574,"dataGaName":648},"/solutions/source-code-management/",{"text":652,"config":653},"Automated Software Delivery",{"href":637,"dataGaLocation":574,"dataGaName":654},"Automated software delivery",{"title":656,"description":657,"link":658,"items":663},"Security","Deliver code faster without compromising security",{"config":659},{"href":660,"dataGaName":661,"dataGaLocation":574,"icon":662},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[664,668,673],{"text":665,"config":666},"Application Security Testing",{"href":660,"dataGaName":667,"dataGaLocation":574},"Application security testing",{"text":669,"config":670},"Software Supply Chain Security",{"href":671,"dataGaLocation":574,"dataGaName":672},"/solutions/supply-chain/","Software supply chain security",{"text":674,"config":675},"Software Compliance",{"href":676,"dataGaName":677,"dataGaLocation":574},"/solutions/software-compliance/","software compliance",{"title":679,"link":680,"items":685},"Measurement",{"config":681},{"icon":682,"href":683,"dataGaName":684,"dataGaLocation":574},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[686,690,694],{"text":687,"config":688},"Visibility & Measurement",{"href":683,"dataGaLocation":574,"dataGaName":689},"Visibility and Measurement",{"text":691,"config":692},"Value Stream Management",{"href":693,"dataGaLocation":574,"dataGaName":691},"/solutions/value-stream-management/",{"text":695,"config":696},"Analytics & Insights",{"href":697,"dataGaLocation":574,"dataGaName":698},"/solutions/analytics-and-insights/","Analytics and insights",{"title":700,"type":625,"items":701},"GitLab for",[702,708,714],{"text":703,"config":704},"Enterprise",{"icon":705,"href":706,"dataGaLocation":574,"dataGaName":707},"Building","/enterprise/","enterprise",{"text":709,"config":710},"Small Business",{"icon":711,"href":712,"dataGaLocation":574,"dataGaName":713},"Work","/small-business/","small business",{"text":715,"config":716},"Public Sector",{"icon":717,"href":718,"dataGaLocation":574,"dataGaName":719},"Organization","/solutions/public-sector/","public sector",{"text":721,"config":722},"Pricing",{"href":723,"dataGaName":724,"dataGaLocation":574,"dataNavLevelOne":724},"/pricing/","pricing",{"text":726,"config":727,"menu":729},"Resources",{"dataNavLevelOne":728},"resources",{"type":625,"link":730,"columns":734,"feature":828},{"text":731,"config":732},"View all resources",{"href":733,"dataGaName":728,"dataGaLocation":574},"/resources/",[735,768,795],{"title":736,"items":737},"Getting started",[738,743,748,753,758,763],{"text":739,"config":740},"Install",{"href":741,"dataGaName":742,"dataGaLocation":574},"/install/","install",{"text":744,"config":745},"Quick start guides",{"href":746,"dataGaName":747,"dataGaLocation":574},"/get-started/","quick setup checklists",{"text":749,"config":750},"Learn",{"href":751,"dataGaLocation":574,"dataGaName":752},"https://university.gitlab.com/","learn",{"text":754,"config":755},"Product documentation",{"href":756,"dataGaName":757,"dataGaLocation":574},"https://docs.gitlab.com/","product documentation",{"text":759,"config":760},"Best practice videos",{"href":761,"dataGaName":762,"dataGaLocation":574},"/getting-started-videos/","best practice videos",{"text":764,"config":765},"Integrations",{"href":766,"dataGaName":767,"dataGaLocation":574},"/integrations/","integrations",{"title":769,"items":770},"Discover",[771,776,781,786,790],{"text":772,"config":773},"Customer success stories",{"href":774,"dataGaName":775,"dataGaLocation":574},"/customers/","customer success stories",{"text":777,"config":778},"Blog",{"href":779,"dataGaName":780,"dataGaLocation":574},"/blog/","blog",{"text":782,"config":783},"Demo Hub",{"href":784,"dataGaName":785,"dataGaLocation":574},"/demo-hub/","demo hub",{"text":787,"config":788},"The Source",{"href":789,"dataGaName":780,"dataGaLocation":574},"/the-source/",{"text":791,"config":792},"Remote",{"href":793,"dataGaName":794,"dataGaLocation":574},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":796,"items":797},"Connect",[798,803,808,813,818,823],{"text":799,"config":800},"GitLab Services",{"href":801,"dataGaName":802,"dataGaLocation":574},"/services/","services",{"text":804,"config":805},"Contribute",{"href":806,"dataGaName":807,"dataGaLocation":574},"https://contributors.gitlab.com","contribute",{"text":809,"config":810},"Community",{"href":811,"dataGaName":812,"dataGaLocation":574},"/community/","community",{"text":814,"config":815},"Forum",{"href":816,"dataGaName":817,"dataGaLocation":574},"https://forum.gitlab.com/","forum",{"text":819,"config":820},"Events",{"href":821,"dataGaName":822,"dataGaLocation":574},"/events/","events",{"text":824,"config":825},"Partners",{"href":826,"dataGaName":827,"dataGaLocation":574},"/partners/","partners",{"config":829,"title":832,"text":833,"link":834},{"background":830,"textColor":831},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":835,"config":836},"Read the latest",{"href":837,"dataGaName":838,"dataGaLocation":574},"/whats-new/","whats new",{"text":840,"config":841,"menu":843},"Company",{"dataNavLevelOne":842},"company",{"type":625,"columns":844},[845],{"items":846},[847,852,858,860,865,870,875,880,885,890],{"text":848,"config":849},"About",{"href":850,"dataGaName":851,"dataGaLocation":574},"/company/","about",{"text":853,"config":854,"footerGa":857},"Jobs",{"href":855,"dataGaName":856,"dataGaLocation":574},"/jobs/","jobs",{"dataGaName":856},{"text":819,"config":859},{"href":821,"dataGaName":822,"dataGaLocation":574},{"text":861,"config":862},"Leadership",{"href":863,"dataGaName":864,"dataGaLocation":574},"/company/team/e-group/","leadership",{"text":866,"config":867},"Handbook",{"href":868,"dataGaName":869,"dataGaLocation":574},"https://handbook.gitlab.com/","handbook",{"text":871,"config":872},"Investor relations",{"href":873,"dataGaName":874,"dataGaLocation":574},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":876,"config":877},"Trust Center",{"href":878,"dataGaName":879,"dataGaLocation":574},"/security/","trust center",{"text":881,"config":882},"AI Transparency Center",{"href":883,"dataGaName":884,"dataGaLocation":574},"/ai-transparency-center/","ai transparency center",{"text":886,"config":887},"Newsletter",{"href":888,"dataGaName":889,"dataGaLocation":574},"/company/contact/#contact-forms","newsletter",{"text":891,"config":892},"Press",{"href":893,"dataGaName":894,"dataGaLocation":574},"/press/","press",{"text":896,"config":897,"menu":898},"Contact us",{"dataNavLevelOne":842},{"type":625,"columns":899},[900],{"items":901},[902,907,912],{"text":903,"config":904},"Talk to sales",{"href":905,"dataGaName":906,"dataGaLocation":574},"/sales/","talk to sales",{"text":908,"config":909},"Support portal",{"href":910,"dataGaName":911,"dataGaLocation":574},"https://support.gitlab.com/hc/en-us","support portal",{"text":913,"config":914},"Customer portal",{"href":915,"dataGaName":916,"dataGaLocation":574},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":918,"login":919,"suggestions":926},"Close",{"text":920,"link":921},"To search repositories and projects, login to",{"text":922,"config":923},"gitlab.com",{"href":588,"dataGaName":924,"dataGaLocation":925},"search login","search",{"text":927,"default":928},"Suggestions",[929,931,935,937,941,945],{"text":605,"config":930},{"href":610,"dataGaName":605,"dataGaLocation":925},{"text":932,"config":933},"Code Suggestions (AI)",{"href":934,"dataGaName":932,"dataGaLocation":925},"/solutions/code-suggestions/",{"text":641,"config":936},{"href":643,"dataGaName":641,"dataGaLocation":925},{"text":938,"config":939},"GitLab on AWS",{"href":940,"dataGaName":938,"dataGaLocation":925},"/partners/technology-partners/aws/",{"text":942,"config":943},"GitLab on Google Cloud",{"href":944,"dataGaName":942,"dataGaLocation":925},"/partners/technology-partners/google-cloud-platform/",{"text":946,"config":947},"Why GitLab?",{"href":618,"dataGaName":946,"dataGaLocation":925},{"freeTrial":949,"mobileIcon":954,"desktopIcon":959,"secondaryButton":962},{"text":950,"config":951},"Start free trial",{"href":952,"dataGaName":579,"dataGaLocation":953},"https://gitlab.com/-/trials/new/","nav",{"altText":955,"config":956},"Gitlab Icon",{"src":957,"dataGaName":958,"dataGaLocation":953},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":955,"config":960},{"src":961,"dataGaName":958,"dataGaLocation":953},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":963,"config":964},"Get Started",{"href":965,"dataGaName":966,"dataGaLocation":953},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":968,"mobileIcon":972,"desktopIcon":974},{"text":969,"config":970},"Learn more about GitLab Duo",{"href":610,"dataGaName":971,"dataGaLocation":953},"gitlab duo",{"altText":955,"config":973},{"src":957,"dataGaName":958,"dataGaLocation":953},{"altText":955,"config":975},{"src":961,"dataGaName":958,"dataGaLocation":953},{"button":977,"mobileIcon":982,"desktopIcon":984},{"text":978,"config":979},"/switch",{"href":980,"dataGaName":981,"dataGaLocation":953},"#contact","switch",{"altText":955,"config":983},{"src":957,"dataGaName":958,"dataGaLocation":953},{"altText":955,"config":985},{"src":986,"dataGaName":958,"dataGaLocation":953},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":988,"mobileIcon":993,"desktopIcon":995},{"text":989,"config":990},"Back to pricing",{"href":723,"dataGaName":991,"dataGaLocation":953,"icon":992},"back to pricing","GoBack",{"altText":955,"config":994},{"src":957,"dataGaName":958,"dataGaLocation":953},{"altText":955,"config":996},{"src":961,"dataGaName":958,"dataGaLocation":953},{"title":998,"titleMobile":999,"button":1000,"config":1005},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":616,"config":1001},{"href":1002,"dataGaName":1003,"dataGaLocation":1004},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1006,"disabled":553},"release",{"data":1008},{"text":1009,"source":1010,"edit":1016,"contribute":1021,"config":1026,"items":1031,"minimal":1241},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1011,"config":1012},"View page source",{"href":1013,"dataGaName":1014,"dataGaLocation":1015},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1017,"config":1018},"Edit this page",{"href":1019,"dataGaName":1020,"dataGaLocation":1015},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1022,"config":1023},"Please contribute",{"href":1024,"dataGaName":1025,"dataGaLocation":1015},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1027,"facebook":1028,"youtube":1029,"linkedin":1030},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1032,1079,1133,1177,1209],{"title":721,"links":1033,"subMenu":1048},[1034,1038,1043],{"text":1035,"config":1036},"View plans",{"href":723,"dataGaName":1037,"dataGaLocation":1015},"view plans",{"text":1039,"config":1040},"Why Premium?",{"href":1041,"dataGaName":1042,"dataGaLocation":1015},"/pricing/premium/","why premium",{"text":1044,"config":1045},"Why Ultimate?",{"href":1046,"dataGaName":1047,"dataGaLocation":1015},"/pricing/ultimate/","why ultimate",[1049],{"title":1050,"links":1051},"Contact Us",[1052,1055,1057,1059,1064,1069,1074],{"text":1053,"config":1054},"Contact sales",{"href":905,"dataGaName":584,"dataGaLocation":1015},{"text":908,"config":1056},{"href":910,"dataGaName":911,"dataGaLocation":1015},{"text":913,"config":1058},{"href":915,"dataGaName":916,"dataGaLocation":1015},{"text":1060,"config":1061},"Status",{"href":1062,"dataGaName":1063,"dataGaLocation":1015},"https://status.gitlab.com/","status",{"text":1065,"config":1066},"Terms of use",{"href":1067,"dataGaName":1068,"dataGaLocation":1015},"/terms/","terms of use",{"text":1070,"config":1071},"Privacy statement",{"href":1072,"dataGaName":1073,"dataGaLocation":1015},"/privacy/","privacy statement",{"text":1075,"config":1076},"Cookie preferences",{"dataGaName":1077,"dataGaLocation":1015,"id":1078,"isOneTrustButton":556},"cookie preferences","ot-sdk-btn",{"title":621,"links":1080,"subMenu":1089},[1081,1085],{"text":1082,"config":1083},"DevSecOps platform",{"href":603,"dataGaName":1084,"dataGaLocation":1015},"devsecops platform",{"text":1086,"config":1087},"AI-Assisted Development",{"href":610,"dataGaName":1088,"dataGaLocation":1015},"ai-assisted development",[1090],{"title":1091,"links":1092},"Topics",[1093,1098,1103,1108,1113,1118,1123,1128],{"text":1094,"config":1095},"CICD",{"href":1096,"dataGaName":1097,"dataGaLocation":1015},"/topics/ci-cd/","cicd",{"text":1099,"config":1100},"GitOps",{"href":1101,"dataGaName":1102,"dataGaLocation":1015},"/topics/gitops/","gitops",{"text":1104,"config":1105},"DevOps",{"href":1106,"dataGaName":1107,"dataGaLocation":1015},"/topics/devops/","devops",{"text":1109,"config":1110},"Version Control",{"href":1111,"dataGaName":1112,"dataGaLocation":1015},"/topics/version-control/","version control",{"text":1114,"config":1115},"DevSecOps",{"href":1116,"dataGaName":1117,"dataGaLocation":1015},"/topics/devsecops/","devsecops",{"text":1119,"config":1120},"Cloud Native",{"href":1121,"dataGaName":1122,"dataGaLocation":1015},"/topics/cloud-native/","cloud native",{"text":1124,"config":1125},"AI for Coding",{"href":1126,"dataGaName":1127,"dataGaLocation":1015},"/topics/devops/ai-for-coding/","ai for coding",{"text":1129,"config":1130},"Agentic AI",{"href":1131,"dataGaName":1132,"dataGaLocation":1015},"/topics/agentic-ai/","agentic ai",{"title":1134,"links":1135},"Solutions",[1136,1138,1140,1145,1149,1152,1156,1159,1161,1164,1167,1172],{"text":665,"config":1137},{"href":660,"dataGaName":665,"dataGaLocation":1015},{"text":654,"config":1139},{"href":637,"dataGaName":638,"dataGaLocation":1015},{"text":1141,"config":1142},"Agile development",{"href":1143,"dataGaName":1144,"dataGaLocation":1015},"/solutions/agile-delivery/","agile delivery",{"text":1146,"config":1147},"SCM",{"href":650,"dataGaName":1148,"dataGaLocation":1015},"source code management",{"text":1094,"config":1150},{"href":643,"dataGaName":1151,"dataGaLocation":1015},"continuous integration & delivery",{"text":1153,"config":1154},"Value stream management",{"href":693,"dataGaName":1155,"dataGaLocation":1015},"value stream management",{"text":1099,"config":1157},{"href":1158,"dataGaName":1102,"dataGaLocation":1015},"/solutions/gitops/",{"text":703,"config":1160},{"href":706,"dataGaName":707,"dataGaLocation":1015},{"text":1162,"config":1163},"Small business",{"href":712,"dataGaName":713,"dataGaLocation":1015},{"text":1165,"config":1166},"Public sector",{"href":718,"dataGaName":719,"dataGaLocation":1015},{"text":1168,"config":1169},"Education",{"href":1170,"dataGaName":1171,"dataGaLocation":1015},"/solutions/education/","education",{"text":1173,"config":1174},"Financial services",{"href":1175,"dataGaName":1176,"dataGaLocation":1015},"/solutions/finance/","financial services",{"title":726,"links":1178},[1179,1181,1183,1185,1188,1190,1193,1195,1197,1199,1201,1203,1205,1207],{"text":739,"config":1180},{"href":741,"dataGaName":742,"dataGaLocation":1015},{"text":744,"config":1182},{"href":746,"dataGaName":747,"dataGaLocation":1015},{"text":749,"config":1184},{"href":751,"dataGaName":752,"dataGaLocation":1015},{"text":754,"config":1186},{"href":756,"dataGaName":1187,"dataGaLocation":1015},"docs",{"text":777,"config":1189},{"href":779,"dataGaName":780,"dataGaLocation":1015},{"text":1191,"config":1192},"What's new",{"href":837,"dataGaName":838,"dataGaLocation":1015},{"text":772,"config":1194},{"href":774,"dataGaName":775,"dataGaLocation":1015},{"text":791,"config":1196},{"href":793,"dataGaName":794,"dataGaLocation":1015},{"text":799,"config":1198},{"href":801,"dataGaName":802,"dataGaLocation":1015},{"text":804,"config":1200},{"href":806,"dataGaName":807,"dataGaLocation":1015},{"text":809,"config":1202},{"href":811,"dataGaName":812,"dataGaLocation":1015},{"text":814,"config":1204},{"href":816,"dataGaName":817,"dataGaLocation":1015},{"text":819,"config":1206},{"href":821,"dataGaName":822,"dataGaLocation":1015},{"text":824,"config":1208},{"href":826,"dataGaName":827,"dataGaLocation":1015},{"title":840,"links":1210},[1211,1213,1215,1217,1219,1221,1225,1230,1232,1234,1236],{"text":848,"config":1212},{"href":850,"dataGaName":842,"dataGaLocation":1015},{"text":853,"config":1214},{"href":855,"dataGaName":856,"dataGaLocation":1015},{"text":861,"config":1216},{"href":863,"dataGaName":864,"dataGaLocation":1015},{"text":866,"config":1218},{"href":868,"dataGaName":869,"dataGaLocation":1015},{"text":871,"config":1220},{"href":873,"dataGaName":874,"dataGaLocation":1015},{"text":1222,"config":1223},"Sustainability",{"href":1224,"dataGaName":1222,"dataGaLocation":1015},"/sustainability/",{"text":1226,"config":1227},"Diversity, inclusion and belonging (DIB)",{"href":1228,"dataGaName":1229,"dataGaLocation":1015},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":876,"config":1231},{"href":878,"dataGaName":879,"dataGaLocation":1015},{"text":886,"config":1233},{"href":888,"dataGaName":889,"dataGaLocation":1015},{"text":891,"config":1235},{"href":893,"dataGaName":894,"dataGaLocation":1015},{"text":1237,"config":1238},"Modern Slavery Transparency Statement",{"href":1239,"dataGaName":1240,"dataGaLocation":1015},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1242},[1243,1246,1249],{"text":1244,"config":1245},"Terms",{"href":1067,"dataGaName":1068,"dataGaLocation":1015},{"text":1247,"config":1248},"Cookies",{"dataGaName":1077,"dataGaLocation":1015,"id":1078,"isOneTrustButton":556},{"text":1250,"config":1251},"Privacy",{"href":1072,"dataGaName":1073,"dataGaLocation":1015},[1253,1267],{"id":1254,"title":7,"body":552,"config":1255,"content":1257,"description":552,"extension":1261,"meta":1262,"navigation":556,"path":1263,"seo":1264,"stem":1265,"__hash__":1266},"blogAuthors/en-us/blog/authors/julie-byrne.yml",{"template":1256},"BlogAuthor",{"name":7,"config":1258},{"headshot":1259,"ctfId":1260},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669432/Blog/Author%20Headshots/juliebyrne.jpg","3SaRWyz0u889xiq6rZkCO","yml",{},"/en-us/blog/authors/julie-byrne",{},"en-us/blog/authors/julie-byrne","ah5NLMVkha_1IgTyOVEpcgM8Ni6s0eBt7Z7r68WGukI",{"id":1268,"title":8,"body":552,"config":1269,"content":1270,"description":552,"extension":1261,"meta":1274,"navigation":556,"path":1275,"seo":1276,"stem":1277,"__hash__":1278},"blogAuthors/en-us/blog/authors/jerez-solis.yml",{"template":1256},{"name":8,"config":1271},{"headshot":1272,"ctfId":1273},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749664494/Blog/Author%20Headshots/jerezsolis.jpg","1Tx8fzD6QQglwxBTAlwAOZ",{},"/en-us/blog/authors/jerez-solis",{},"en-us/blog/authors/jerez-solis","-x7IzIDKZG8xtdxpjEmuoJA1HZ0LJh8mza79ibYm1Cw",[1280,1288,1296],{"title":1281,"description":1282,"heroImage":1283,"category":548,"date":1284,"authors":1285,"slug":1287,"externalUrl":552},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1286],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1289,"description":1290,"heroImage":1283,"category":548,"date":1291,"authors":1292,"slug":1295,"externalUrl":552},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1293,1294],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1297,"description":1298,"heroImage":1299,"category":548,"date":1300,"authors":1301,"slug":1303,"externalUrl":552},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1302],"Alisa Ho","claude-security-and-gitlab",{"promotions":1305},[1306,1320,1332,1343],{"id":1307,"categories":1308,"header":1310,"text":1311,"button":1312,"image":1317},"ai-modernization",[1309],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1313,"config":1314},"Get your AI maturity score",{"href":1315,"dataGaName":1316,"dataGaLocation":780},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1318},{"src":1319},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1321,"categories":1322,"header":1324,"text":1311,"button":1325,"image":1329},"devops-modernization",[1323,1117],"product","Are you just managing tools or shipping innovation?",{"text":1326,"config":1327},"Get your DevOps maturity score",{"href":1328,"dataGaName":1316,"dataGaLocation":780},"/assessments/devops-modernization-assessment/",{"config":1330},{"src":1331},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1333,"categories":1334,"header":1335,"text":1311,"button":1336,"image":1340},"security-modernization",[548],"Are you trading speed for security?",{"text":1337,"config":1338},"Get your security maturity score",{"href":1339,"dataGaName":1316,"dataGaLocation":780},"/assessments/security-modernization-assessment/",{"config":1341},{"src":1342},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1344,"paths":1345,"header":1348,"text":1349,"button":1350,"image":1355},"github-azure-migration",[1346,1347],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1351,"config":1352},"See how GitLab compares to GitHub",{"href":1353,"dataGaName":1354,"dataGaLocation":780},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1356},{"src":1331},{"header":1358,"blurb":1359,"button":1360,"secondaryButton":1365},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1361,"config":1362},"Get your free trial",{"href":1363,"dataGaName":579,"dataGaLocation":1364},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1053,"config":1366},{"href":905,"dataGaName":584,"dataGaLocation":1364},1786803753670]