[{"data":1,"prerenderedAt":915},["ShallowReactive",2],{"/blog/top-challenges-to-securing-the-software-supply-chain":3,"navigation-en-us":131,"banner-en-us":558,"footer-en-us":568,"blog-post-authors-en-us-Chandler Gibbons":812,"blog-related-posts-en-us-top-challenges-to-securing-the-software-supply-chain":827,"blog-promotions-en-us":852,"next-steps-en-us":905},{"id":4,"title":5,"authors":6,"body":8,"category":111,"date":112,"description":113,"extension":114,"externalUrl":115,"faq":115,"featured":116,"heroImage":117,"meta":118,"navigation":119,"path":120,"seo":121,"slug":125,"stem":126,"tags":127,"template":129,"updatedDate":115,"__hash__":130},"blogPosts/en-us/blog/top-challenges-to-securing-the-software-supply-chain.md","Top challenges to securing the software supply chain",[7],"Chandler Gibbons",{"type":9,"value":10,"toc":103},"minimark",[11,26,29,34,43,51,55,69,73,88,92,95],[12,13,14,15,20,21,25],"p",{},"Organizations are feeling the pressure to integrate security into their software development lifecycles, and federal and industry mandates mean ",[16,17,19],"a",{"href":18},"/blog/gitlabs-2022-global-devsecops-survey-security-is-the-top-concern-investment/","the days of security as a “nice to have” are officially over",". Understanding the threats that can emerge across the entire ",[16,22,24],{"href":23},"/blog/gitlab-supply-chain-security/","software supply chain"," is integral to this effort. But assembling a complete DevSecOps strategy that governs how code, applications, and infrastructure are protected across the software supply chain is no easy feat.",[12,27,28],{},"What follows are a few of the biggest challenges that organizations should keep in mind while incorporating software supply chain security into their software development lifecycle.",[30,31,33],"h2",{"id":32},"the-full-attack-surface-is-huge","The full attack surface is huge",[12,35,36,37,42],{},"Most modern cloud-native applications are developed using a multitude of open source and third-party components, creating a tangle of direct and indirect dependencies. But vulnerabilities in open source software, such as the ",[16,38,41],{"href":39,"rel":40},"https://www.cisa.gov/uscert/ncas/alerts/aa21-356a",[],"Log4Shell vulnerability",", are only one part of the software supply chain’s full attack surface.",[12,44,45,46,50],{},"Other potential attack vectors include flaws in in-house code, misconfigured ",[16,47,49],{"href":48},"/topics/ci-cd/","CI/CD"," pipelines, secret information inadvertently committed to source code repositories, and even undiscovered vulnerabilities in web APIs. Recognizing all of the ways attackers can exploit the software supply chain is an overwhelming task — in fact, it’s impossible for teams to manually monitor all of these vectors, remediate the threats, and do their day jobs at the same time. DevSecOps teams should be aware of the broad categories of threats to watch out for and the tools and processes, such as version control, multi-factor authentication, and automated security scanning, that are effective at preventing or identifying attacks at each stage of the software supply chain.",[30,52,54],{"id":53},"zero-trust-is-easier-said-than-done","Zero trust is easier said than done",[12,56,57,58,63,64,68],{},"The key to ensuring security during each step in the software supply chain is to enforce zero trust: essentially, scrutinizing everything and everyone, whether human, machine, open source component, or application configuration, for potential threats. IBM’s ",[16,59,62],{"href":60,"rel":61},"https://www.ibm.com/reports/data-breach",[],"Cost of a Data Breach 2022 report"," found that investments in zero trust are paying off: Organizations that implemented zero trust saved nearly $1 million in average breach costs compared to organizations without zero trust. However, a majority of surveyed organizations had not yet deployed a zero trust security architecture, according to the report. It’s important to remember that ",[16,65,67],{"href":66},"/blog/why-devops-and-zero-trust-go-together/","zero trust is not a single product or service"," — it is a strategy applied to a security framework. For securing the software supply chain, that means enforcing zero trust principles at each step in the chain.",[30,70,72],{"id":71},"launching-a-cyber-attack-is-getting-easier","Launching a cyber attack is getting easier",[12,74,75,76,81,82,87],{},"Software supply chain attacks were once the domain of experienced cybercriminals who had the skills to identify and exploit vulnerabilities or to build and inject malicious software code into applications. However, today’s cybercriminals have the benefit of learning from their predecessors. Once a piece of malicious software is out in the world, attackers can reuse and modify it for their own purposes. The ",[16,77,80],{"href":78,"rel":79},"https://www.csoonline.com/article/3258748/the-mirai-botnet-explained-how-teen-scammers-and-cctv-cameras-almost-brought-down-the-internet.html",[],"Mirai malware",", for example, continues to live on even after its creators were caught and sentenced in 2018, with new variants emerging each year that continue to pose risks to vulnerable network devices. Today’s hackers also have a broader arsenal of ",[16,83,86],{"href":84,"rel":85},"https://www.cisa.gov/uscert/ncas/alerts/AA18-284A",[],"malicious tools"," at their disposal, such as credential stealers and lateral movement tools, that make it easier than ever to launch software supply chain attacks.",[30,89,91],{"id":90},"assess-your-organizations-threat-landscape","Assess your organization’s threat landscape",[12,93,94],{},"Taking steps to recognize threat vectors in the software supply chain ensures that the software development lifecycle remains an engine of innovation and drives benefits for the business, rather than being a potential backdoor for attackers.",[12,96,97,102],{},[16,98,101],{"href":99,"rel":100},"https://about.gitlab.com/the-source/security/field-guide-to-threat-vectors-in-the-software-supply-chain/",[],"Download our field guide"," to better understand the types of threat vectors that can emerge at each stage of the software supply chain and how to mitigate those risks.",{"title":104,"searchDepth":105,"depth":105,"links":106},"",2,[107,108,109,110],{"id":32,"depth":105,"text":33},{"id":53,"depth":105,"text":54},{"id":71,"depth":105,"text":72},{"id":90,"depth":105,"text":91},"security","2022-11-07","Learn what organizations should keep in mind while incorporating software supply chain security into their software development lifecycle.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749668437/Blog/Hero%20Images/faster-cycle-times.jpg",{},true,"/en-us/blog/top-challenges-to-securing-the-software-supply-chain",{"title":5,"description":113,"ogTitle":5,"ogDescription":113,"noIndex":116,"ogImage":117,"ogUrl":122,"ogSiteName":123,"ogType":124,"canonicalUrls":122},"https://about.gitlab.com/blog/top-challenges-to-securing-the-software-supply-chain","https://about.gitlab.com","article","top-challenges-to-securing-the-software-supply-chain","en-us/blog/top-challenges-to-securing-the-software-supply-chain",[111,128],"open source","BlogPost","19fBVSEg691I9aAK6WYIr-ds-AkmGiZbHgQQubqqEZg",{"logo":132,"freeTrial":137,"sales":142,"login":147,"items":152,"search":478,"minimal":509,"duo":528,"switchNav":537,"pricingDeployment":548},{"config":133},{"href":134,"dataGaName":135,"dataGaLocation":136},"/","gitlab logo","header",{"text":138,"config":139},"Get free trial",{"href":140,"dataGaName":141,"dataGaLocation":136},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":143,"config":144},"Request a demo",{"href":145,"dataGaName":146,"dataGaLocation":136},"/sales/?contact-topic=request-demo","sales",{"text":148,"config":149},"Sign in",{"href":150,"dataGaName":151,"dataGaLocation":136},"https://gitlab.com/users/sign_in/","sign in",[153,182,281,286,400,456],{"text":154,"config":155,"menu":157},"Platform",{"dataNavLevelOne":156},"platform",{"type":158,"columns":159},"cards",[160,166,174],{"title":154,"description":161,"link":162},"The intelligent orchestration platform for DevSecOps",{"text":163,"config":164},"Explore our Platform",{"href":165,"dataGaName":156,"dataGaLocation":136},"/platform/",{"title":167,"description":168,"link":169},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":170,"config":171},"Meet GitLab Duo",{"href":172,"dataGaName":173,"dataGaLocation":136},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":175,"description":176,"link":177},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":178,"config":179},"Learn more",{"href":180,"dataGaName":181,"dataGaLocation":136},"/why-gitlab/","why gitlab",{"text":183,"left":119,"config":184,"menu":186},"Product",{"dataNavLevelOne":185},"solutions",{"type":187,"link":188,"columns":192,"feature":260},"lists",{"text":189,"config":190},"View all Solutions",{"href":191,"dataGaName":185,"dataGaLocation":136},"/solutions/",[193,216,239],{"title":194,"description":195,"link":196,"items":201},"Automation","CI/CD and automation to accelerate deployment",{"config":197},{"icon":198,"href":199,"dataGaName":200,"dataGaLocation":136},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[202,205,208,212],{"text":49,"config":203},{"href":204,"dataGaLocation":136,"dataGaName":49},"/solutions/continuous-integration/",{"text":167,"config":206},{"href":172,"dataGaLocation":136,"dataGaName":207},"gitlab duo agent platform - product menu",{"text":209,"config":210},"Source Code Management",{"href":211,"dataGaLocation":136,"dataGaName":209},"/solutions/source-code-management/",{"text":213,"config":214},"Automated Software Delivery",{"href":199,"dataGaLocation":136,"dataGaName":215},"Automated software delivery",{"title":217,"description":218,"link":219,"items":224},"Security","Deliver code faster without compromising security",{"config":220},{"href":221,"dataGaName":222,"dataGaLocation":136,"icon":223},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[225,229,234],{"text":226,"config":227},"Application Security Testing",{"href":221,"dataGaName":228,"dataGaLocation":136},"Application security testing",{"text":230,"config":231},"Software Supply Chain Security",{"href":232,"dataGaLocation":136,"dataGaName":233},"/solutions/supply-chain/","Software supply chain security",{"text":235,"config":236},"Software Compliance",{"href":237,"dataGaName":238,"dataGaLocation":136},"/solutions/software-compliance/","software compliance",{"title":240,"link":241,"items":246},"Measurement",{"config":242},{"icon":243,"href":244,"dataGaName":245,"dataGaLocation":136},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[247,251,255],{"text":248,"config":249},"Visibility & Measurement",{"href":244,"dataGaLocation":136,"dataGaName":250},"Visibility and Measurement",{"text":252,"config":253},"Value Stream Management",{"href":254,"dataGaLocation":136,"dataGaName":252},"/solutions/value-stream-management/",{"text":256,"config":257},"Analytics & Insights",{"href":258,"dataGaLocation":136,"dataGaName":259},"/solutions/analytics-and-insights/","Analytics and insights",{"title":261,"type":187,"items":262},"GitLab for",[263,269,275],{"text":264,"config":265},"Enterprise",{"icon":266,"href":267,"dataGaLocation":136,"dataGaName":268},"Building","/enterprise/","enterprise",{"text":270,"config":271},"Small Business",{"icon":272,"href":273,"dataGaLocation":136,"dataGaName":274},"Work","/small-business/","small business",{"text":276,"config":277},"Public Sector",{"icon":278,"href":279,"dataGaLocation":136,"dataGaName":280},"Organization","/solutions/public-sector/","public sector",{"text":282,"config":283},"Pricing",{"href":284,"dataGaName":285,"dataGaLocation":136,"dataNavLevelOne":285},"/pricing/","pricing",{"text":287,"config":288,"menu":290},"Resources",{"dataNavLevelOne":289},"resources",{"type":187,"link":291,"columns":295,"feature":389},{"text":292,"config":293},"View all resources",{"href":294,"dataGaName":289,"dataGaLocation":136},"/resources/",[296,329,356],{"title":297,"items":298},"Getting started",[299,304,309,314,319,324],{"text":300,"config":301},"Install",{"href":302,"dataGaName":303,"dataGaLocation":136},"/install/","install",{"text":305,"config":306},"Quick start guides",{"href":307,"dataGaName":308,"dataGaLocation":136},"/get-started/","quick setup checklists",{"text":310,"config":311},"Learn",{"href":312,"dataGaLocation":136,"dataGaName":313},"https://university.gitlab.com/","learn",{"text":315,"config":316},"Product documentation",{"href":317,"dataGaName":318,"dataGaLocation":136},"https://docs.gitlab.com/","product documentation",{"text":320,"config":321},"Best practice videos",{"href":322,"dataGaName":323,"dataGaLocation":136},"/getting-started-videos/","best practice videos",{"text":325,"config":326},"Integrations",{"href":327,"dataGaName":328,"dataGaLocation":136},"/integrations/","integrations",{"title":330,"items":331},"Discover",[332,337,342,347,351],{"text":333,"config":334},"Customer success stories",{"href":335,"dataGaName":336,"dataGaLocation":136},"/customers/","customer success stories",{"text":338,"config":339},"Blog",{"href":340,"dataGaName":341,"dataGaLocation":136},"/blog/","blog",{"text":343,"config":344},"Demo Hub",{"href":345,"dataGaName":346,"dataGaLocation":136},"/demo-hub/","demo hub",{"text":348,"config":349},"The Source",{"href":350,"dataGaName":341,"dataGaLocation":136},"/the-source/",{"text":352,"config":353},"Remote",{"href":354,"dataGaName":355,"dataGaLocation":136},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":357,"items":358},"Connect",[359,364,369,374,379,384],{"text":360,"config":361},"GitLab Services",{"href":362,"dataGaName":363,"dataGaLocation":136},"/services/","services",{"text":365,"config":366},"Contribute",{"href":367,"dataGaName":368,"dataGaLocation":136},"https://contributors.gitlab.com","contribute",{"text":370,"config":371},"Community",{"href":372,"dataGaName":373,"dataGaLocation":136},"/community/","community",{"text":375,"config":376},"Forum",{"href":377,"dataGaName":378,"dataGaLocation":136},"https://forum.gitlab.com/","forum",{"text":380,"config":381},"Events",{"href":382,"dataGaName":383,"dataGaLocation":136},"/events/","events",{"text":385,"config":386},"Partners",{"href":387,"dataGaName":388,"dataGaLocation":136},"/partners/","partners",{"config":390,"title":393,"text":394,"link":395},{"background":391,"textColor":392},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":396,"config":397},"Read the latest",{"href":398,"dataGaName":399,"dataGaLocation":136},"/whats-new/","whats new",{"text":401,"config":402,"menu":404},"Company",{"dataNavLevelOne":403},"company",{"type":187,"columns":405},[406],{"items":407},[408,413,419,421,426,431,436,441,446,451],{"text":409,"config":410},"About",{"href":411,"dataGaName":412,"dataGaLocation":136},"/company/","about",{"text":414,"config":415,"footerGa":418},"Jobs",{"href":416,"dataGaName":417,"dataGaLocation":136},"/jobs/","jobs",{"dataGaName":417},{"text":380,"config":420},{"href":382,"dataGaName":383,"dataGaLocation":136},{"text":422,"config":423},"Leadership",{"href":424,"dataGaName":425,"dataGaLocation":136},"/company/team/e-group/","leadership",{"text":427,"config":428},"Handbook",{"href":429,"dataGaName":430,"dataGaLocation":136},"https://handbook.gitlab.com/","handbook",{"text":432,"config":433},"Investor relations",{"href":434,"dataGaName":435,"dataGaLocation":136},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":437,"config":438},"Trust Center",{"href":439,"dataGaName":440,"dataGaLocation":136},"/security/","trust center",{"text":442,"config":443},"AI Transparency Center",{"href":444,"dataGaName":445,"dataGaLocation":136},"/ai-transparency-center/","ai transparency center",{"text":447,"config":448},"Newsletter",{"href":449,"dataGaName":450,"dataGaLocation":136},"/company/contact/#contact-forms","newsletter",{"text":452,"config":453},"Press",{"href":454,"dataGaName":455,"dataGaLocation":136},"/press/","press",{"text":457,"config":458,"menu":459},"Contact us",{"dataNavLevelOne":403},{"type":187,"columns":460},[461],{"items":462},[463,468,473],{"text":464,"config":465},"Talk to sales",{"href":466,"dataGaName":467,"dataGaLocation":136},"/sales/","talk to sales",{"text":469,"config":470},"Support portal",{"href":471,"dataGaName":472,"dataGaLocation":136},"https://support.gitlab.com/hc/en-us","support portal",{"text":474,"config":475},"Customer portal",{"href":476,"dataGaName":477,"dataGaLocation":136},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":479,"login":480,"suggestions":487},"Close",{"text":481,"link":482},"To search repositories and projects, login to",{"text":483,"config":484},"gitlab.com",{"href":150,"dataGaName":485,"dataGaLocation":486},"search login","search",{"text":488,"default":489},"Suggestions",[490,492,496,498,502,506],{"text":167,"config":491},{"href":172,"dataGaName":167,"dataGaLocation":486},{"text":493,"config":494},"Code Suggestions (AI)",{"href":495,"dataGaName":493,"dataGaLocation":486},"/solutions/code-suggestions/",{"text":49,"config":497},{"href":204,"dataGaName":49,"dataGaLocation":486},{"text":499,"config":500},"GitLab on AWS",{"href":501,"dataGaName":499,"dataGaLocation":486},"/partners/technology-partners/aws/",{"text":503,"config":504},"GitLab on Google Cloud",{"href":505,"dataGaName":503,"dataGaLocation":486},"/partners/technology-partners/google-cloud-platform/",{"text":507,"config":508},"Why GitLab?",{"href":180,"dataGaName":507,"dataGaLocation":486},{"freeTrial":510,"mobileIcon":515,"desktopIcon":520,"secondaryButton":523},{"text":511,"config":512},"Start free trial",{"href":513,"dataGaName":141,"dataGaLocation":514},"https://gitlab.com/-/trials/new/","nav",{"altText":516,"config":517},"Gitlab Icon",{"src":518,"dataGaName":519,"dataGaLocation":514},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":516,"config":521},{"src":522,"dataGaName":519,"dataGaLocation":514},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":524,"config":525},"Get Started",{"href":526,"dataGaName":527,"dataGaLocation":514},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":529,"mobileIcon":533,"desktopIcon":535},{"text":530,"config":531},"Learn more about GitLab Duo",{"href":172,"dataGaName":532,"dataGaLocation":514},"gitlab duo",{"altText":516,"config":534},{"src":518,"dataGaName":519,"dataGaLocation":514},{"altText":516,"config":536},{"src":522,"dataGaName":519,"dataGaLocation":514},{"button":538,"mobileIcon":543,"desktopIcon":545},{"text":539,"config":540},"/switch",{"href":541,"dataGaName":542,"dataGaLocation":514},"#contact","switch",{"altText":516,"config":544},{"src":518,"dataGaName":519,"dataGaLocation":514},{"altText":516,"config":546},{"src":547,"dataGaName":519,"dataGaLocation":514},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":549,"mobileIcon":554,"desktopIcon":556},{"text":550,"config":551},"Back to pricing",{"href":284,"dataGaName":552,"dataGaLocation":514,"icon":553},"back to pricing","GoBack",{"altText":516,"config":555},{"src":518,"dataGaName":519,"dataGaLocation":514},{"altText":516,"config":557},{"src":522,"dataGaName":519,"dataGaLocation":514},{"title":559,"titleMobile":560,"button":561,"config":566},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":178,"config":562},{"href":563,"dataGaName":564,"dataGaLocation":565},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":567,"disabled":116},"release",{"data":569},{"text":570,"source":571,"edit":577,"contribute":582,"config":587,"items":592,"minimal":801},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":572,"config":573},"View page source",{"href":574,"dataGaName":575,"dataGaLocation":576},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":578,"config":579},"Edit this page",{"href":580,"dataGaName":581,"dataGaLocation":576},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":583,"config":584},"Please contribute",{"href":585,"dataGaName":586,"dataGaLocation":576},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":588,"facebook":589,"youtube":590,"linkedin":591},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[593,640,693,737,769],{"title":282,"links":594,"subMenu":609},[595,599,604],{"text":596,"config":597},"View plans",{"href":284,"dataGaName":598,"dataGaLocation":576},"view plans",{"text":600,"config":601},"Why Premium?",{"href":602,"dataGaName":603,"dataGaLocation":576},"/pricing/premium/","why premium",{"text":605,"config":606},"Why Ultimate?",{"href":607,"dataGaName":608,"dataGaLocation":576},"/pricing/ultimate/","why ultimate",[610],{"title":611,"links":612},"Contact Us",[613,616,618,620,625,630,635],{"text":614,"config":615},"Contact sales",{"href":466,"dataGaName":146,"dataGaLocation":576},{"text":469,"config":617},{"href":471,"dataGaName":472,"dataGaLocation":576},{"text":474,"config":619},{"href":476,"dataGaName":477,"dataGaLocation":576},{"text":621,"config":622},"Status",{"href":623,"dataGaName":624,"dataGaLocation":576},"https://status.gitlab.com/","status",{"text":626,"config":627},"Terms of use",{"href":628,"dataGaName":629,"dataGaLocation":576},"/terms/","terms of use",{"text":631,"config":632},"Privacy statement",{"href":633,"dataGaName":634,"dataGaLocation":576},"/privacy/","privacy statement",{"text":636,"config":637},"Cookie preferences",{"dataGaName":638,"dataGaLocation":576,"id":639,"isOneTrustButton":119},"cookie preferences","ot-sdk-btn",{"title":183,"links":641,"subMenu":650},[642,646],{"text":643,"config":644},"DevSecOps platform",{"href":165,"dataGaName":645,"dataGaLocation":576},"devsecops platform",{"text":647,"config":648},"AI-Assisted Development",{"href":172,"dataGaName":649,"dataGaLocation":576},"ai-assisted development",[651],{"title":652,"links":653},"Topics",[654,658,663,668,673,678,683,688],{"text":655,"config":656},"CICD",{"href":48,"dataGaName":657,"dataGaLocation":576},"cicd",{"text":659,"config":660},"GitOps",{"href":661,"dataGaName":662,"dataGaLocation":576},"/topics/gitops/","gitops",{"text":664,"config":665},"DevOps",{"href":666,"dataGaName":667,"dataGaLocation":576},"/topics/devops/","devops",{"text":669,"config":670},"Version Control",{"href":671,"dataGaName":672,"dataGaLocation":576},"/topics/version-control/","version control",{"text":674,"config":675},"DevSecOps",{"href":676,"dataGaName":677,"dataGaLocation":576},"/topics/devsecops/","devsecops",{"text":679,"config":680},"Cloud Native",{"href":681,"dataGaName":682,"dataGaLocation":576},"/topics/cloud-native/","cloud native",{"text":684,"config":685},"AI for Coding",{"href":686,"dataGaName":687,"dataGaLocation":576},"/topics/devops/ai-for-coding/","ai for coding",{"text":689,"config":690},"Agentic AI",{"href":691,"dataGaName":692,"dataGaLocation":576},"/topics/agentic-ai/","agentic ai",{"title":694,"links":695},"Solutions",[696,698,700,705,709,712,716,719,721,724,727,732],{"text":226,"config":697},{"href":221,"dataGaName":226,"dataGaLocation":576},{"text":215,"config":699},{"href":199,"dataGaName":200,"dataGaLocation":576},{"text":701,"config":702},"Agile development",{"href":703,"dataGaName":704,"dataGaLocation":576},"/solutions/agile-delivery/","agile delivery",{"text":706,"config":707},"SCM",{"href":211,"dataGaName":708,"dataGaLocation":576},"source code management",{"text":655,"config":710},{"href":204,"dataGaName":711,"dataGaLocation":576},"continuous integration & delivery",{"text":713,"config":714},"Value stream management",{"href":254,"dataGaName":715,"dataGaLocation":576},"value stream management",{"text":659,"config":717},{"href":718,"dataGaName":662,"dataGaLocation":576},"/solutions/gitops/",{"text":264,"config":720},{"href":267,"dataGaName":268,"dataGaLocation":576},{"text":722,"config":723},"Small business",{"href":273,"dataGaName":274,"dataGaLocation":576},{"text":725,"config":726},"Public sector",{"href":279,"dataGaName":280,"dataGaLocation":576},{"text":728,"config":729},"Education",{"href":730,"dataGaName":731,"dataGaLocation":576},"/solutions/education/","education",{"text":733,"config":734},"Financial services",{"href":735,"dataGaName":736,"dataGaLocation":576},"/solutions/finance/","financial services",{"title":287,"links":738},[739,741,743,745,748,750,753,755,757,759,761,763,765,767],{"text":300,"config":740},{"href":302,"dataGaName":303,"dataGaLocation":576},{"text":305,"config":742},{"href":307,"dataGaName":308,"dataGaLocation":576},{"text":310,"config":744},{"href":312,"dataGaName":313,"dataGaLocation":576},{"text":315,"config":746},{"href":317,"dataGaName":747,"dataGaLocation":576},"docs",{"text":338,"config":749},{"href":340,"dataGaName":341,"dataGaLocation":576},{"text":751,"config":752},"What's new",{"href":398,"dataGaName":399,"dataGaLocation":576},{"text":333,"config":754},{"href":335,"dataGaName":336,"dataGaLocation":576},{"text":352,"config":756},{"href":354,"dataGaName":355,"dataGaLocation":576},{"text":360,"config":758},{"href":362,"dataGaName":363,"dataGaLocation":576},{"text":365,"config":760},{"href":367,"dataGaName":368,"dataGaLocation":576},{"text":370,"config":762},{"href":372,"dataGaName":373,"dataGaLocation":576},{"text":375,"config":764},{"href":377,"dataGaName":378,"dataGaLocation":576},{"text":380,"config":766},{"href":382,"dataGaName":383,"dataGaLocation":576},{"text":385,"config":768},{"href":387,"dataGaName":388,"dataGaLocation":576},{"title":401,"links":770},[771,773,775,777,779,781,785,790,792,794,796],{"text":409,"config":772},{"href":411,"dataGaName":403,"dataGaLocation":576},{"text":414,"config":774},{"href":416,"dataGaName":417,"dataGaLocation":576},{"text":422,"config":776},{"href":424,"dataGaName":425,"dataGaLocation":576},{"text":427,"config":778},{"href":429,"dataGaName":430,"dataGaLocation":576},{"text":432,"config":780},{"href":434,"dataGaName":435,"dataGaLocation":576},{"text":782,"config":783},"Sustainability",{"href":784,"dataGaName":782,"dataGaLocation":576},"/sustainability/",{"text":786,"config":787},"Diversity, inclusion and belonging (DIB)",{"href":788,"dataGaName":789,"dataGaLocation":576},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":437,"config":791},{"href":439,"dataGaName":440,"dataGaLocation":576},{"text":447,"config":793},{"href":449,"dataGaName":450,"dataGaLocation":576},{"text":452,"config":795},{"href":454,"dataGaName":455,"dataGaLocation":576},{"text":797,"config":798},"Modern Slavery Transparency Statement",{"href":799,"dataGaName":800,"dataGaLocation":576},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":802},[803,806,809],{"text":804,"config":805},"Terms",{"href":628,"dataGaName":629,"dataGaLocation":576},{"text":807,"config":808},"Cookies",{"dataGaName":638,"dataGaLocation":576,"id":639,"isOneTrustButton":119},{"text":810,"config":811},"Privacy",{"href":633,"dataGaName":634,"dataGaLocation":576},[813],{"id":814,"title":7,"body":115,"config":815,"content":817,"description":115,"extension":821,"meta":822,"navigation":119,"path":823,"seo":824,"stem":825,"__hash__":826},"blogAuthors/en-us/blog/authors/chandler-gibbons.yml",{"template":816},"BlogAuthor",{"name":7,"config":818},{"headshot":819,"ctfId":820},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749663276/Blog/Author%20Headshots/chandlergibb-headshot.jpg","chandlergibb","yml",{},"/en-us/blog/authors/chandler-gibbons",{},"en-us/blog/authors/chandler-gibbons","GjJva5WqhlseSDw26sqbN-TRSRT3vkcXG9OFg6M2a28",[828,836,844],{"title":829,"description":830,"heroImage":831,"category":111,"date":832,"authors":833,"slug":835,"externalUrl":115},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[834],"Julian Thome","improved-scope-offset-fingerprinting",{"title":837,"description":838,"heroImage":831,"category":111,"date":839,"authors":840,"slug":843,"externalUrl":115},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[841,842],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":845,"description":846,"heroImage":847,"category":111,"date":848,"authors":849,"slug":851,"externalUrl":115},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[850],"Alisa Ho","claude-security-and-gitlab",{"promotions":853},[854,868,880,891],{"id":855,"categories":856,"header":858,"text":859,"button":860,"image":865},"ai-modernization",[857],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":861,"config":862},"Get your AI maturity score",{"href":863,"dataGaName":864,"dataGaLocation":341},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":866},{"src":867},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":869,"categories":870,"header":872,"text":859,"button":873,"image":877},"devops-modernization",[871,677],"product","Are you just managing tools or shipping innovation?",{"text":874,"config":875},"Get your DevOps maturity score",{"href":876,"dataGaName":864,"dataGaLocation":341},"/assessments/devops-modernization-assessment/",{"config":878},{"src":879},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":881,"categories":882,"header":883,"text":859,"button":884,"image":888},"security-modernization",[111],"Are you trading speed for security?",{"text":885,"config":886},"Get your security maturity score",{"href":887,"dataGaName":864,"dataGaLocation":341},"/assessments/security-modernization-assessment/",{"config":889},{"src":890},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":892,"paths":893,"header":896,"text":897,"button":898,"image":903},"github-azure-migration",[894,895],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":899,"config":900},"See how GitLab compares to GitHub",{"href":901,"dataGaName":902,"dataGaLocation":341},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":904},{"src":879},{"header":906,"blurb":907,"button":908,"secondaryButton":913},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":909,"config":910},"Get your free trial",{"href":911,"dataGaName":141,"dataGaLocation":912},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":614,"config":914},{"href":466,"dataGaName":146,"dataGaLocation":912},1786803766421]