[{"data":1,"prerenderedAt":1565},["ShallowReactive",2],{"/blog/top-five-actions-owasp-2021":3,"navigation-en-us":780,"banner-en-us":1208,"footer-en-us":1218,"blog-post-authors-en-us-Wayne Haber":1463,"blog-related-posts-en-us-top-five-actions-owasp-2021":1477,"blog-promotions-en-us":1502,"next-steps-en-us":1555},{"id":4,"title":5,"authors":6,"body":8,"category":761,"date":762,"description":763,"extension":764,"externalUrl":765,"faq":765,"featured":766,"heroImage":767,"meta":768,"navigation":769,"path":770,"seo":771,"slug":776,"stem":777,"tags":765,"template":778,"updatedDate":765,"__hash__":779},"blogPosts/en-us/blog/top-five-actions-owasp-2021.md","Top five actions engineers should take based on the OWASP Top 10 2021 security updates",[7],"Wayne Haber",{"type":9,"value":10,"toc":754},"minimark",[11,15,19,35,50,55,73,91,94,97,100,103,106,110,210,214,217,226,690,693,740],[12,13,14],"p",{},"\u003C%= cache_bust(stylesheet_link_tag('harveyball'), cache_bust_value) %>",[16,17,18],"style",{},"\n.slpBlog__article table > tbody > tr > td {\n  vertical-align: middle;\n}\ntd .harveyball {\n  margin: 0 auto;\n}\nli .harveyball {\n  display: inline;\n}\n",[12,20,21,22,28,29,34],{},"The ",[23,24,27],"a",{"href":25,"rel":26},"https://owasp.org/",[],"OWASP Foundation"," recently released its long-anticipated ",[23,30,33],{"href":31,"rel":32},"https://owasp.org/Top10/",[],"OWASP top 10 security vulnerability trends for 2021",".  This list provides awareness for developers and security teams on the most critical security risks to applications. This is the first update in four years.",[12,36,37,38,43,44,49],{},"We're proud to ",[23,39,42],{"href":40,"rel":41},"https://about.gitlab.com/blog/gitlab-is-now-a-member-of-the-owasp-foundation/",[],"sponsor the OWASP organization",", which supports their mission \"to help the world improve the security of its software\" as well as support regional and global annual conferences. We were also thrilled to be able to help with the OWASP top 10 updates by compiling and providing ",[23,45,48],{"href":46,"rel":47},"https://about.gitlab.com/blog/gitlab-latest-security-trends/",[],"anonymized vulnerability data"," to OWASP so they could use it with data from other sources to compile the trends.",[51,52,54],"h2",{"id":53},"there-are-many-changes-to-the-owasp-top-10","There are many changes to the OWASP top 10",[56,57],"iframe",{"src":58,"title":59,"className":60,"frameBorder":62,"scrolling":63,"style":64,"sandbox":65},"https://flo.uri.sh/visualisation/7574790/embed","Interactive or visual content",[61],"flourish-embed-iframe","0","no","width:100%;height:600px;",[66,67,68,69,70,71,72],"allow-same-origin","allow-forms","allow-scripts","allow-downloads","allow-popups","allow-popups-to-escape-sandbox","allow-top-navigation-by-user-activation",[74,75,77],"div",{"style":76},"width:100%!;margin-top:4px!important;text-align:right!important;",[23,78,84,90],{"className":79,"href":81,"target":82,"style":83},[80],"flourish-credit","https://public.flourish.studio/visualisation/7574790/?utm_source=embed&utm_campaign=visualisation/7574790","_top","text-decoration:none!important",[85,86],"img",{"alt":87,"src":88,"style":89},"Made with Flourish","https://public.flourish.studio/resources/made_with_flourish.svg","width:105px!important;height:16px!important;border:none!important;margin:0!important;"," ",[12,92,93],{},"OWASP Top 10 changes from 2004 to 2021",[12,95,96],{},"In the top 5, broken access control has gone from #5 up to #1 on this list due to nearly 4% of applications having challenges in this area. Insecure design has been added as a new category. Cryptographic failures, injection, and security misconfiguration continue to be high on the list.",[12,98,99],{},"In the bottom 5, vulnerable and outdated components, identification/authentication issues, and logging/monitoring are still present. New categories are software/data integrity and Server-Side Request Forgery (SSRF).",[12,101,102],{},"The most significant changes between the OWASP Top 10 2017 and 2021 rankings is the position of Broken Authentication, which moved five steps down from position 2 to 7. This change indicates that this category is considered much less critical nowadays than it used to be in the past. In contrast, Broken Access Control is considered more critical in 2021 in comparison to 2017 because it moved up four steps from position 5 to 1.",[12,104,105],{},"Another noticeable difference when comparing OWASP Top 10 2017 and 2021 is the disappearance of the XML External Entity (XXE), Cross-Site Scripting (XSS), and Insecure Deserialization categories which have been absorbed by the Security Misconfiguration, Injection and Software and Data Integrity Failures categories in the 2021 ranking, respectively. This change freed up two additional spots in the 2021 ranking for the entirely new categories Insecure Design and SSRF. Vulnerabilities in Software Dependencies moved up three positions from position 9 in 2017 (Using Components with Known Vulnerabilities) to position 6 in 2021 (Vulnerable and Outdated Components).",[51,107,109],{"id":108},"what-should-engineering-and-security-teams-do-based-on-the-updates","What should engineering and security teams do based on the updates?",[111,112,113,134,142,168,189],"ol",{},[114,115,116,121,122,127,128,133],"li",{},[23,117,120],{"href":118,"rel":119},"https://owasp.org/Top10/A01_2021-Broken_Access_Control/",[],"Broken access control"," – ",[23,123,126],{"href":124,"rel":125},"https://docs.gitlab.com/user/application_security/sast/",[],"SAST"," and ",[23,129,132],{"href":130,"rel":131},"https://docs.gitlab.com/user/application_security/dast/",[],"DAST"," scanners can sometimes help to find some classes of these issues. Automated tools can identify that user X can access feature Y; however, they often cannot determine if that user should have that level of access. This is where designing for security from the beginning comes into play, especially for authentication and authorization. Humans cannot be replaced with automation to detect many of these issues. Focused penetration testing and bug bounty programs are key to find things that may have slipped through the cracks.",[114,135,136,141],{},[23,137,140],{"href":138,"rel":139},"https://owasp.org/Top10/A04_2021-Insecure_Design/",[],"Insecure design"," – Similar to the top controls for broken access control, it is essential to design for security at the beginning and monitor it over time. Teach developers how their applications may be attacked through threat modeling in order to enable them to design and evaluate the system design from a security-first mindset.",[114,143,144,149,150,155,156,161,162,167],{},[23,145,148],{"href":146,"rel":147},"https://owasp.org/Top10/pt_BR/A08_2021-Software_and_Data_Integrity_Failures/",[],"Software/data integrity"," – Educate developers on attackers doing typosquatting on common libraries and inducing developers to use their libraries that have been compromised. Confirm your libraries and other dependencies are checked for known security issues via ",[23,151,154],{"href":152,"rel":153},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"GitLab Dependency Scanning",", and/or Container Scanning and open source tools like ",[23,157,160],{"href":158,"rel":159},"https://owasp.org/www-project-dependency-check/",[],"OWASP dependency check",". Also, consider tools like ",[23,163,166],{"href":164,"rel":165},"https://about.gitlab.com/blog/announcing-package-hunter/",[],"package hunter"," that can help find malicious code in your dependencies.",[114,169,170,175,176,181,182,127,185,188],{},[23,171,174],{"href":172,"rel":173},"https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/",[],"Server-Side Request Forgery"," – Sanitize untrusted input data using hardened libraries and ",[23,177,180],{"href":178,"rel":179},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/",[],"fuzz test"," your inputs to suss out unexpected behaviors. Implement allow lists for what should be permitted rather than deny lists that can be easily thwarted by a determined attacker. ",[23,183,126],{"href":124,"rel":184},[],[23,186,132],{"href":130,"rel":187},[]," scanners can often easily identify this class of issues.",[114,190,191,192,197,198,203,204,209],{},"Keep diligence on the other top threats on the list via the above recommendations, including confirming monitoring and pre-established escalation runbooks for security issues. ",[23,193,196],{"href":194,"rel":195},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"Scan your code for secrets"," that can accidentally leak into repositories. Keep an eye on ",[23,199,202],{"href":200,"rel":201},"https://docs.gitlab.com/user/application_security/security_dashboard/",[],"vulnerability trends"," in your applications over time to make sure they are being vetted and addressed as appropriate. ",[23,205,208],{"href":206,"rel":207},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"Scan and monitor your containers"," for security issues.",[51,211,213],{"id":212},"how-do-gitlab-and-other-solutions-measure-up-to-these-risks","How do GitLab and other solutions measure up to these risks?",[12,215,216],{},"No one solution covers the entire threat in any category. A defense-in-depth strategy of employing multiple areas of validation is key to managing risk.",[12,218,219,220,225],{},"More information about how GitLab addresses these risks can be found on the ",[23,221,224],{"href":222,"rel":223},"https://handbook.gitlab.com/handbook/engineering/development/sec/secure/products/metrics/",[],"secure product metric page",".",[227,228,229,257],"table",{},[230,231,232],"thead",{},[233,234,235,239,242,245,248,251,254],"tr",{},[236,237,238],"th",{},"Security risk",[236,240,241],{},"GitLab Secure & Protect",[236,243,244],{},"Penetration Testing",[236,246,247],{},"Bug Bounties",[236,249,250],{},"Security Training",[236,252,253],{},"Security-First Design",[236,255,256],{},"Security Monitoring & Escalation",[258,259,260,314,361,408,455,502,549,596,643],"tbody",{},[233,261,262,266,277,285,292,299,306],{},[263,264,265],"td",{},"A01:2021-Broken Access Control",[263,267,268],{},[269,270,273],"svg",{"className":271},[272],"harveyball",[274,275],"use",{"xLinkHref":276},"/images/harveyball/icons.svg#harveyball-50",[263,278,279],{},[269,280,282],{"className":281},[272],[274,283],{"xLinkHref":284},"/images/harveyball/icons.svg#harveyball-75",[263,286,287],{},[269,288,290],{"className":289},[272],[274,291],{"xLinkHref":284},[263,293,294],{},[269,295,297],{"className":296},[272],[274,298],{"xLinkHref":276},[263,300,301],{},[269,302,304],{"className":303},[272],[274,305],{"xLinkHref":276},[263,307,308],{},[269,309,311],{"className":310},[272],[274,312],{"xLinkHref":313},"/images/harveyball/icons.svg#harveyball-25",[233,315,316,319,326,333,340,347,354],{},[263,317,318],{},"02:2021-Cryptographic Failures",[263,320,321],{},[269,322,324],{"className":323},[272],[274,325],{"xLinkHref":284},[263,327,328],{},[269,329,331],{"className":330},[272],[274,332],{"xLinkHref":276},[263,334,335],{},[269,336,338],{"className":337},[272],[274,339],{"xLinkHref":276},[263,341,342],{},[269,343,345],{"className":344},[272],[274,346],{"xLinkHref":284},[263,348,349],{},[269,350,352],{"className":351},[272],[274,353],{"xLinkHref":276},[263,355,356],{},[269,357,359],{"className":358},[272],[274,360],{"xLinkHref":313},[233,362,363,366,373,380,387,394,401],{},[263,364,365],{},"03:2021-Injection",[263,367,368],{},[269,369,371],{"className":370},[272],[274,372],{"xLinkHref":276},[263,374,375],{},[269,376,378],{"className":377},[272],[274,379],{"xLinkHref":276},[263,381,382],{},[269,383,385],{"className":384},[272],[274,386],{"xLinkHref":284},[263,388,389],{},[269,390,392],{"className":391},[272],[274,393],{"xLinkHref":276},[263,395,396],{},[269,397,399],{"className":398},[272],[274,400],{"xLinkHref":276},[263,402,403],{},[269,404,406],{"className":405},[272],[274,407],{"xLinkHref":313},[233,409,410,413,420,427,434,441,448],{},[263,411,412],{},"A05:2021-Security Misconfiguration",[263,414,415],{},[269,416,418],{"className":417},[272],[274,419],{"xLinkHref":313},[263,421,422],{},[269,423,425],{"className":424},[272],[274,426],{"xLinkHref":276},[263,428,429],{},[269,430,432],{"className":431},[272],[274,433],{"xLinkHref":313},[263,435,436],{},[269,437,439],{"className":438},[272],[274,440],{"xLinkHref":313},[263,442,443],{},[269,444,446],{"className":445},[272],[274,447],{"xLinkHref":313},[263,449,450],{},[269,451,453],{"className":452},[272],[274,454],{"xLinkHref":276},[233,456,457,460,467,474,481,488,495],{},[263,458,459],{},"A06:2021-Vulnerable and Outdated Components",[263,461,462],{},[269,463,465],{"className":464},[272],[274,466],{"xLinkHref":284},[263,468,469],{},[269,470,472],{"className":471},[272],[274,473],{"xLinkHref":276},[263,475,476],{},[269,477,479],{"className":478},[272],[274,480],{"xLinkHref":276},[263,482,483],{},[269,484,486],{"className":485},[272],[274,487],{"xLinkHref":276},[263,489,490],{},[269,491,493],{"className":492},[272],[274,494],{"xLinkHref":276},[263,496,497],{},[269,498,500],{"className":499},[272],[274,501],{"xLinkHref":276},[233,503,504,507,514,521,528,535,542],{},[263,505,506],{},"A07:2021-Identification and Authentication Failures",[263,508,509],{},[269,510,512],{"className":511},[272],[274,513],{"xLinkHref":276},[263,515,516],{},[269,517,519],{"className":518},[272],[274,520],{"xLinkHref":284},[263,522,523],{},[269,524,526],{"className":525},[272],[274,527],{"xLinkHref":284},[263,529,530],{},[269,531,533],{"className":532},[272],[274,534],{"xLinkHref":276},[263,536,537],{},[269,538,540],{"className":539},[272],[274,541],{"xLinkHref":276},[263,543,544],{},[269,545,547],{"className":546},[272],[274,548],{"xLinkHref":313},[233,550,551,554,561,568,575,582,589],{},[263,552,553],{},"A08:2021-Software and Data Integrity Failures",[263,555,556],{},[269,557,559],{"className":558},[272],[274,560],{"xLinkHref":284},[263,562,563],{},[269,564,566],{"className":565},[272],[274,567],{"xLinkHref":284},[263,569,570],{},[269,571,573],{"className":572},[272],[274,574],{"xLinkHref":276},[263,576,577],{},[269,578,580],{"className":579},[272],[274,581],{"xLinkHref":276},[263,583,584],{},[269,585,587],{"className":586},[272],[274,588],{"xLinkHref":284},[263,590,591],{},[269,592,594],{"className":593},[272],[274,595],{"xLinkHref":313},[233,597,598,601,608,615,622,629,636],{},[263,599,600],{},"A09:2021-Security Logging and Monitoring Failures",[263,602,603],{},[269,604,606],{"className":605},[272],[274,607],{"xLinkHref":313},[263,609,610],{},[269,611,613],{"className":612},[272],[274,614],{"xLinkHref":313},[263,616,617],{},[269,618,620],{"className":619},[272],[274,621],{"xLinkHref":313},[263,623,624],{},[269,625,627],{"className":626},[272],[274,628],{"xLinkHref":313},[263,630,631],{},[269,632,634],{"className":633},[272],[274,635],{"xLinkHref":276},[263,637,638],{},[269,639,641],{"className":640},[272],[274,642],{"xLinkHref":284},[233,644,645,648,655,662,669,676,683],{},[263,646,647],{},"A10:2021-Server-Side Request Forgery",[263,649,650],{},[269,651,653],{"className":652},[272],[274,654],{"xLinkHref":284},[263,656,657],{},[269,658,660],{"className":659},[272],[274,661],{"xLinkHref":284},[263,663,664],{},[269,665,667],{"className":666},[272],[274,668],{"xLinkHref":284},[263,670,671],{},[269,672,674],{"className":673},[272],[274,675],{"xLinkHref":276},[263,677,678],{},[269,679,681],{"className":680},[272],[274,682],{"xLinkHref":284},[263,684,685],{},[269,686,688],{"className":687},[272],[274,689],{"xLinkHref":313},[12,691,692],{},"Coverage legend:",[694,695,696,697,696,707,696,715,696,723,696,731],"ul",{},"\n  ",[114,698,699,700,706],{},"\n    ",[269,701,703],{"className":702},[272],[274,704],{"xLinkHref":705},"/images/harveyball/icons.svg#harveyball-0"," - 0%\n  ",[114,708,699,709,714],{},[269,710,712],{"className":711},[272],[274,713],{"xLinkHref":313}," - 25%\n  ",[114,716,699,717,722],{},[269,718,720],{"className":719},[272],[274,721],{"xLinkHref":276}," - 50%\n  ",[114,724,699,725,730],{},[269,726,728],{"className":727},[272],[274,729],{"xLinkHref":284}," - 75%\n  ",[114,732,699,733,739],{},[269,734,736],{"className":735},[272],[274,737],{"xLinkHref":738},"/images/harveyball/icons.svg#harveyball-100"," - 100%\n  ",[12,741,742,743,748,749],{},"Cover image by ",[23,744,747],{"href":745,"rel":746},"https://unsplash.com/@joshgmit?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText%22",[],"Joshua Golde"," on ",[23,750,753],{"href":751,"rel":752},"https://unsplash.com/s/photos/ranking?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText",[],"Unsplash",{"title":755,"searchDepth":756,"depth":756,"links":757},"",2,[758,759,760],{"id":53,"depth":756,"text":54},{"id":108,"depth":756,"text":109},{"id":212,"depth":756,"text":213},"security","2021-11-15","Learn what actions engineers should take based on the OWASP Top 10 updates for 2021","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749684879/Blog/Hero%20Images/joshua-golde-qIu77BsFdds-unsplash.jpg",{},true,"/en-us/blog/top-five-actions-owasp-2021",{"title":772,"description":763,"ogTitle":772,"ogDescription":763,"noIndex":766,"ogImage":767,"ogUrl":773,"ogSiteName":774,"ogType":775,"canonicalUrls":773},"Five key actions to take based on OWASP Top 10 2021 updates","https://about.gitlab.com/blog/top-five-actions-owasp-2021","https://about.gitlab.com","article","top-five-actions-owasp-2021","en-us/blog/top-five-actions-owasp-2021","BlogPost","p5RLAtzmyRgNJUe_NhaZ-1ITis_OTWc4Gyt7PQg5wac",{"logo":781,"freeTrial":786,"sales":791,"login":796,"items":801,"search":1128,"minimal":1159,"duo":1178,"switchNav":1187,"pricingDeployment":1198},{"config":782},{"href":783,"dataGaName":784,"dataGaLocation":785},"/","gitlab logo","header",{"text":787,"config":788},"Get free trial",{"href":789,"dataGaName":790,"dataGaLocation":785},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":792,"config":793},"Request a demo",{"href":794,"dataGaName":795,"dataGaLocation":785},"/sales/?contact-topic=request-demo","sales",{"text":797,"config":798},"Sign in",{"href":799,"dataGaName":800,"dataGaLocation":785},"https://gitlab.com/users/sign_in/","sign in",[802,831,931,936,1050,1106],{"text":803,"config":804,"menu":806},"Platform",{"dataNavLevelOne":805},"platform",{"type":807,"columns":808},"cards",[809,815,823],{"title":803,"description":810,"link":811},"The intelligent orchestration platform for DevSecOps",{"text":812,"config":813},"Explore our Platform",{"href":814,"dataGaName":805,"dataGaLocation":785},"/platform/",{"title":816,"description":817,"link":818},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":819,"config":820},"Meet GitLab Duo",{"href":821,"dataGaName":822,"dataGaLocation":785},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":824,"description":825,"link":826},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":827,"config":828},"Learn more",{"href":829,"dataGaName":830,"dataGaLocation":785},"/why-gitlab/","why gitlab",{"text":832,"left":769,"config":833,"menu":835},"Product",{"dataNavLevelOne":834},"solutions",{"type":836,"link":837,"columns":841,"feature":910},"lists",{"text":838,"config":839},"View all Solutions",{"href":840,"dataGaName":834,"dataGaLocation":785},"/solutions/",[842,866,889],{"title":843,"description":844,"link":845,"items":850},"Automation","CI/CD and automation to accelerate deployment",{"config":846},{"icon":847,"href":848,"dataGaName":849,"dataGaLocation":785},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[851,855,858,862],{"text":852,"config":853},"CI/CD",{"href":854,"dataGaLocation":785,"dataGaName":852},"/solutions/continuous-integration/",{"text":816,"config":856},{"href":821,"dataGaLocation":785,"dataGaName":857},"gitlab duo agent platform - product menu",{"text":859,"config":860},"Source Code Management",{"href":861,"dataGaLocation":785,"dataGaName":859},"/solutions/source-code-management/",{"text":863,"config":864},"Automated Software Delivery",{"href":848,"dataGaLocation":785,"dataGaName":865},"Automated software delivery",{"title":867,"description":868,"link":869,"items":874},"Security","Deliver code faster without compromising security",{"config":870},{"href":871,"dataGaName":872,"dataGaLocation":785,"icon":873},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[875,879,884],{"text":876,"config":877},"Application Security Testing",{"href":871,"dataGaName":878,"dataGaLocation":785},"Application security testing",{"text":880,"config":881},"Software Supply Chain Security",{"href":882,"dataGaLocation":785,"dataGaName":883},"/solutions/supply-chain/","Software supply chain security",{"text":885,"config":886},"Software Compliance",{"href":887,"dataGaName":888,"dataGaLocation":785},"/solutions/software-compliance/","software compliance",{"title":890,"link":891,"items":896},"Measurement",{"config":892},{"icon":893,"href":894,"dataGaName":895,"dataGaLocation":785},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[897,901,905],{"text":898,"config":899},"Visibility & Measurement",{"href":894,"dataGaLocation":785,"dataGaName":900},"Visibility and Measurement",{"text":902,"config":903},"Value Stream Management",{"href":904,"dataGaLocation":785,"dataGaName":902},"/solutions/value-stream-management/",{"text":906,"config":907},"Analytics & Insights",{"href":908,"dataGaLocation":785,"dataGaName":909},"/solutions/analytics-and-insights/","Analytics and insights",{"title":911,"type":836,"items":912},"GitLab for",[913,919,925],{"text":914,"config":915},"Enterprise",{"icon":916,"href":917,"dataGaLocation":785,"dataGaName":918},"Building","/enterprise/","enterprise",{"text":920,"config":921},"Small Business",{"icon":922,"href":923,"dataGaLocation":785,"dataGaName":924},"Work","/small-business/","small business",{"text":926,"config":927},"Public Sector",{"icon":928,"href":929,"dataGaLocation":785,"dataGaName":930},"Organization","/solutions/public-sector/","public sector",{"text":932,"config":933},"Pricing",{"href":934,"dataGaName":935,"dataGaLocation":785,"dataNavLevelOne":935},"/pricing/","pricing",{"text":937,"config":938,"menu":940},"Resources",{"dataNavLevelOne":939},"resources",{"type":836,"link":941,"columns":945,"feature":1039},{"text":942,"config":943},"View all resources",{"href":944,"dataGaName":939,"dataGaLocation":785},"/resources/",[946,979,1006],{"title":947,"items":948},"Getting started",[949,954,959,964,969,974],{"text":950,"config":951},"Install",{"href":952,"dataGaName":953,"dataGaLocation":785},"/install/","install",{"text":955,"config":956},"Quick start guides",{"href":957,"dataGaName":958,"dataGaLocation":785},"/get-started/","quick setup checklists",{"text":960,"config":961},"Learn",{"href":962,"dataGaLocation":785,"dataGaName":963},"https://university.gitlab.com/","learn",{"text":965,"config":966},"Product documentation",{"href":967,"dataGaName":968,"dataGaLocation":785},"https://docs.gitlab.com/","product documentation",{"text":970,"config":971},"Best practice videos",{"href":972,"dataGaName":973,"dataGaLocation":785},"/getting-started-videos/","best practice videos",{"text":975,"config":976},"Integrations",{"href":977,"dataGaName":978,"dataGaLocation":785},"/integrations/","integrations",{"title":980,"items":981},"Discover",[982,987,992,997,1001],{"text":983,"config":984},"Customer success stories",{"href":985,"dataGaName":986,"dataGaLocation":785},"/customers/","customer success stories",{"text":988,"config":989},"Blog",{"href":990,"dataGaName":991,"dataGaLocation":785},"/blog/","blog",{"text":993,"config":994},"Demo Hub",{"href":995,"dataGaName":996,"dataGaLocation":785},"/demo-hub/","demo hub",{"text":998,"config":999},"The Source",{"href":1000,"dataGaName":991,"dataGaLocation":785},"/the-source/",{"text":1002,"config":1003},"Remote",{"href":1004,"dataGaName":1005,"dataGaLocation":785},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1007,"items":1008},"Connect",[1009,1014,1019,1024,1029,1034],{"text":1010,"config":1011},"GitLab Services",{"href":1012,"dataGaName":1013,"dataGaLocation":785},"/services/","services",{"text":1015,"config":1016},"Contribute",{"href":1017,"dataGaName":1018,"dataGaLocation":785},"https://contributors.gitlab.com","contribute",{"text":1020,"config":1021},"Community",{"href":1022,"dataGaName":1023,"dataGaLocation":785},"/community/","community",{"text":1025,"config":1026},"Forum",{"href":1027,"dataGaName":1028,"dataGaLocation":785},"https://forum.gitlab.com/","forum",{"text":1030,"config":1031},"Events",{"href":1032,"dataGaName":1033,"dataGaLocation":785},"/events/","events",{"text":1035,"config":1036},"Partners",{"href":1037,"dataGaName":1038,"dataGaLocation":785},"/partners/","partners",{"config":1040,"title":1043,"text":1044,"link":1045},{"background":1041,"textColor":1042},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1046,"config":1047},"Read the latest",{"href":1048,"dataGaName":1049,"dataGaLocation":785},"/whats-new/","whats new",{"text":1051,"config":1052,"menu":1054},"Company",{"dataNavLevelOne":1053},"company",{"type":836,"columns":1055},[1056],{"items":1057},[1058,1063,1069,1071,1076,1081,1086,1091,1096,1101],{"text":1059,"config":1060},"About",{"href":1061,"dataGaName":1062,"dataGaLocation":785},"/company/","about",{"text":1064,"config":1065,"footerGa":1068},"Jobs",{"href":1066,"dataGaName":1067,"dataGaLocation":785},"/jobs/","jobs",{"dataGaName":1067},{"text":1030,"config":1070},{"href":1032,"dataGaName":1033,"dataGaLocation":785},{"text":1072,"config":1073},"Leadership",{"href":1074,"dataGaName":1075,"dataGaLocation":785},"/company/team/e-group/","leadership",{"text":1077,"config":1078},"Handbook",{"href":1079,"dataGaName":1080,"dataGaLocation":785},"https://handbook.gitlab.com/","handbook",{"text":1082,"config":1083},"Investor relations",{"href":1084,"dataGaName":1085,"dataGaLocation":785},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1087,"config":1088},"Trust Center",{"href":1089,"dataGaName":1090,"dataGaLocation":785},"/security/","trust center",{"text":1092,"config":1093},"AI Transparency Center",{"href":1094,"dataGaName":1095,"dataGaLocation":785},"/ai-transparency-center/","ai transparency center",{"text":1097,"config":1098},"Newsletter",{"href":1099,"dataGaName":1100,"dataGaLocation":785},"/company/contact/#contact-forms","newsletter",{"text":1102,"config":1103},"Press",{"href":1104,"dataGaName":1105,"dataGaLocation":785},"/press/","press",{"text":1107,"config":1108,"menu":1109},"Contact us",{"dataNavLevelOne":1053},{"type":836,"columns":1110},[1111],{"items":1112},[1113,1118,1123],{"text":1114,"config":1115},"Talk to sales",{"href":1116,"dataGaName":1117,"dataGaLocation":785},"/sales/","talk to sales",{"text":1119,"config":1120},"Support portal",{"href":1121,"dataGaName":1122,"dataGaLocation":785},"https://support.gitlab.com/hc/en-us","support portal",{"text":1124,"config":1125},"Customer portal",{"href":1126,"dataGaName":1127,"dataGaLocation":785},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1129,"login":1130,"suggestions":1137},"Close",{"text":1131,"link":1132},"To search repositories and projects, login to",{"text":1133,"config":1134},"gitlab.com",{"href":799,"dataGaName":1135,"dataGaLocation":1136},"search login","search",{"text":1138,"default":1139},"Suggestions",[1140,1142,1146,1148,1152,1156],{"text":816,"config":1141},{"href":821,"dataGaName":816,"dataGaLocation":1136},{"text":1143,"config":1144},"Code Suggestions (AI)",{"href":1145,"dataGaName":1143,"dataGaLocation":1136},"/solutions/code-suggestions/",{"text":852,"config":1147},{"href":854,"dataGaName":852,"dataGaLocation":1136},{"text":1149,"config":1150},"GitLab on AWS",{"href":1151,"dataGaName":1149,"dataGaLocation":1136},"/partners/technology-partners/aws/",{"text":1153,"config":1154},"GitLab on Google Cloud",{"href":1155,"dataGaName":1153,"dataGaLocation":1136},"/partners/technology-partners/google-cloud-platform/",{"text":1157,"config":1158},"Why GitLab?",{"href":829,"dataGaName":1157,"dataGaLocation":1136},{"freeTrial":1160,"mobileIcon":1165,"desktopIcon":1170,"secondaryButton":1173},{"text":1161,"config":1162},"Start free trial",{"href":1163,"dataGaName":790,"dataGaLocation":1164},"https://gitlab.com/-/trials/new/","nav",{"altText":1166,"config":1167},"Gitlab Icon",{"src":1168,"dataGaName":1169,"dataGaLocation":1164},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1166,"config":1171},{"src":1172,"dataGaName":1169,"dataGaLocation":1164},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1174,"config":1175},"Get Started",{"href":1176,"dataGaName":1177,"dataGaLocation":1164},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1179,"mobileIcon":1183,"desktopIcon":1185},{"text":1180,"config":1181},"Learn more about GitLab Duo",{"href":821,"dataGaName":1182,"dataGaLocation":1164},"gitlab duo",{"altText":1166,"config":1184},{"src":1168,"dataGaName":1169,"dataGaLocation":1164},{"altText":1166,"config":1186},{"src":1172,"dataGaName":1169,"dataGaLocation":1164},{"button":1188,"mobileIcon":1193,"desktopIcon":1195},{"text":1189,"config":1190},"/switch",{"href":1191,"dataGaName":1192,"dataGaLocation":1164},"#contact","switch",{"altText":1166,"config":1194},{"src":1168,"dataGaName":1169,"dataGaLocation":1164},{"altText":1166,"config":1196},{"src":1197,"dataGaName":1169,"dataGaLocation":1164},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1199,"mobileIcon":1204,"desktopIcon":1206},{"text":1200,"config":1201},"Back to pricing",{"href":934,"dataGaName":1202,"dataGaLocation":1164,"icon":1203},"back to pricing","GoBack",{"altText":1166,"config":1205},{"src":1168,"dataGaName":1169,"dataGaLocation":1164},{"altText":1166,"config":1207},{"src":1172,"dataGaName":1169,"dataGaLocation":1164},{"title":1209,"titleMobile":1210,"button":1211,"config":1216},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":827,"config":1212},{"href":1213,"dataGaName":1214,"dataGaLocation":1215},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1217,"disabled":766},"release",{"data":1219},{"text":1220,"source":1221,"edit":1227,"contribute":1232,"config":1237,"items":1242,"minimal":1452},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1222,"config":1223},"View page source",{"href":1224,"dataGaName":1225,"dataGaLocation":1226},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1228,"config":1229},"Edit this page",{"href":1230,"dataGaName":1231,"dataGaLocation":1226},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1233,"config":1234},"Please contribute",{"href":1235,"dataGaName":1236,"dataGaLocation":1226},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1238,"facebook":1239,"youtube":1240,"linkedin":1241},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1243,1290,1344,1388,1420],{"title":932,"links":1244,"subMenu":1259},[1245,1249,1254],{"text":1246,"config":1247},"View plans",{"href":934,"dataGaName":1248,"dataGaLocation":1226},"view plans",{"text":1250,"config":1251},"Why Premium?",{"href":1252,"dataGaName":1253,"dataGaLocation":1226},"/pricing/premium/","why premium",{"text":1255,"config":1256},"Why Ultimate?",{"href":1257,"dataGaName":1258,"dataGaLocation":1226},"/pricing/ultimate/","why ultimate",[1260],{"title":1261,"links":1262},"Contact Us",[1263,1266,1268,1270,1275,1280,1285],{"text":1264,"config":1265},"Contact sales",{"href":1116,"dataGaName":795,"dataGaLocation":1226},{"text":1119,"config":1267},{"href":1121,"dataGaName":1122,"dataGaLocation":1226},{"text":1124,"config":1269},{"href":1126,"dataGaName":1127,"dataGaLocation":1226},{"text":1271,"config":1272},"Status",{"href":1273,"dataGaName":1274,"dataGaLocation":1226},"https://status.gitlab.com/","status",{"text":1276,"config":1277},"Terms of use",{"href":1278,"dataGaName":1279,"dataGaLocation":1226},"/terms/","terms of use",{"text":1281,"config":1282},"Privacy statement",{"href":1283,"dataGaName":1284,"dataGaLocation":1226},"/privacy/","privacy statement",{"text":1286,"config":1287},"Cookie preferences",{"dataGaName":1288,"dataGaLocation":1226,"id":1289,"isOneTrustButton":769},"cookie preferences","ot-sdk-btn",{"title":832,"links":1291,"subMenu":1300},[1292,1296],{"text":1293,"config":1294},"DevSecOps platform",{"href":814,"dataGaName":1295,"dataGaLocation":1226},"devsecops platform",{"text":1297,"config":1298},"AI-Assisted Development",{"href":821,"dataGaName":1299,"dataGaLocation":1226},"ai-assisted development",[1301],{"title":1302,"links":1303},"Topics",[1304,1309,1314,1319,1324,1329,1334,1339],{"text":1305,"config":1306},"CICD",{"href":1307,"dataGaName":1308,"dataGaLocation":1226},"/topics/ci-cd/","cicd",{"text":1310,"config":1311},"GitOps",{"href":1312,"dataGaName":1313,"dataGaLocation":1226},"/topics/gitops/","gitops",{"text":1315,"config":1316},"DevOps",{"href":1317,"dataGaName":1318,"dataGaLocation":1226},"/topics/devops/","devops",{"text":1320,"config":1321},"Version Control",{"href":1322,"dataGaName":1323,"dataGaLocation":1226},"/topics/version-control/","version control",{"text":1325,"config":1326},"DevSecOps",{"href":1327,"dataGaName":1328,"dataGaLocation":1226},"/topics/devsecops/","devsecops",{"text":1330,"config":1331},"Cloud Native",{"href":1332,"dataGaName":1333,"dataGaLocation":1226},"/topics/cloud-native/","cloud native",{"text":1335,"config":1336},"AI for Coding",{"href":1337,"dataGaName":1338,"dataGaLocation":1226},"/topics/devops/ai-for-coding/","ai for coding",{"text":1340,"config":1341},"Agentic AI",{"href":1342,"dataGaName":1343,"dataGaLocation":1226},"/topics/agentic-ai/","agentic ai",{"title":1345,"links":1346},"Solutions",[1347,1349,1351,1356,1360,1363,1367,1370,1372,1375,1378,1383],{"text":876,"config":1348},{"href":871,"dataGaName":876,"dataGaLocation":1226},{"text":865,"config":1350},{"href":848,"dataGaName":849,"dataGaLocation":1226},{"text":1352,"config":1353},"Agile development",{"href":1354,"dataGaName":1355,"dataGaLocation":1226},"/solutions/agile-delivery/","agile delivery",{"text":1357,"config":1358},"SCM",{"href":861,"dataGaName":1359,"dataGaLocation":1226},"source code management",{"text":1305,"config":1361},{"href":854,"dataGaName":1362,"dataGaLocation":1226},"continuous integration & delivery",{"text":1364,"config":1365},"Value stream management",{"href":904,"dataGaName":1366,"dataGaLocation":1226},"value stream management",{"text":1310,"config":1368},{"href":1369,"dataGaName":1313,"dataGaLocation":1226},"/solutions/gitops/",{"text":914,"config":1371},{"href":917,"dataGaName":918,"dataGaLocation":1226},{"text":1373,"config":1374},"Small business",{"href":923,"dataGaName":924,"dataGaLocation":1226},{"text":1376,"config":1377},"Public sector",{"href":929,"dataGaName":930,"dataGaLocation":1226},{"text":1379,"config":1380},"Education",{"href":1381,"dataGaName":1382,"dataGaLocation":1226},"/solutions/education/","education",{"text":1384,"config":1385},"Financial services",{"href":1386,"dataGaName":1387,"dataGaLocation":1226},"/solutions/finance/","financial services",{"title":937,"links":1389},[1390,1392,1394,1396,1399,1401,1404,1406,1408,1410,1412,1414,1416,1418],{"text":950,"config":1391},{"href":952,"dataGaName":953,"dataGaLocation":1226},{"text":955,"config":1393},{"href":957,"dataGaName":958,"dataGaLocation":1226},{"text":960,"config":1395},{"href":962,"dataGaName":963,"dataGaLocation":1226},{"text":965,"config":1397},{"href":967,"dataGaName":1398,"dataGaLocation":1226},"docs",{"text":988,"config":1400},{"href":990,"dataGaName":991,"dataGaLocation":1226},{"text":1402,"config":1403},"What's new",{"href":1048,"dataGaName":1049,"dataGaLocation":1226},{"text":983,"config":1405},{"href":985,"dataGaName":986,"dataGaLocation":1226},{"text":1002,"config":1407},{"href":1004,"dataGaName":1005,"dataGaLocation":1226},{"text":1010,"config":1409},{"href":1012,"dataGaName":1013,"dataGaLocation":1226},{"text":1015,"config":1411},{"href":1017,"dataGaName":1018,"dataGaLocation":1226},{"text":1020,"config":1413},{"href":1022,"dataGaName":1023,"dataGaLocation":1226},{"text":1025,"config":1415},{"href":1027,"dataGaName":1028,"dataGaLocation":1226},{"text":1030,"config":1417},{"href":1032,"dataGaName":1033,"dataGaLocation":1226},{"text":1035,"config":1419},{"href":1037,"dataGaName":1038,"dataGaLocation":1226},{"title":1051,"links":1421},[1422,1424,1426,1428,1430,1432,1436,1441,1443,1445,1447],{"text":1059,"config":1423},{"href":1061,"dataGaName":1053,"dataGaLocation":1226},{"text":1064,"config":1425},{"href":1066,"dataGaName":1067,"dataGaLocation":1226},{"text":1072,"config":1427},{"href":1074,"dataGaName":1075,"dataGaLocation":1226},{"text":1077,"config":1429},{"href":1079,"dataGaName":1080,"dataGaLocation":1226},{"text":1082,"config":1431},{"href":1084,"dataGaName":1085,"dataGaLocation":1226},{"text":1433,"config":1434},"Sustainability",{"href":1435,"dataGaName":1433,"dataGaLocation":1226},"/sustainability/",{"text":1437,"config":1438},"Diversity, inclusion and belonging (DIB)",{"href":1439,"dataGaName":1440,"dataGaLocation":1226},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1087,"config":1442},{"href":1089,"dataGaName":1090,"dataGaLocation":1226},{"text":1097,"config":1444},{"href":1099,"dataGaName":1100,"dataGaLocation":1226},{"text":1102,"config":1446},{"href":1104,"dataGaName":1105,"dataGaLocation":1226},{"text":1448,"config":1449},"Modern Slavery Transparency Statement",{"href":1450,"dataGaName":1451,"dataGaLocation":1226},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1453},[1454,1457,1460],{"text":1455,"config":1456},"Terms",{"href":1278,"dataGaName":1279,"dataGaLocation":1226},{"text":1458,"config":1459},"Cookies",{"dataGaName":1288,"dataGaLocation":1226,"id":1289,"isOneTrustButton":769},{"text":1461,"config":1462},"Privacy",{"href":1283,"dataGaName":1284,"dataGaLocation":1226},[1464],{"id":1465,"title":7,"body":765,"config":1466,"content":1468,"description":765,"extension":1471,"meta":1472,"navigation":769,"path":1473,"seo":1474,"stem":1475,"__hash__":1476},"blogAuthors/en-us/blog/authors/wayne-haber.yml",{"template":1467},"BlogAuthor",{"name":7,"config":1469},{"headshot":755,"ctfId":1470},"whaber","yml",{},"/en-us/blog/authors/wayne-haber",{},"en-us/blog/authors/wayne-haber","bHVPtZoskSj8VvsaFqG_4drVYnZCFtMyDZ6u2YsBDOE",[1478,1486,1494],{"title":1479,"description":1480,"heroImage":1481,"category":761,"date":1482,"authors":1483,"slug":1485,"externalUrl":765},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1484],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1487,"description":1488,"heroImage":1481,"category":761,"date":1489,"authors":1490,"slug":1493,"externalUrl":765},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1491,1492],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1495,"description":1496,"heroImage":1497,"category":761,"date":1498,"authors":1499,"slug":1501,"externalUrl":765},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1500],"Alisa Ho","claude-security-and-gitlab",{"promotions":1503},[1504,1518,1530,1541],{"id":1505,"categories":1506,"header":1508,"text":1509,"button":1510,"image":1515},"ai-modernization",[1507],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1511,"config":1512},"Get your AI maturity score",{"href":1513,"dataGaName":1514,"dataGaLocation":991},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1516},{"src":1517},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1519,"categories":1520,"header":1522,"text":1509,"button":1523,"image":1527},"devops-modernization",[1521,1328],"product","Are you just managing tools or shipping innovation?",{"text":1524,"config":1525},"Get your DevOps maturity score",{"href":1526,"dataGaName":1514,"dataGaLocation":991},"/assessments/devops-modernization-assessment/",{"config":1528},{"src":1529},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1531,"categories":1532,"header":1533,"text":1509,"button":1534,"image":1538},"security-modernization",[761],"Are you trading speed for security?",{"text":1535,"config":1536},"Get your security maturity score",{"href":1537,"dataGaName":1514,"dataGaLocation":991},"/assessments/security-modernization-assessment/",{"config":1539},{"src":1540},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1542,"paths":1543,"header":1546,"text":1547,"button":1548,"image":1553},"github-azure-migration",[1544,1545],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1549,"config":1550},"See how GitLab compares to GitHub",{"href":1551,"dataGaName":1552,"dataGaLocation":991},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1554},{"src":1529},{"header":1556,"blurb":1557,"button":1558,"secondaryButton":1563},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1559,"config":1560},"Get your free trial",{"href":1561,"dataGaName":790,"dataGaLocation":1562},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1264,"config":1564},{"href":1116,"dataGaName":795,"dataGaLocation":1562},1786803774252]