[{"data":1,"prerenderedAt":1946},["ShallowReactive",2],{"/blog/use-gitlab-to-detect-vulnerabilities":3,"navigation-en-us":1164,"banner-en-us":1589,"footer-en-us":1599,"blog-post-authors-en-us-GitLab":1844,"blog-related-posts-en-us-use-gitlab-to-detect-vulnerabilities":1859,"blog-promotions-en-us":1883,"next-steps-en-us":1936},{"id":4,"title":5,"authors":6,"body":8,"category":1143,"date":1144,"description":1145,"extension":1146,"externalUrl":1147,"faq":1147,"featured":1148,"heroImage":1149,"meta":1150,"navigation":304,"path":1151,"seo":1152,"slug":1156,"stem":1157,"tags":1158,"template":1162,"updatedDate":1147,"__hash__":1163},"blogPosts/en-us/blog/use-gitlab-to-detect-vulnerabilities.md","How to use GitLab security features to detect log4j vulnerabilities",[7],"GitLab",{"type":9,"value":10,"toc":1136},"minimark",[11,24,35,38,41,69,78,83,97,108,130,137,175,178,185,188,194,205,211,223,231,235,256,269,276,367,370,376,382,387,390,396,403,407,422,431,500,506,661,769,780,800,814,817,840,855,860,866,871,878,882,891,932,938,1061,1070,1105,1109,1117,1132],[12,13,14],"p",{},[15,16,17,18,23],"em",{},"Note: Out of an abundance of caution, we encourage users who are using older versions of GitLab SAST and Dependency Scanning to update to the latest versions. You can find more information and recommended actions in ",[19,20,22],"a",{"href":21},"/blog/updates-and-actions-to-address-logj-in-gitlab/","this blog post",".",[12,25,26],{},[15,27,28,29,34],{},"Any customer leveraging the ",[19,30,33],{"href":31,"rel":32},"https://docs.gitlab.com/user/application_security/sast/#configure-sast-in-your-cicd-yaml",[],"recommended includes"," for GitLab SAST has automatically received the new patched versions released Dec 13, 2021.",[12,36,37],{},"In light of the recently discovered log4j vulnerabilities, we would like to demonstrate how GitLab can be used to assess and remediate the log4j vulnerability as well as other security vulnerabilities that may exist in your projects.",[12,39,40],{},"The solutions shared here are:",[42,43,44,51,57,63],"ul",{},[45,46,47],"li",{},[19,48,50],{"href":49},"#use-gitlab-dependency-scanning-to-detect-and-mitigate-log4j-vulnerabilities","Dependency Scanning (Ultimate)",[45,52,53],{},[19,54,56],{"href":55},"#detect-log4j-vulnerabilities-with-container-scanning","Container Scanning (Ultimate)",[45,58,59],{},[19,60,62],{"href":61},"#detect-vulnerable-containers-in-your-kubernetes-cluster","Cluster image scanning (Ultimate)",[45,64,65],{},[19,66,68],{"href":67},"#search-gitlab-projects-which-use-the-log4j-java-library","Advanced Search (Premium)",[12,70,71,72,77],{},"Free users wishing to access Premium and Ultimate features can do so by signing up for a ",[19,73,76],{"href":74,"rel":75},"https://about.gitlab.com/free-trial/",[],"free trial"," of GitLab.",[79,80,82],"h3",{"id":81},"use-gitlab-dependency-scanning-to-detect-and-mitigate-log4j-vulnerabilities","Use GitLab dependency scanning to detect and mitigate log4j vulnerabilities",[12,84,85,90,91,96],{},[19,86,89],{"href":87,"rel":88},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency scanning"," uses Gemnasium, which has been ",[19,92,95],{"href":93,"rel":94},"https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/merge_requests/11381",[],"updated"," to detect the log4j vulnerability, to automatically find security vulnerabilities in your software dependencies.",[12,98,99,100,104,105,23],{},"Let’s try dependency scanning with a vulnerable project. Navigate to ",[101,102,103],"code",{},"Create new project > Import project > from URL"," and use ",[101,106,107],{},"https://github.com/christophetd/log4shell-vulnerable-app.git",[12,109,110,111,114,115,118,119,124,125,23],{},"Next, navigate to ",[101,112,113],{},"Security & Compliance > Security dashboard"," and select to configure ",[101,116,117],{},"Dependency Scanning",". This will create a new merge request enabling the dependency scanner, and you can immediately see the first ",[19,120,123],{"href":121,"rel":122},"https://gitlab.com/gitlab-da/playground/log4shell-vulnerable-app/-/pipelines/427550530/security",[],"scanning results"," in the ",[19,126,129],{"href":127,"rel":128},"https://gitlab.com/gitlab-da/playground/log4shell-vulnerable-app/-/merge_requests/1",[],"merge request",[12,131,132,133,136],{},"Alternatively, you can edit the ",[101,134,135],{},".gitlab-ci.yml"," configuration file and include the Dependency Scanning CI/CD template.",[138,139,144],"pre",{"className":140,"code":141,"language":142,"meta":143,"style":143},"language-yaml shiki shiki-themes github-light","include:\n- template: Security/Dependency-Scanning.gitlab-ci.yml\n","yaml","",[101,145,146,159],{"__ignoreMap":143},[147,148,151,155],"span",{"class":149,"line":150},"line",1,[147,152,154],{"class":153},"shJU0","include",[147,156,158],{"class":157},"sgsFI",":\n",[147,160,162,165,168,171],{"class":149,"line":161},2,[147,163,164],{"class":157},"- ",[147,166,167],{"class":153},"template",[147,169,170],{"class":157},": ",[147,172,174],{"class":173},"sYBdl","Security/Dependency-Scanning.gitlab-ci.yml\n",[12,176,177],{},"Create a new merge request and wait for the pipeline to finish. Inspect the security reports.",[12,179,180],{},[181,182],"img",{"alt":183,"src":184},"GitLab security report","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397670/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image2.png",[12,186,187],{},"Take action on the critical vulnerability, open the details and create a new confidential security issue to follow-up.",[12,189,190],{},[181,191],{"alt":192,"src":193},"Details of security vulnerability","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397672/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image9.png",[12,195,196,197,200,201,204],{},"After merging the MR to add dependency scanning, future MRs and code changes will detect the log4j vulnerabilities. This helps to avoid accidentally introducing older versions again. Open the ",[101,198,199],{},"Security report"," in ",[101,202,203],{},"Security & Compliance"," to get an overview of the vulnerabilities.",[12,206,207],{},[181,208],{"alt":209,"src":210},"Panel showing security vulnerabilities","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397670/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image4.png",[12,212,213,214,219,220,23],{},"You can customize the default settings using ",[19,215,218],{"href":216,"rel":217},"https://docs.gitlab.com/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings",[],"CI/CD variables",", for example increasing the log level to debug with ",[101,221,222],{},"SECURE_LOG_LEVEL: ‘debug’",[12,224,225,226,23],{},"The project created in the examples above is located ",[19,227,230],{"href":228,"rel":229},"https://gitlab.com/gitlab-da/playground/log4shell-vulnerable-app",[],"here",[79,232,234],{"id":233},"detect-log4j-vulnerabilities-with-container-scanning","Detect log4j vulnerabilities with Container Scanning",[12,236,237,238,241,242,245,246,251,252,255],{},"Vulnerabilities in container images can come not only from the source code for the application, but also from packages and libraries that are installed on the base image. Images can inherit packages and vulnerabilities from other container images using the ",[101,239,240],{},"FROM"," keyword in a ",[101,243,244],{},"Dockerfile",". ",[19,247,250],{"href":248,"rel":249},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"Container Scanning"," helps detect these vulnerabilities for the Operating System including packages. The latest release adds language vulnerability scans as a new optional feature to help detect the log4j library vulnerability using the underlying scanners (Trivy as default, Grype optional). You can also use this capability to scan remote images using the ",[101,253,254],{},"DOCKER_IMAGE"," variable.",[12,257,258,259,262,263,268],{},"You can enable the ",[101,260,261],{},"CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN"," variable to ",[19,264,267],{"href":265,"rel":266},"https://docs.gitlab.com/user/application_security/container_scanning/#report-language-specific-findings",[],"scan for language specific packages",". Please note that the additionally detected language dependencies can cause duplicates when you enable Dependency Scanning too.",[12,270,271,272,275],{},"To try it, navigate to ",[101,273,274],{},"CI/CD > Pipeline Editor"," and add the following configuration for Container Scanning:",[138,277,279],{"className":140,"code":278,"language":142,"meta":143,"style":143},"include:\n    - template: Security/Container-Scanning.gitlab-ci.yml\n\nvariables:\n    # Use Trivy or Grype as security scanners (Trivy is the default in the included template)\n    # CS_ANALYZER_IMAGE: \"registry.gitlab.com/security-products/container-scanning/trivy:4\"\n    # CS_ANALYZER_IMAGE: \"registry.gitlab.com/security-products/container-scanning/grype:4\"\n    # Detect language libraries as dependencies\n    CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN: \"false\"\n    # Test the vulnerable log4j image\n    DOCKER_IMAGE: registry.gitlab.com/gitlab-da/playground/log4shell-vulnerable-app:latest\n\n",[101,280,281,287,299,306,314,321,327,333,339,350,356],{"__ignoreMap":143},[147,282,283,285],{"class":149,"line":150},[147,284,154],{"class":153},[147,286,158],{"class":157},[147,288,289,292,294,296],{"class":149,"line":161},[147,290,291],{"class":157},"    - ",[147,293,167],{"class":153},[147,295,170],{"class":157},[147,297,298],{"class":173},"Security/Container-Scanning.gitlab-ci.yml\n",[147,300,302],{"class":149,"line":301},3,[147,303,305],{"emptyLinePlaceholder":304},true,"\n",[147,307,309,312],{"class":149,"line":308},4,[147,310,311],{"class":153},"variables",[147,313,158],{"class":157},[147,315,317],{"class":149,"line":316},5,[147,318,320],{"class":319},"sAwPA","    # Use Trivy or Grype as security scanners (Trivy is the default in the included template)\n",[147,322,324],{"class":149,"line":323},6,[147,325,326],{"class":319},"    # CS_ANALYZER_IMAGE: \"registry.gitlab.com/security-products/container-scanning/trivy:4\"\n",[147,328,330],{"class":149,"line":329},7,[147,331,332],{"class":319},"    # CS_ANALYZER_IMAGE: \"registry.gitlab.com/security-products/container-scanning/grype:4\"\n",[147,334,336],{"class":149,"line":335},8,[147,337,338],{"class":319},"    # Detect language libraries as dependencies\n",[147,340,342,345,347],{"class":149,"line":341},9,[147,343,344],{"class":153},"    CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN",[147,346,170],{"class":157},[147,348,349],{"class":173},"\"false\"\n",[147,351,353],{"class":149,"line":352},10,[147,354,355],{"class":319},"    # Test the vulnerable log4j image\n",[147,357,359,362,364],{"class":149,"line":358},11,[147,360,361],{"class":153},"    DOCKER_IMAGE",[147,363,170],{"class":157},[147,365,366],{"class":173},"registry.gitlab.com/gitlab-da/playground/log4shell-vulnerable-app:latest\n",[12,368,369],{},"Create a new branch, commit the changes and create a new MR. Once the pipeline has completed, inspect the security report in the MR.",[12,371,372],{},[181,373],{"alt":374,"src":375},"List of vulnerabilities detected by container scanning","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397672/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image6.png",[12,377,378,379,23],{},"After merging the MR, you can view the vulnerabilities that exist in your default branch by navigating to ",[101,380,381],{},"Security & Compliance > Vulnerability Report",[12,383,384],{},[181,385],{"alt":209,"src":386},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397672/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image7.png",[12,388,389],{},"Inspect the vulnerability details to take action.",[12,391,392],{},[181,393],{"alt":394,"src":395},"Detail on vulnerability","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397672/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image8.png",[12,397,398,399,402],{},"This feature is available for customers using the default CI/CD templates, or the tagged ",[101,400,401],{},":4"," scanner images from  GitLab's Container Registry (registry.gitlab.com). If you are using custom images, please rebuild them based on the latest release.",[79,404,406],{"id":405},"detect-vulnerable-containers-in-your-kubernetes-cluster","Detect vulnerable containers in your Kubernetes cluster",[12,408,409,410,415,416,421],{},"You can use ",[19,411,414],{"href":412,"rel":413},"https://docs.gitlab.com/user/clusters/agent/vulnerabilities/",[],"cluster image scanning in Kubernetes"," which uses Starboard and ",[19,417,420],{"href":418,"rel":419},"https://aquasecurity.github.io/starboard/v0.13.1/integrations/vulnerability-scanners/trivy/",[],"uses Trivy as a security scanner"," under the hood. Trivy’s vulnerability DB is able to detect CVE-2021-44228.",[12,423,424,425,430],{},"Let’s try it! A quick way to bring up a Kubernetes cluster is in Civo Cloud. Create an account, and follow the documentation on ",[19,426,429],{"href":427,"rel":428},"https://www.civo.com/learn/kubernetes-cluster-administration-using-civo-cli",[],"how to set up the CLI"," with an API token. Next, create a k3s cluster.",[138,432,436],{"className":433,"code":434,"language":435,"meta":143,"style":143},"language-shell shiki shiki-themes github-light","$ civo kubernetes create log4j\n$ civo kubernetes config log4j --save\n$ kubectl config use-context log4j\n$ kubectl get node\n","shell",[101,437,438,456,474,488],{"__ignoreMap":143},[147,439,440,444,447,450,453],{"class":149,"line":150},[147,441,443],{"class":442},"s7eDp","$",[147,445,446],{"class":173}," civo",[147,448,449],{"class":173}," kubernetes",[147,451,452],{"class":173}," create",[147,454,455],{"class":173}," log4j\n",[147,457,458,460,462,464,467,470],{"class":149,"line":161},[147,459,443],{"class":442},[147,461,446],{"class":173},[147,463,449],{"class":173},[147,465,466],{"class":173}," config",[147,468,469],{"class":173}," log4j",[147,471,473],{"class":472},"sYu0t"," --save\n",[147,475,476,478,481,483,486],{"class":149,"line":301},[147,477,443],{"class":442},[147,479,480],{"class":173}," kubectl",[147,482,466],{"class":173},[147,484,485],{"class":173}," use-context",[147,487,455],{"class":173},[147,489,490,492,494,497],{"class":149,"line":308},[147,491,443],{"class":442},[147,493,480],{"class":173},[147,495,496],{"class":173}," get",[147,498,499],{"class":173}," node\n",[12,501,502,505],{},[101,503,504],{},"registry.gitlab.com/gitlab-da/playground/log4shell-vulnerable-app:latest"," provides a vulnerable container image we can deploy and then scan.",[138,507,509],{"className":433,"code":508,"language":435,"meta":143,"style":143},"$ vim deployment.yaml\n\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: log4j\nspec:\n  replicas: 2\n  selector:\n    matchLabels:\n      app: log4j\n  template:\n    metadata:\n      labels:\n        app: log4j\n    spec:\n      containers:\n        - image: registry.gitlab.com/gitlab-da/playground/log4shell-vulnerable-app:latest\n          name: log4j\n\n$ kubectl apply -f deployment.yaml\n",[101,510,511,521,525,533,541,546,553,558,566,571,576,583,589,595,601,609,615,621,633,641,646],{"__ignoreMap":143},[147,512,513,515,518],{"class":149,"line":150},[147,514,443],{"class":442},[147,516,517],{"class":173}," vim",[147,519,520],{"class":173}," deployment.yaml\n",[147,522,523],{"class":149,"line":161},[147,524,305],{"emptyLinePlaceholder":304},[147,526,527,530],{"class":149,"line":301},[147,528,529],{"class":442},"apiVersion:",[147,531,532],{"class":173}," apps/v1\n",[147,534,535,538],{"class":149,"line":308},[147,536,537],{"class":442},"kind:",[147,539,540],{"class":173}," Deployment\n",[147,542,543],{"class":149,"line":316},[147,544,545],{"class":442},"metadata:\n",[147,547,548,551],{"class":149,"line":323},[147,549,550],{"class":442},"  name:",[147,552,455],{"class":173},[147,554,555],{"class":149,"line":329},[147,556,557],{"class":442},"spec:\n",[147,559,560,563],{"class":149,"line":335},[147,561,562],{"class":442},"  replicas:",[147,564,565],{"class":472}," 2\n",[147,567,568],{"class":149,"line":341},[147,569,570],{"class":442},"  selector:\n",[147,572,573],{"class":149,"line":352},[147,574,575],{"class":442},"    matchLabels:\n",[147,577,578,581],{"class":149,"line":358},[147,579,580],{"class":442},"      app:",[147,582,455],{"class":173},[147,584,586],{"class":149,"line":585},12,[147,587,588],{"class":442},"  template:\n",[147,590,592],{"class":149,"line":591},13,[147,593,594],{"class":442},"    metadata:\n",[147,596,598],{"class":149,"line":597},14,[147,599,600],{"class":442},"      labels:\n",[147,602,604,607],{"class":149,"line":603},15,[147,605,606],{"class":442},"        app:",[147,608,455],{"class":173},[147,610,612],{"class":149,"line":611},16,[147,613,614],{"class":442},"    spec:\n",[147,616,618],{"class":149,"line":617},17,[147,619,620],{"class":442},"      containers:\n",[147,622,624,627,630],{"class":149,"line":623},18,[147,625,626],{"class":442},"        -",[147,628,629],{"class":173}," image:",[147,631,632],{"class":173}," registry.gitlab.com/gitlab-da/playground/log4shell-vulnerable-app:latest\n",[147,634,636,639],{"class":149,"line":635},19,[147,637,638],{"class":442},"          name:",[147,640,455],{"class":173},[147,642,644],{"class":149,"line":643},20,[147,645,305],{"emptyLinePlaceholder":304},[147,647,649,651,653,656,659],{"class":149,"line":648},21,[147,650,443],{"class":442},[147,652,480],{"class":173},[147,654,655],{"class":173}," apply",[147,657,658],{"class":472}," -f",[147,660,520],{"class":173},[138,662,664],{"className":433,"code":663,"language":435,"meta":143,"style":143},"$ vim service.yaml\n\napiVersion: v1\nkind: Service\nmetadata:\n  name: log4j\n  labels:\n    app: log4j\nspec:\n  ports:\n    - name: \"log4j\"\n      port: 8080\n  selector:\n    app: log4j\n\n$ kubectl apply -f service.yaml\n",[101,665,666,675,679,686,693,697,703,708,715,719,724,735,743,747,753,757],{"__ignoreMap":143},[147,667,668,670,672],{"class":149,"line":150},[147,669,443],{"class":442},[147,671,517],{"class":173},[147,673,674],{"class":173}," service.yaml\n",[147,676,677],{"class":149,"line":161},[147,678,305],{"emptyLinePlaceholder":304},[147,680,681,683],{"class":149,"line":301},[147,682,529],{"class":442},[147,684,685],{"class":173}," v1\n",[147,687,688,690],{"class":149,"line":308},[147,689,537],{"class":442},[147,691,692],{"class":173}," Service\n",[147,694,695],{"class":149,"line":316},[147,696,545],{"class":442},[147,698,699,701],{"class":149,"line":323},[147,700,550],{"class":442},[147,702,455],{"class":173},[147,704,705],{"class":149,"line":329},[147,706,707],{"class":442},"  labels:\n",[147,709,710,713],{"class":149,"line":335},[147,711,712],{"class":442},"    app:",[147,714,455],{"class":173},[147,716,717],{"class":149,"line":341},[147,718,557],{"class":442},[147,720,721],{"class":149,"line":352},[147,722,723],{"class":442},"  ports:\n",[147,725,726,729,732],{"class":149,"line":358},[147,727,728],{"class":442},"    -",[147,730,731],{"class":173}," name:",[147,733,734],{"class":173}," \"log4j\"\n",[147,736,737,740],{"class":149,"line":585},[147,738,739],{"class":442},"      port:",[147,741,742],{"class":472}," 8080\n",[147,744,745],{"class":149,"line":591},[147,746,570],{"class":442},[147,748,749,751],{"class":149,"line":597},[147,750,712],{"class":442},[147,752,455],{"class":173},[147,754,755],{"class":149,"line":603},[147,756,305],{"emptyLinePlaceholder":304},[147,758,759,761,763,765,767],{"class":149,"line":611},[147,760,443],{"class":442},[147,762,480],{"class":173},[147,764,655],{"class":173},[147,766,658],{"class":472},[147,768,674],{"class":173},[12,770,771,772,776,777,23],{},"Test the application container with port forwarding, and open your browser at ",[19,773,775],{"rel":774},[],"http://localhost:80808",". You can close the connection with ",[101,778,779],{},"ctrl+c",[138,781,783],{"className":433,"code":782,"language":435,"meta":143,"style":143},"$ kubectl port-forward service/log4j 8080:8080\n",[101,784,785],{"__ignoreMap":143},[147,786,787,789,791,794,797],{"class":149,"line":150},[147,788,443],{"class":442},[147,790,480],{"class":173},[147,792,793],{"class":173}," port-forward",[147,795,796],{"class":173}," service/log4j",[147,798,799],{"class":173}," 8080:8080\n",[12,801,802,803,808,809,813],{},"After the deployment is finished, let’s add the cluster image scanning integration. Follow the ",[19,804,807],{"href":805,"rel":806},"https://aquasecurity.github.io/starboard/v0.13.1/operator/installation/kubectl/",[],"Starboard Operator"," installation documentation. Next, configure the ",[19,810,812],{"href":412,"rel":811},[],"Kubernetes Cluster Image Scanning"," with GitLab.",[12,815,816],{},"The final step is to integrate the CI/CD template and run the pipelines.",[138,818,820],{"className":140,"code":819,"language":142,"meta":143,"style":143},"include:\n  - template: Security/Cluster-Image-Scanning.gitlab-ci.yml\n\n",[101,821,822,828],{"__ignoreMap":143},[147,823,824,826],{"class":149,"line":150},[147,825,154],{"class":153},[147,827,158],{"class":157},[147,829,830,833,835,837],{"class":149,"line":161},[147,831,832],{"class":157},"  - ",[147,834,167],{"class":153},[147,836,170],{"class":157},[147,838,839],{"class":173},"Security/Cluster-Image-Scanning.gitlab-ci.yml\n",[12,841,842,843,846,847,850,851,854],{},"Navigate into ",[101,844,845],{},"Security & Compliance > Vulnerability report"," and select the ",[101,848,849],{},"Operational vulnerabilities"," tab to inspect the vulnerabilities. There you can see that ",[101,852,853],{},"log4j"," was detected in the deployed application running in our Kubernetes cluster 💜.",[12,856,857],{},[181,858],{"alt":209,"src":859},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397672/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image5.png",[12,861,862,863,865],{},"Inspect the ",[101,864,853],{}," vulnerability to see more details.",[12,867,868],{},[181,869],{"alt":394,"src":870},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397670/blog/Content%20Images/2021-12-15-use-gitlab-to-detect-log4j/image3.png",[12,872,873,874,23],{},"The full project is located ",[19,875,230],{"href":876,"rel":877},"https://gitlab.com/gitlab-da/playground/log4j-kubernetes-container-scanning",[],[79,879,881],{"id":880},"search-gitlab-projects-which-use-the-log4j-java-library","Search GitLab projects which use the log4j Java library",[12,883,884,885,890],{},"You can use the ",[19,886,889],{"href":887,"rel":888},"https://docs.gitlab.com/api/search/#scope-blobs",[],"advanced search with scope blobs",". Let’s try it! Navigate to your profile and add a new personal access token (PAT). Export it into the environment to access it in the next step:",[138,892,894],{"className":433,"code":893,"language":435,"meta":143,"style":143},"$ export GITLAB_TOKEN=xxxxxxxxx\n\n$ curl --header \"PRIVATE-TOKEN: $GITLAB_TOKEN\" \"https://gitlab.com/api/v4/search?scope=blobs&search=log4j\"\n",[101,895,896,906,910],{"__ignoreMap":143},[147,897,898,900,903],{"class":149,"line":150},[147,899,443],{"class":442},[147,901,902],{"class":173}," export",[147,904,905],{"class":173}," GITLAB_TOKEN=xxxxxxxxx\n",[147,907,908],{"class":149,"line":161},[147,909,305],{"emptyLinePlaceholder":304},[147,911,912,914,917,920,923,926,929],{"class":149,"line":301},[147,913,443],{"class":442},[147,915,916],{"class":173}," curl",[147,918,919],{"class":472}," --header",[147,921,922],{"class":173}," \"PRIVATE-TOKEN: ",[147,924,925],{"class":157},"$GITLAB_TOKEN",[147,927,928],{"class":173},"\"",[147,930,931],{"class":173}," \"https://gitlab.com/api/v4/search?scope=blobs&search=log4j\"\n",[12,933,934,935,23],{},"Tip: Install jq to format the JSON body. More insights in ",[19,936,22],{"href":937},"/blog/devops-workflows-json-format-jq-ci-cd-lint/",[138,939,941],{"className":433,"code":940,"language":435,"meta":143,"style":143},"$ curl --header \"PRIVATE-TOKEN: $GITLAB_TOKEN\" \"https://gitlab.com/api/v4/search?scope=blobs&search=log4j\" | jq\n\n  {\n    \"basename\": \"src/main/resources/log4j\",\n    \"data\": \"log4j.rootLogger=ERROR, stdout\\n \\n# Direct log messages to stdout\\n\",\n    \"path\": \"src/main/resources/log4j.properties\",\n    \"filename\": \"src/main/resources/log4j.properties\",\n    \"id\": null,\n    \"ref\": \"9a1df407e1a5365950a77f715163f6dba915fdf4\",\n    \"startline\": 2,\n    \"project_id\": 12345678\n  },\n\n",[101,942,943,967,971,976,987,997,1007,1016,1026,1036,1046,1056],{"__ignoreMap":143},[147,944,945,947,949,951,953,955,957,960,964],{"class":149,"line":150},[147,946,443],{"class":442},[147,948,916],{"class":173},[147,950,919],{"class":472},[147,952,922],{"class":173},[147,954,925],{"class":157},[147,956,928],{"class":173},[147,958,959],{"class":173}," \"https://gitlab.com/api/v4/search?scope=blobs&search=log4j\"",[147,961,963],{"class":962},"sD7c4"," |",[147,965,966],{"class":442}," jq\n",[147,968,969],{"class":149,"line":161},[147,970,305],{"emptyLinePlaceholder":304},[147,972,973],{"class":149,"line":301},[147,974,975],{"class":157},"  {\n",[147,977,978,981,984],{"class":149,"line":308},[147,979,980],{"class":442},"    \"basename\"",[147,982,983],{"class":472},":",[147,985,986],{"class":173}," \"src/main/resources/log4j\",\n",[147,988,989,992,994],{"class":149,"line":316},[147,990,991],{"class":442},"    \"data\"",[147,993,983],{"class":472},[147,995,996],{"class":173}," \"log4j.rootLogger=ERROR, stdout\\n \\n# Direct log messages to stdout\\n\",\n",[147,998,999,1002,1004],{"class":149,"line":323},[147,1000,1001],{"class":442},"    \"path\"",[147,1003,983],{"class":472},[147,1005,1006],{"class":173}," \"src/main/resources/log4j.properties\",\n",[147,1008,1009,1012,1014],{"class":149,"line":329},[147,1010,1011],{"class":442},"    \"filename\"",[147,1013,983],{"class":472},[147,1015,1006],{"class":173},[147,1017,1018,1021,1023],{"class":149,"line":335},[147,1019,1020],{"class":442},"    \"id\"",[147,1022,983],{"class":472},[147,1024,1025],{"class":173}," null,\n",[147,1027,1028,1031,1033],{"class":149,"line":341},[147,1029,1030],{"class":442},"    \"ref\"",[147,1032,983],{"class":472},[147,1034,1035],{"class":173}," \"9a1df407e1a5365950a77f715163f6dba915fdf4\",\n",[147,1037,1038,1041,1043],{"class":149,"line":352},[147,1039,1040],{"class":442},"    \"startline\"",[147,1042,983],{"class":472},[147,1044,1045],{"class":173}," 2,\n",[147,1047,1048,1051,1053],{"class":149,"line":358},[147,1049,1050],{"class":442},"    \"project_id\"",[147,1052,983],{"class":472},[147,1054,1055],{"class":472}," 12345678\n",[147,1057,1058],{"class":149,"line":585},[147,1059,1060],{"class":157},"  },\n",[12,1062,409,1063,1066,1067,1069],{},[101,1064,1065],{},"jq"," to further transform and filter the result set, for example only listing the paths where ",[101,1068,853],{}," as a string exists.",[138,1071,1073],{"className":433,"code":1072,"language":435,"meta":143,"style":143},"curl --header \"PRIVATE-TOKEN: $GITLAB_TOKEN\" \"https://gitlab.com/api/v4/search?scope=blobs&search=log4j\" | jq -c '.[] | select (.path | contains (\"log4j\"))' | jq\n",[101,1074,1075],{"__ignoreMap":143},[147,1076,1077,1080,1082,1084,1086,1088,1090,1092,1095,1098,1101,1103],{"class":149,"line":150},[147,1078,1079],{"class":442},"curl",[147,1081,919],{"class":472},[147,1083,922],{"class":173},[147,1085,925],{"class":157},[147,1087,928],{"class":173},[147,1089,959],{"class":173},[147,1091,963],{"class":962},[147,1093,1094],{"class":442}," jq",[147,1096,1097],{"class":472}," -c",[147,1099,1100],{"class":173}," '.[] | select (.path | contains (\"log4j\"))'",[147,1102,963],{"class":962},[147,1104,966],{"class":442},[79,1106,1108],{"id":1107},"next-steps","Next steps",[12,1110,1111,1112,23],{},"The GitLab security team is continuing to proactively monitor the situation and ensure our product and customers are secure. We will continue to communicate should we identify additional opportunities to help our customers and community navigate through this situation. Please ",[19,1113,1116],{"href":1114,"rel":1115},"https://about.gitlab.com/company/preference-center/",[],"subscribe to our security alerts mailing list",[12,1118,1119,1120,1125,1126,1131],{},"Please visit the public ",[19,1121,1124],{"href":1122,"rel":1123},"https://gitlab.com/gitlab-da/log4j-resources",[],"log4j-resources project"," and visit our ",[19,1127,1130],{"href":1128,"rel":1129},"https://forum.gitlab.com/c/devsecops-security/47",[],"forum"," for additional information.",[1133,1134,1135],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}",{"title":143,"searchDepth":161,"depth":161,"links":1137},[1138,1139,1140,1141,1142],{"id":81,"depth":301,"text":82},{"id":233,"depth":301,"text":234},{"id":405,"depth":301,"text":406},{"id":880,"depth":301,"text":881},{"id":1107,"depth":301,"text":1108},"company","2021-12-15","Detailed guidance to help customers detect vulnerabilities.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749666816/Blog/Hero%20Images/security-cover.png",{},"/en-us/blog/use-gitlab-to-detect-vulnerabilities",{"title":5,"description":1145,"ogTitle":5,"ogDescription":1145,"noIndex":1148,"ogImage":1149,"ogUrl":1153,"ogSiteName":1154,"ogType":1155,"canonicalUrls":1153},"https://about.gitlab.com/blog/use-gitlab-to-detect-vulnerabilities","https://about.gitlab.com","article","use-gitlab-to-detect-vulnerabilities","en-us/blog/use-gitlab-to-detect-vulnerabilities",[1159,1160,1161],"security","kubernetes","tutorial","BlogPost","jdmq91ENgt4moDaCK1n1_JaFD3LXK4uoUi-hIqGOnhY",{"logo":1165,"freeTrial":1170,"sales":1174,"login":1179,"items":1184,"search":1509,"minimal":1540,"duo":1559,"switchNav":1568,"pricingDeployment":1579},{"config":1166},{"href":1167,"dataGaName":1168,"dataGaLocation":1169},"/","gitlab logo","header",{"text":1171,"config":1172},"Get free trial",{"href":1173,"dataGaName":76,"dataGaLocation":1169},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/",{"text":1175,"config":1176},"Request a demo",{"href":1177,"dataGaName":1178,"dataGaLocation":1169},"/sales/?contact-topic=request-demo","sales",{"text":1180,"config":1181},"Sign in",{"href":1182,"dataGaName":1183,"dataGaLocation":1169},"https://gitlab.com/users/sign_in/","sign in",[1185,1214,1314,1319,1432,1487],{"text":1186,"config":1187,"menu":1189},"Platform",{"dataNavLevelOne":1188},"platform",{"type":1190,"columns":1191},"cards",[1192,1198,1206],{"title":1186,"description":1193,"link":1194},"The intelligent orchestration platform for DevSecOps",{"text":1195,"config":1196},"Explore our Platform",{"href":1197,"dataGaName":1188,"dataGaLocation":1169},"/platform/",{"title":1199,"description":1200,"link":1201},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1202,"config":1203},"Meet GitLab Duo",{"href":1204,"dataGaName":1205,"dataGaLocation":1169},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1207,"description":1208,"link":1209},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1210,"config":1211},"Learn more",{"href":1212,"dataGaName":1213,"dataGaLocation":1169},"/why-gitlab/","why gitlab",{"text":1215,"left":304,"config":1216,"menu":1218},"Product",{"dataNavLevelOne":1217},"solutions",{"type":1219,"link":1220,"columns":1224,"feature":1293},"lists",{"text":1221,"config":1222},"View all Solutions",{"href":1223,"dataGaName":1217,"dataGaLocation":1169},"/solutions/",[1225,1249,1272],{"title":1226,"description":1227,"link":1228,"items":1233},"Automation","CI/CD and automation to accelerate deployment",{"config":1229},{"icon":1230,"href":1231,"dataGaName":1232,"dataGaLocation":1169},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1234,1238,1241,1245],{"text":1235,"config":1236},"CI/CD",{"href":1237,"dataGaLocation":1169,"dataGaName":1235},"/solutions/continuous-integration/",{"text":1199,"config":1239},{"href":1204,"dataGaLocation":1169,"dataGaName":1240},"gitlab duo agent platform - product menu",{"text":1242,"config":1243},"Source Code Management",{"href":1244,"dataGaLocation":1169,"dataGaName":1242},"/solutions/source-code-management/",{"text":1246,"config":1247},"Automated Software Delivery",{"href":1231,"dataGaLocation":1169,"dataGaName":1248},"Automated software delivery",{"title":1250,"description":1251,"link":1252,"items":1257},"Security","Deliver code faster without compromising security",{"config":1253},{"href":1254,"dataGaName":1255,"dataGaLocation":1169,"icon":1256},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1258,1262,1267],{"text":1259,"config":1260},"Application Security Testing",{"href":1254,"dataGaName":1261,"dataGaLocation":1169},"Application security testing",{"text":1263,"config":1264},"Software Supply Chain Security",{"href":1265,"dataGaLocation":1169,"dataGaName":1266},"/solutions/supply-chain/","Software supply chain security",{"text":1268,"config":1269},"Software Compliance",{"href":1270,"dataGaName":1271,"dataGaLocation":1169},"/solutions/software-compliance/","software compliance",{"title":1273,"link":1274,"items":1279},"Measurement",{"config":1275},{"icon":1276,"href":1277,"dataGaName":1278,"dataGaLocation":1169},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1280,1284,1288],{"text":1281,"config":1282},"Visibility & Measurement",{"href":1277,"dataGaLocation":1169,"dataGaName":1283},"Visibility and Measurement",{"text":1285,"config":1286},"Value Stream Management",{"href":1287,"dataGaLocation":1169,"dataGaName":1285},"/solutions/value-stream-management/",{"text":1289,"config":1290},"Analytics & Insights",{"href":1291,"dataGaLocation":1169,"dataGaName":1292},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1294,"type":1219,"items":1295},"GitLab for",[1296,1302,1308],{"text":1297,"config":1298},"Enterprise",{"icon":1299,"href":1300,"dataGaLocation":1169,"dataGaName":1301},"Building","/enterprise/","enterprise",{"text":1303,"config":1304},"Small Business",{"icon":1305,"href":1306,"dataGaLocation":1169,"dataGaName":1307},"Work","/small-business/","small business",{"text":1309,"config":1310},"Public Sector",{"icon":1311,"href":1312,"dataGaLocation":1169,"dataGaName":1313},"Organization","/solutions/public-sector/","public sector",{"text":1315,"config":1316},"Pricing",{"href":1317,"dataGaName":1318,"dataGaLocation":1169,"dataNavLevelOne":1318},"/pricing/","pricing",{"text":1320,"config":1321,"menu":1323},"Resources",{"dataNavLevelOne":1322},"resources",{"type":1219,"link":1324,"columns":1328,"feature":1421},{"text":1325,"config":1326},"View all resources",{"href":1327,"dataGaName":1322,"dataGaLocation":1169},"/resources/",[1329,1362,1389],{"title":1330,"items":1331},"Getting started",[1332,1337,1342,1347,1352,1357],{"text":1333,"config":1334},"Install",{"href":1335,"dataGaName":1336,"dataGaLocation":1169},"/install/","install",{"text":1338,"config":1339},"Quick start guides",{"href":1340,"dataGaName":1341,"dataGaLocation":1169},"/get-started/","quick setup checklists",{"text":1343,"config":1344},"Learn",{"href":1345,"dataGaLocation":1169,"dataGaName":1346},"https://university.gitlab.com/","learn",{"text":1348,"config":1349},"Product documentation",{"href":1350,"dataGaName":1351,"dataGaLocation":1169},"https://docs.gitlab.com/","product documentation",{"text":1353,"config":1354},"Best practice videos",{"href":1355,"dataGaName":1356,"dataGaLocation":1169},"/getting-started-videos/","best practice videos",{"text":1358,"config":1359},"Integrations",{"href":1360,"dataGaName":1361,"dataGaLocation":1169},"/integrations/","integrations",{"title":1363,"items":1364},"Discover",[1365,1370,1375,1380,1384],{"text":1366,"config":1367},"Customer success stories",{"href":1368,"dataGaName":1369,"dataGaLocation":1169},"/customers/","customer success stories",{"text":1371,"config":1372},"Blog",{"href":1373,"dataGaName":1374,"dataGaLocation":1169},"/blog/","blog",{"text":1376,"config":1377},"Demo Hub",{"href":1378,"dataGaName":1379,"dataGaLocation":1169},"/demo-hub/","demo hub",{"text":1381,"config":1382},"The Source",{"href":1383,"dataGaName":1374,"dataGaLocation":1169},"/the-source/",{"text":1385,"config":1386},"Remote",{"href":1387,"dataGaName":1388,"dataGaLocation":1169},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1390,"items":1391},"Connect",[1392,1397,1402,1407,1411,1416],{"text":1393,"config":1394},"GitLab Services",{"href":1395,"dataGaName":1396,"dataGaLocation":1169},"/services/","services",{"text":1398,"config":1399},"Contribute",{"href":1400,"dataGaName":1401,"dataGaLocation":1169},"https://contributors.gitlab.com","contribute",{"text":1403,"config":1404},"Community",{"href":1405,"dataGaName":1406,"dataGaLocation":1169},"/community/","community",{"text":1408,"config":1409},"Forum",{"href":1410,"dataGaName":1130,"dataGaLocation":1169},"https://forum.gitlab.com/",{"text":1412,"config":1413},"Events",{"href":1414,"dataGaName":1415,"dataGaLocation":1169},"/events/","events",{"text":1417,"config":1418},"Partners",{"href":1419,"dataGaName":1420,"dataGaLocation":1169},"/partners/","partners",{"config":1422,"title":1425,"text":1426,"link":1427},{"background":1423,"textColor":1424},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1428,"config":1429},"Read the latest",{"href":1430,"dataGaName":1431,"dataGaLocation":1169},"/whats-new/","whats new",{"text":1433,"config":1434,"menu":1435},"Company",{"dataNavLevelOne":1143},{"type":1219,"columns":1436},[1437],{"items":1438},[1439,1444,1450,1452,1457,1462,1467,1472,1477,1482],{"text":1440,"config":1441},"About",{"href":1442,"dataGaName":1443,"dataGaLocation":1169},"/company/","about",{"text":1445,"config":1446,"footerGa":1449},"Jobs",{"href":1447,"dataGaName":1448,"dataGaLocation":1169},"/jobs/","jobs",{"dataGaName":1448},{"text":1412,"config":1451},{"href":1414,"dataGaName":1415,"dataGaLocation":1169},{"text":1453,"config":1454},"Leadership",{"href":1455,"dataGaName":1456,"dataGaLocation":1169},"/company/team/e-group/","leadership",{"text":1458,"config":1459},"Handbook",{"href":1460,"dataGaName":1461,"dataGaLocation":1169},"https://handbook.gitlab.com/","handbook",{"text":1463,"config":1464},"Investor relations",{"href":1465,"dataGaName":1466,"dataGaLocation":1169},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1468,"config":1469},"Trust Center",{"href":1470,"dataGaName":1471,"dataGaLocation":1169},"/security/","trust center",{"text":1473,"config":1474},"AI Transparency Center",{"href":1475,"dataGaName":1476,"dataGaLocation":1169},"/ai-transparency-center/","ai transparency center",{"text":1478,"config":1479},"Newsletter",{"href":1480,"dataGaName":1481,"dataGaLocation":1169},"/company/contact/#contact-forms","newsletter",{"text":1483,"config":1484},"Press",{"href":1485,"dataGaName":1486,"dataGaLocation":1169},"/press/","press",{"text":1488,"config":1489,"menu":1490},"Contact us",{"dataNavLevelOne":1143},{"type":1219,"columns":1491},[1492],{"items":1493},[1494,1499,1504],{"text":1495,"config":1496},"Talk to sales",{"href":1497,"dataGaName":1498,"dataGaLocation":1169},"/sales/","talk to sales",{"text":1500,"config":1501},"Support portal",{"href":1502,"dataGaName":1503,"dataGaLocation":1169},"https://support.gitlab.com/hc/en-us","support portal",{"text":1505,"config":1506},"Customer portal",{"href":1507,"dataGaName":1508,"dataGaLocation":1169},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1510,"login":1511,"suggestions":1518},"Close",{"text":1512,"link":1513},"To search repositories and projects, login to",{"text":1514,"config":1515},"gitlab.com",{"href":1182,"dataGaName":1516,"dataGaLocation":1517},"search login","search",{"text":1519,"default":1520},"Suggestions",[1521,1523,1527,1529,1533,1537],{"text":1199,"config":1522},{"href":1204,"dataGaName":1199,"dataGaLocation":1517},{"text":1524,"config":1525},"Code Suggestions (AI)",{"href":1526,"dataGaName":1524,"dataGaLocation":1517},"/solutions/code-suggestions/",{"text":1235,"config":1528},{"href":1237,"dataGaName":1235,"dataGaLocation":1517},{"text":1530,"config":1531},"GitLab on AWS",{"href":1532,"dataGaName":1530,"dataGaLocation":1517},"/partners/technology-partners/aws/",{"text":1534,"config":1535},"GitLab on Google Cloud",{"href":1536,"dataGaName":1534,"dataGaLocation":1517},"/partners/technology-partners/google-cloud-platform/",{"text":1538,"config":1539},"Why GitLab?",{"href":1212,"dataGaName":1538,"dataGaLocation":1517},{"freeTrial":1541,"mobileIcon":1546,"desktopIcon":1551,"secondaryButton":1554},{"text":1542,"config":1543},"Start free trial",{"href":1544,"dataGaName":76,"dataGaLocation":1545},"https://gitlab.com/-/trials/new/","nav",{"altText":1547,"config":1548},"Gitlab Icon",{"src":1549,"dataGaName":1550,"dataGaLocation":1545},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1547,"config":1552},{"src":1553,"dataGaName":1550,"dataGaLocation":1545},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1555,"config":1556},"Get Started",{"href":1557,"dataGaName":1558,"dataGaLocation":1545},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1560,"mobileIcon":1564,"desktopIcon":1566},{"text":1561,"config":1562},"Learn more about GitLab Duo",{"href":1204,"dataGaName":1563,"dataGaLocation":1545},"gitlab duo",{"altText":1547,"config":1565},{"src":1549,"dataGaName":1550,"dataGaLocation":1545},{"altText":1547,"config":1567},{"src":1553,"dataGaName":1550,"dataGaLocation":1545},{"button":1569,"mobileIcon":1574,"desktopIcon":1576},{"text":1570,"config":1571},"/switch",{"href":1572,"dataGaName":1573,"dataGaLocation":1545},"#contact","switch",{"altText":1547,"config":1575},{"src":1549,"dataGaName":1550,"dataGaLocation":1545},{"altText":1547,"config":1577},{"src":1578,"dataGaName":1550,"dataGaLocation":1545},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1580,"mobileIcon":1585,"desktopIcon":1587},{"text":1581,"config":1582},"Back to pricing",{"href":1317,"dataGaName":1583,"dataGaLocation":1545,"icon":1584},"back to pricing","GoBack",{"altText":1547,"config":1586},{"src":1549,"dataGaName":1550,"dataGaLocation":1545},{"altText":1547,"config":1588},{"src":1553,"dataGaName":1550,"dataGaLocation":1545},{"title":1590,"titleMobile":1591,"button":1592,"config":1597},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1210,"config":1593},{"href":1594,"dataGaName":1595,"dataGaLocation":1596},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1598,"disabled":1148},"release",{"data":1600},{"text":1601,"source":1602,"edit":1608,"contribute":1613,"config":1618,"items":1623,"minimal":1833},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1603,"config":1604},"View page source",{"href":1605,"dataGaName":1606,"dataGaLocation":1607},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1609,"config":1610},"Edit this page",{"href":1611,"dataGaName":1612,"dataGaLocation":1607},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1614,"config":1615},"Please contribute",{"href":1616,"dataGaName":1617,"dataGaLocation":1607},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1619,"facebook":1620,"youtube":1621,"linkedin":1622},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1624,1671,1725,1769,1801],{"title":1315,"links":1625,"subMenu":1640},[1626,1630,1635],{"text":1627,"config":1628},"View plans",{"href":1317,"dataGaName":1629,"dataGaLocation":1607},"view plans",{"text":1631,"config":1632},"Why Premium?",{"href":1633,"dataGaName":1634,"dataGaLocation":1607},"/pricing/premium/","why premium",{"text":1636,"config":1637},"Why Ultimate?",{"href":1638,"dataGaName":1639,"dataGaLocation":1607},"/pricing/ultimate/","why ultimate",[1641],{"title":1642,"links":1643},"Contact Us",[1644,1647,1649,1651,1656,1661,1666],{"text":1645,"config":1646},"Contact sales",{"href":1497,"dataGaName":1178,"dataGaLocation":1607},{"text":1500,"config":1648},{"href":1502,"dataGaName":1503,"dataGaLocation":1607},{"text":1505,"config":1650},{"href":1507,"dataGaName":1508,"dataGaLocation":1607},{"text":1652,"config":1653},"Status",{"href":1654,"dataGaName":1655,"dataGaLocation":1607},"https://status.gitlab.com/","status",{"text":1657,"config":1658},"Terms of use",{"href":1659,"dataGaName":1660,"dataGaLocation":1607},"/terms/","terms of use",{"text":1662,"config":1663},"Privacy statement",{"href":1664,"dataGaName":1665,"dataGaLocation":1607},"/privacy/","privacy statement",{"text":1667,"config":1668},"Cookie preferences",{"dataGaName":1669,"dataGaLocation":1607,"id":1670,"isOneTrustButton":304},"cookie preferences","ot-sdk-btn",{"title":1215,"links":1672,"subMenu":1681},[1673,1677],{"text":1674,"config":1675},"DevSecOps platform",{"href":1197,"dataGaName":1676,"dataGaLocation":1607},"devsecops platform",{"text":1678,"config":1679},"AI-Assisted Development",{"href":1204,"dataGaName":1680,"dataGaLocation":1607},"ai-assisted development",[1682],{"title":1683,"links":1684},"Topics",[1685,1690,1695,1700,1705,1710,1715,1720],{"text":1686,"config":1687},"CICD",{"href":1688,"dataGaName":1689,"dataGaLocation":1607},"/topics/ci-cd/","cicd",{"text":1691,"config":1692},"GitOps",{"href":1693,"dataGaName":1694,"dataGaLocation":1607},"/topics/gitops/","gitops",{"text":1696,"config":1697},"DevOps",{"href":1698,"dataGaName":1699,"dataGaLocation":1607},"/topics/devops/","devops",{"text":1701,"config":1702},"Version Control",{"href":1703,"dataGaName":1704,"dataGaLocation":1607},"/topics/version-control/","version control",{"text":1706,"config":1707},"DevSecOps",{"href":1708,"dataGaName":1709,"dataGaLocation":1607},"/topics/devsecops/","devsecops",{"text":1711,"config":1712},"Cloud Native",{"href":1713,"dataGaName":1714,"dataGaLocation":1607},"/topics/cloud-native/","cloud native",{"text":1716,"config":1717},"AI for Coding",{"href":1718,"dataGaName":1719,"dataGaLocation":1607},"/topics/devops/ai-for-coding/","ai for coding",{"text":1721,"config":1722},"Agentic AI",{"href":1723,"dataGaName":1724,"dataGaLocation":1607},"/topics/agentic-ai/","agentic ai",{"title":1726,"links":1727},"Solutions",[1728,1730,1732,1737,1741,1744,1748,1751,1753,1756,1759,1764],{"text":1259,"config":1729},{"href":1254,"dataGaName":1259,"dataGaLocation":1607},{"text":1248,"config":1731},{"href":1231,"dataGaName":1232,"dataGaLocation":1607},{"text":1733,"config":1734},"Agile development",{"href":1735,"dataGaName":1736,"dataGaLocation":1607},"/solutions/agile-delivery/","agile delivery",{"text":1738,"config":1739},"SCM",{"href":1244,"dataGaName":1740,"dataGaLocation":1607},"source code management",{"text":1686,"config":1742},{"href":1237,"dataGaName":1743,"dataGaLocation":1607},"continuous integration & delivery",{"text":1745,"config":1746},"Value stream management",{"href":1287,"dataGaName":1747,"dataGaLocation":1607},"value stream management",{"text":1691,"config":1749},{"href":1750,"dataGaName":1694,"dataGaLocation":1607},"/solutions/gitops/",{"text":1297,"config":1752},{"href":1300,"dataGaName":1301,"dataGaLocation":1607},{"text":1754,"config":1755},"Small business",{"href":1306,"dataGaName":1307,"dataGaLocation":1607},{"text":1757,"config":1758},"Public sector",{"href":1312,"dataGaName":1313,"dataGaLocation":1607},{"text":1760,"config":1761},"Education",{"href":1762,"dataGaName":1763,"dataGaLocation":1607},"/solutions/education/","education",{"text":1765,"config":1766},"Financial services",{"href":1767,"dataGaName":1768,"dataGaLocation":1607},"/solutions/finance/","financial services",{"title":1320,"links":1770},[1771,1773,1775,1777,1780,1782,1785,1787,1789,1791,1793,1795,1797,1799],{"text":1333,"config":1772},{"href":1335,"dataGaName":1336,"dataGaLocation":1607},{"text":1338,"config":1774},{"href":1340,"dataGaName":1341,"dataGaLocation":1607},{"text":1343,"config":1776},{"href":1345,"dataGaName":1346,"dataGaLocation":1607},{"text":1348,"config":1778},{"href":1350,"dataGaName":1779,"dataGaLocation":1607},"docs",{"text":1371,"config":1781},{"href":1373,"dataGaName":1374,"dataGaLocation":1607},{"text":1783,"config":1784},"What's new",{"href":1430,"dataGaName":1431,"dataGaLocation":1607},{"text":1366,"config":1786},{"href":1368,"dataGaName":1369,"dataGaLocation":1607},{"text":1385,"config":1788},{"href":1387,"dataGaName":1388,"dataGaLocation":1607},{"text":1393,"config":1790},{"href":1395,"dataGaName":1396,"dataGaLocation":1607},{"text":1398,"config":1792},{"href":1400,"dataGaName":1401,"dataGaLocation":1607},{"text":1403,"config":1794},{"href":1405,"dataGaName":1406,"dataGaLocation":1607},{"text":1408,"config":1796},{"href":1410,"dataGaName":1130,"dataGaLocation":1607},{"text":1412,"config":1798},{"href":1414,"dataGaName":1415,"dataGaLocation":1607},{"text":1417,"config":1800},{"href":1419,"dataGaName":1420,"dataGaLocation":1607},{"title":1433,"links":1802},[1803,1805,1807,1809,1811,1813,1817,1822,1824,1826,1828],{"text":1440,"config":1804},{"href":1442,"dataGaName":1143,"dataGaLocation":1607},{"text":1445,"config":1806},{"href":1447,"dataGaName":1448,"dataGaLocation":1607},{"text":1453,"config":1808},{"href":1455,"dataGaName":1456,"dataGaLocation":1607},{"text":1458,"config":1810},{"href":1460,"dataGaName":1461,"dataGaLocation":1607},{"text":1463,"config":1812},{"href":1465,"dataGaName":1466,"dataGaLocation":1607},{"text":1814,"config":1815},"Sustainability",{"href":1816,"dataGaName":1814,"dataGaLocation":1607},"/sustainability/",{"text":1818,"config":1819},"Diversity, inclusion and belonging (DIB)",{"href":1820,"dataGaName":1821,"dataGaLocation":1607},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1468,"config":1823},{"href":1470,"dataGaName":1471,"dataGaLocation":1607},{"text":1478,"config":1825},{"href":1480,"dataGaName":1481,"dataGaLocation":1607},{"text":1483,"config":1827},{"href":1485,"dataGaName":1486,"dataGaLocation":1607},{"text":1829,"config":1830},"Modern Slavery Transparency Statement",{"href":1831,"dataGaName":1832,"dataGaLocation":1607},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1834},[1835,1838,1841],{"text":1836,"config":1837},"Terms",{"href":1659,"dataGaName":1660,"dataGaLocation":1607},{"text":1839,"config":1840},"Cookies",{"dataGaName":1669,"dataGaLocation":1607,"id":1670,"isOneTrustButton":304},{"text":1842,"config":1843},"Privacy",{"href":1664,"dataGaName":1665,"dataGaLocation":1607},[1845],{"id":1846,"title":1847,"body":1147,"config":1848,"content":1850,"description":1147,"extension":1853,"meta":1854,"navigation":304,"path":1855,"seo":1856,"stem":1857,"__hash__":1858},"blogAuthors/en-us/blog/authors/gitlab.yml","Gitlab",{"template":1849},"BlogAuthor",{"name":7,"config":1851},{"headshot":1852,"ctfId":7},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","yml",{},"/en-us/blog/authors/gitlab",{},"en-us/blog/authors/gitlab","XCBKIcPoCs6zi2oHG7o-bAp52Jhaw8_zGhIJ2jNrEjU",[1860,1868,1875],{"title":1861,"description":1862,"heroImage":1863,"category":1143,"date":1864,"authors":1865,"slug":1867,"externalUrl":1147},"Why GitLab signed the Open Weights and American AI Leadership letter","GitLab supports customer choice, data privacy, and AI model neutrality, empowering teams to run secure, cost-effective, local solutions.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1785333264/ww4mlighwlvvzgnmbe6w.png","2026-07-29",[1866],"Bill Staples","open-weight-model-letter",{"title":1869,"description":1870,"heroImage":1871,"category":1143,"date":1872,"authors":1873,"slug":1874,"externalUrl":1147},"GitLab Act 2","A letter to our customers and our investors.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1776362275/ozbwn9tk0dditpnfddlz.png","2026-05-11",[1866],"gitlab-act-2",{"title":1876,"description":1877,"heroImage":1878,"category":1143,"date":1879,"authors":1880,"slug":1882,"externalUrl":1147},"GitLab named a 2026 Omdia Universe Leader","Omdia's 2026 report on AI-assisted software development ranked 19 vendors. Here is what GitLab's top scores mean for engineering teams.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774465167/n5hlvrsrheadeccyr1oz.png","2026-04-13",[1881],"Rebecca Carter","gitlab-named-a-2026-omdia-universe-leader",{"promotions":1884},[1885,1899,1911,1922],{"id":1886,"categories":1887,"header":1889,"text":1890,"button":1891,"image":1896},"ai-modernization",[1888],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1892,"config":1893},"Get your AI maturity score",{"href":1894,"dataGaName":1895,"dataGaLocation":1374},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1897},{"src":1898},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1900,"categories":1901,"header":1903,"text":1890,"button":1904,"image":1908},"devops-modernization",[1902,1709],"product","Are you just managing tools or shipping innovation?",{"text":1905,"config":1906},"Get your DevOps maturity score",{"href":1907,"dataGaName":1895,"dataGaLocation":1374},"/assessments/devops-modernization-assessment/",{"config":1909},{"src":1910},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1912,"categories":1913,"header":1914,"text":1890,"button":1915,"image":1919},"security-modernization",[1159],"Are you trading speed for security?",{"text":1916,"config":1917},"Get your security maturity score",{"href":1918,"dataGaName":1895,"dataGaLocation":1374},"/assessments/security-modernization-assessment/",{"config":1920},{"src":1921},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1923,"paths":1924,"header":1927,"text":1928,"button":1929,"image":1934},"github-azure-migration",[1925,1926],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1930,"config":1931},"See how GitLab compares to GitHub",{"href":1932,"dataGaName":1933,"dataGaLocation":1374},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1935},{"src":1910},{"header":1937,"blurb":1938,"button":1939,"secondaryButton":1944},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1940,"config":1941},"Get your free trial",{"href":1942,"dataGaName":76,"dataGaLocation":1943},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1645,"config":1945},{"href":1497,"dataGaName":1178,"dataGaLocation":1943},1786803774654]