[{"data":1,"prerenderedAt":1415},["ShallowReactive",2],{"/blog/vulnerability-risk-prioritization-made-simple-with-gitlab":3,"navigation-en-us":631,"banner-en-us":1058,"footer-en-us":1068,"blog-post-authors-en-us-Fernando Diaz":1312,"blog-related-posts-en-us-vulnerability-risk-prioritization-made-simple-with-gitlab":1327,"blog-promotions-en-us":1352,"next-steps-en-us":1405},{"id":4,"title":5,"authors":6,"body":8,"category":611,"date":612,"description":613,"extension":614,"externalUrl":615,"faq":615,"featured":354,"heroImage":616,"meta":617,"navigation":354,"path":618,"seo":619,"slug":624,"stem":625,"tags":626,"template":629,"updatedDate":615,"__hash__":630},"blogPosts/en-us/blog/vulnerability-risk-prioritization-made-simple-with-gitlab.md","Vulnerability risk prioritization made simple with GitLab",[7],"Fernando Diaz",{"type":9,"value":10,"toc":600},"minimark",[11,46,53,59,63,66,69,82,85,88,91,94,108,111,114,117,120,134,137,141,144,155,158,170,173,184,187,200,204,207,291,299,372,381,397,400,406,412,416,419,421,424,447,450,466,470,477,483,487,489,491,494,500,504,510,513,545,548,560,564,567,596],[12,13,14,15,21,22,27,28,33,34,39,40,45],"p",{},"Development and security teams are often overwhelmed by the number of vulnerabilities they need to remediate. Many organizations remediate ",[16,17,20],"a",{"href":18,"rel":19},"https://arxiv.org/pdf/2302.14172",[],"less than 16%"," of their known vulnerabilities monthly. Vulnerability management teams face a constant challenge: which security flaws deserve immediate attention? Three key frameworks help answer this question: Common Vulnerability Scoring System (",[16,23,26],{"href":24,"rel":25},"https://nvd.nist.gov/vuln-metrics/cvss",[],"CVSS","), Known Exploited Vulnerabilities (",[16,29,32],{"href":30,"rel":31},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog",[],"KEV","), and Exploit Prediction Scoring System (",[16,35,38],{"href":36,"rel":37},"https://www.first.org/epss/",[],"EPSS","). The ",[16,41,44],{"href":42,"rel":43},"https://docs.gitlab.com/releases/17/gitlab-17-9-released/",[],"GitLab 17.9 release"," adds support for these frameworks. In this article, you'll learn how to use these frameworks within GitLab to efficiently prioritize risk across your dependency and container image vulnerabilities using this data.",[12,47,48],{},[49,50],"img",{"alt":51,"src":52},"Vulnerability risk assessment data","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749674763/Blog/Content%20Images/vulnerability_data.png",[54,55,56],"center",{},[57,58,51],"em",{},[60,61,26],"h2",{"id":62},"cvss",[12,64,65],{},"CVSS provides a standardized method for rating the severity of security vulnerabilities. Scores range from 0 to 10, with higher values indicating greater severity.",[12,67,68],{},"CVSS evaluates vulnerabilities across three dimension groups:",[70,71,72,76,79],"ul",{},[73,74,75],"li",{},"Base metrics: intrinsic qualities that don't change over time (attack complexity, privileges   required)",[73,77,78],{},"Temporal metrics: factors that evolve (exploit maturity, remediation level)",[73,80,81],{},"Environmental metrics: organization-specific impact considerations",[12,83,84],{},"CVSS offers a consistent severity baseline and common language for security teams. Its comprehensive scoring methodology considers multiple aspects of a vulnerability's technical impact.",[60,86,32],{"id":87},"kev",[12,89,90],{},"The Cybersecurity and Infrastructure Security Agency (CISA) maintains the KEV catalog, which identifies vulnerabilities actively exploited in the wild.",[12,92,93],{},"Unlike academic severity scores, KEV focuses on real-world threat intelligence. Each entry includes:",[70,95,96,99,102,105],{},[73,97,98],{},"CVE identifier",[73,100,101],{},"Vulnerability name",[73,103,104],{},"Action required",[73,106,107],{},"Due date for remediation (for federal agencies)",[12,109,110],{},"KEV provides actionable intelligence based on observed threat actor behavior. It cuts through scoring complexity with a binary signal: \"This vulnerability is being actively exploited right now.\"",[60,112,38],{"id":113},"epss",[12,115,116],{},"The EPSS uses machine learning to predict the likelihood a vulnerability will be exploited in the next 30 days. Scores range from 0 to 1 (or 0%-100%), representing probability.",[12,118,119],{},"EPSS analyzes hundreds of factors, including:",[70,121,122,125,128,131],{},[73,123,124],{},"Technical characteristics",[73,126,127],{},"Social media mentions",[73,129,130],{},"Exploit availability",[73,132,133],{},"Vulnerability age",[12,135,136],{},"EPSS brings risk-based prioritization to vulnerability management. Rather than focusing solely on technical severity, it helps teams understand which vulnerabilities attackers are most likely to target.",[60,138,140],{"id":139},"combining-the-frameworks-for-effective-prioritization","Combining the frameworks for effective prioritization",[12,142,143],{},"Each framework serves a unique purpose:",[70,145,146,149,152],{},[73,147,148],{},"CVSS indicates how severe a vulnerability is technically.",[73,150,151],{},"KEV indicates which vulnerabilities are actively being exploited.",[73,153,154],{},"EPSS indicates which vulnerabilities are likely to be exploited soon.",[12,156,157],{},"An effective prioritization strategy leverages all three:",[159,160,161,164,167],"ol",{},[73,162,163],{},"Start with KEV-listed vulnerabilities as immediate priorities.",[73,165,166],{},"Use EPSS to identify high-probability threats not yet on KEV.",[73,168,169],{},"Consider CVSS for understanding technical impact.",[12,171,172],{},"By combining these complementary frameworks, security teams can focus limited resources on the vulnerabilities that pose the greatest actual risk to their organizations. You can get started with prioritizing vulnerabilities with GitLab by:",[159,174,175,178,181],{},[73,176,177],{},"Adding security scanners to your pipeline",[73,179,180],{},"Viewing vulnerability insights",[73,182,183],{},"Setting the vulnerability status based metrics",[12,185,186],{},"Watch this video to learn more:",[188,189,192,193],"figure",{"className":190},[191],"video_container","\n  ",[194,195,199],"iframe",{"src":196,"frameBorder":197,"allowFullScreen":198},"https://www.youtube.com/embed/7-dWwoKfCHw?si=iC73JCRsxPUEWKf-","0","true"," ",[201,202,177],"h3",{"id":203},"adding-security-scanners-to-your-pipeline",[12,205,206],{},"GitLab provides built-in security scanning tools through its templates that can be integrated directly into your CI/CD pipeline. GitLab offers several security scanners that address different aspects of your application security:",[70,208,209,221,231,241,251,261,271,281],{},[73,210,211,220],{},[212,213,214,219],"strong",{},[16,215,218],{"href":216,"rel":217},"https://docs.gitlab.com/user/application_security/sast/",[],"Static Application Security Testing (SAST)",":"," Analyzes your source code for known vulnerabilities",[73,222,223,230],{},[212,224,225,219],{},[16,226,229],{"href":227,"rel":228},"https://docs.gitlab.com/user/application_security/dast/",[],"Dynamic Application Security Testing (DAST)"," Tests your running application for vulnerabilities",[73,232,233,240],{},[212,234,235,219],{},[16,236,239],{"href":237,"rel":238},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency Scanning"," Checks your dependencies for known vulnerabilities",[73,242,243,250],{},[212,244,245,219],{},[16,246,249],{"href":247,"rel":248},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"Container Scanning"," Identifies vulnerabilities in container images",[73,252,253,260],{},[212,254,255,219],{},[16,256,259],{"href":257,"rel":258},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"Secret Detection"," Finds secrets and credentials accidentally committed to your repository",[73,262,263,270],{},[212,264,265,219],{},[16,266,269],{"href":267,"rel":268},"https://docs.gitlab.com/user/application_security/iac_scanning/",[],"Infrastructure as Code Scanning"," Detects security issues in IaC files",[73,272,273,280],{},[212,274,275,219],{},[16,276,279],{"href":277,"rel":278},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/",[],"Coverage-guided Fuzzing"," Sends random inputs to an instrumented version of your application in an effort to detect bugs",[73,282,283,290],{},[212,284,285,219],{},[16,286,289],{"href":287,"rel":288},"https://docs.gitlab.com/user/application_security/api_fuzzing/",[],"Web API Fuzzing"," Sets operation parameters to unexpected values in an effort to cause unexpected behavior and errors in the API backend",[12,292,293,294,298],{},"To add them to your pipeline, simply add the appropriate templates to ",[295,296,297],"code",{},".gitlab-ci.yml"," file. For example, adding SAST and Dependency Scanning to your pipeline is as simple as:",[300,301,306],"pre",{"className":302,"code":303,"language":304,"meta":305,"style":305},"language-yaml shiki shiki-themes github-light","include:\n  - template: Security/SAST.gitlab-ci.yml\n  - template: Security/Dependency-Scanning.gitlab-ci.yml\n\nstages:\n  - test\n\n","yaml","",[295,307,308,321,337,349,356,364],{"__ignoreMap":305},[309,310,313,317],"span",{"class":311,"line":312},"line",1,[309,314,316],{"class":315},"shJU0","include",[309,318,320],{"class":319},"sgsFI",":\n",[309,322,324,327,330,333],{"class":311,"line":323},2,[309,325,326],{"class":319},"  - ",[309,328,329],{"class":315},"template",[309,331,332],{"class":319},": ",[309,334,336],{"class":335},"sYBdl","Security/SAST.gitlab-ci.yml\n",[309,338,340,342,344,346],{"class":311,"line":339},3,[309,341,326],{"class":319},[309,343,329],{"class":315},[309,345,332],{"class":319},[309,347,348],{"class":335},"Security/Dependency-Scanning.gitlab-ci.yml\n",[309,350,352],{"class":311,"line":351},4,[309,353,355],{"emptyLinePlaceholder":354},true,"\n",[309,357,359,362],{"class":311,"line":358},5,[309,360,361],{"class":315},"stages",[309,363,320],{"class":319},[309,365,367,369],{"class":311,"line":366},6,[309,368,326],{"class":319},[309,370,371],{"class":335},"test\n",[12,373,374,375,380],{},"Once you commit the above changes, security scanners will begin to run. These scanners can be further configured to meet the needs of your organization. To learn more about our various scanners, see the ",[16,376,379],{"href":377,"rel":378},"https://docs.gitlab.com/user/application_security/",[],"GitLab application security documentation",".",[12,382,383,386,387,391,392,396],{},[212,384,385],{},"Note:"," EPSS and KEV metrics are only provided for ",[16,388,390],{"href":237,"rel":389},[],"dependency"," and ",[16,393,395],{"href":247,"rel":394},[],"container image"," vulnerabilities.",[201,398,180],{"id":399},"viewing-vulnerability-insights",[12,401,402,403,380],{},"Once a pipeline with your security scanners is run on the default branch, you can access the vulnerability report. The vulnerability report provides a consolidated view of all security vulnerabilities detected across your project by GitLab's security scanners. You can access it from your project by going to the side-tab and selecting ",[212,404,405],{},"Secure > Vulnerability Report",[12,407,408],{},[49,409],{"alt":410,"src":411},"Vulnerability report grouped by tool","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749674763/Blog/Content%20Images/vulnerability_report__1_.png",[54,413,414],{},[57,415,410],{},[417,418],"br",{},[417,420],{},[12,422,423],{},"From the vulnerability report, select a vulnerability to see its insights page, which includes the severity, EPSS, KEV, and CVSS along with the following:",[70,425,426,429,432,435,438,441,444],{},[73,427,428],{},"description",[73,430,431],{},"when it was detected",[73,433,434],{},"current status",[73,436,437],{},"available actions",[73,439,440],{},"linked issues",[73,442,443],{},"actions log",[73,445,446],{},"filename and line number of the vulnerability (if available)",[12,448,449],{},"This data can be used to effectively triage, remediate, or mitigate the vulnerability.",[12,451,452,454,455,391,460,465],{},[212,453,385],{}," From the insights page, you can also leverage GitLab Duo’s AI capabilities to ",[16,456,459],{"href":457,"rel":458},"https://docs.gitlab.com/user/application_security/vulnerabilities/#vulnerability-explanation",[],"explain",[16,461,464],{"href":462,"rel":463},"https://docs.gitlab.com/user/application_security/vulnerabilities/#vulnerability-resolution",[],"auto-resolve"," a vulnerability.",[201,467,469],{"id":468},"setting-the-vulnerability-status-based-metrics","Setting the vulnerability status-based metrics",[12,471,472,473,476],{},"After examining the provided data, we can go ahead and change the status of our vulnerability by clicking the ",[212,474,475],{},"Change status"," button:",[12,478,479],{},[49,480],{"alt":481,"src":482},"Change vulnerability status from insights page","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749674764/Blog/Content%20Images/change_status.png",[54,484,485],{},[57,486,481],{},[417,488],{},[417,490],{},[12,492,493],{},"Then we'll see a popup that will allow you to change the status of a vulnerability:",[12,495,496],{},[49,497],{"alt":498,"src":499},"Change vulnerability status option","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749674763/Blog/Content%20Images/change_status_2.png",[54,501,502],{},[57,503,498],{},[12,505,506,508],{},[417,507],{},[417,509],{},[12,511,512],{},"When you dismiss a vulnerability you can choose one of the following reasons and optionally provide a comment:",[70,514,515,521,527,533,539],{},[73,516,517,520],{},[212,518,519],{},"Acceptable risk:"," The vulnerability is known, and has not been remediated or mitigated, but is considered to be an acceptable business risk.",[73,522,523,526],{},[212,524,525],{},"False positive:"," An error in reporting in which a test result incorrectly indicates the presence of a vulnerability in a system when the vulnerability is not present.",[73,528,529,532],{},[212,530,531],{},"Mitigating control:"," The vulnerability’s risk is mitigated by a management, operational, or technical control (that is, safeguard or countermeasure) employed by an organization that provides equivalent or comparable protection for an information system.",[73,534,535,538],{},[212,536,537],{},"Used in tests:"," The finding is not a vulnerability because it is part of a test or is test data.",[73,540,541,544],{},[212,542,543],{},"Not applicable:"," The vulnerability is known, and has not been remediated or mitigated, but is considered to be in a part of the application that will not be updated.",[12,546,547],{},"And there you have it, quick and easy vulnerability risk prioritization with GitLab!",[549,550,551],"blockquote",{},[12,552,553,554,559],{},"Get started today with ",[16,555,558],{"href":556,"rel":557},"https://about.gitlab.com/pricing/ultimate/",[],"a free trial of GitLab Ultimate","!",[60,561,563],{"id":562},"learn-more","Learn more",[12,565,566],{},"To learn more about GitLab security and governance features and how we can help enhance your security posture, check out the following resources:",[70,568,569,576,583,589],{},[73,570,571],{},[16,572,575],{"href":573,"rel":574},"https://docs.gitlab.com/user/application_security/vulnerabilities/risk_assessment_data/",[],"GitLab Risk Assessment Data",[73,577,578],{},[16,579,582],{"href":580,"rel":581},"https://about.gitlab.com/solutions/application-security-testing/",[],"GitLab Security and Compliance Solutions",[73,584,585],{},[16,586,588],{"href":377,"rel":587},[],"GitLab Application Security documentation",[73,590,591],{},[16,592,595],{"href":593,"rel":594},"https://gitlab.com/groups/gitlab-org/-/epics/11544",[],"GitLab Risk Assessment Data epic",[597,598,599],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":305,"searchDepth":323,"depth":323,"links":601},[602,603,604,605,610],{"id":62,"depth":323,"text":26},{"id":87,"depth":323,"text":32},{"id":113,"depth":323,"text":38},{"id":139,"depth":323,"text":140,"children":606},[607,608,609],{"id":203,"depth":339,"text":177},{"id":399,"depth":339,"text":180},{"id":468,"depth":339,"text":469},{"id":562,"depth":323,"text":563},"security","2025-03-12","GitLab provides detailed vulnerability risk data to assess the potential impact of detected vulnerabilities. Learn how this enables teams to effectively prioritize remediation efforts.","md",null,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749674528/Blog/Hero%20Images/blog-image-template-1800x945__5_.png",{},"/en-us/blog/vulnerability-risk-prioritization-made-simple-with-gitlab",{"title":5,"description":613,"ogTitle":5,"ogDescription":613,"noIndex":620,"ogImage":616,"ogUrl":621,"ogSiteName":622,"ogType":623,"canonicalUrls":621},false,"https://about.gitlab.com/blog/vulnerability-risk-prioritization-made-simple-with-gitlab","https://about.gitlab.com","article","vulnerability-risk-prioritization-made-simple-with-gitlab","en-us/blog/vulnerability-risk-prioritization-made-simple-with-gitlab",[627,611,628],"tutorial","DevSecOps","BlogPost","Q7sDNsQ3GYZDplE_YrwbiEwvcv_PAP83ekc9hRgGaro",{"logo":632,"freeTrial":637,"sales":642,"login":647,"items":652,"search":978,"minimal":1009,"duo":1028,"switchNav":1037,"pricingDeployment":1048},{"config":633},{"href":634,"dataGaName":635,"dataGaLocation":636},"/","gitlab logo","header",{"text":638,"config":639},"Get free trial",{"href":640,"dataGaName":641,"dataGaLocation":636},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":643,"config":644},"Request a demo",{"href":645,"dataGaName":646,"dataGaLocation":636},"/sales/?contact-topic=request-demo","sales",{"text":648,"config":649},"Sign in",{"href":650,"dataGaName":651,"dataGaLocation":636},"https://gitlab.com/users/sign_in/","sign in",[653,681,781,786,900,956],{"text":654,"config":655,"menu":657},"Platform",{"dataNavLevelOne":656},"platform",{"type":658,"columns":659},"cards",[660,666,674],{"title":654,"description":661,"link":662},"The intelligent orchestration platform for DevSecOps",{"text":663,"config":664},"Explore our Platform",{"href":665,"dataGaName":656,"dataGaLocation":636},"/platform/",{"title":667,"description":668,"link":669},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":670,"config":671},"Meet GitLab Duo",{"href":672,"dataGaName":673,"dataGaLocation":636},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":675,"description":676,"link":677},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":563,"config":678},{"href":679,"dataGaName":680,"dataGaLocation":636},"/why-gitlab/","why gitlab",{"text":682,"left":354,"config":683,"menu":685},"Product",{"dataNavLevelOne":684},"solutions",{"type":686,"link":687,"columns":691,"feature":760},"lists",{"text":688,"config":689},"View all Solutions",{"href":690,"dataGaName":684,"dataGaLocation":636},"/solutions/",[692,716,739],{"title":693,"description":694,"link":695,"items":700},"Automation","CI/CD and automation to accelerate deployment",{"config":696},{"icon":697,"href":698,"dataGaName":699,"dataGaLocation":636},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[701,705,708,712],{"text":702,"config":703},"CI/CD",{"href":704,"dataGaLocation":636,"dataGaName":702},"/solutions/continuous-integration/",{"text":667,"config":706},{"href":672,"dataGaLocation":636,"dataGaName":707},"gitlab duo agent platform - product menu",{"text":709,"config":710},"Source Code Management",{"href":711,"dataGaLocation":636,"dataGaName":709},"/solutions/source-code-management/",{"text":713,"config":714},"Automated Software Delivery",{"href":698,"dataGaLocation":636,"dataGaName":715},"Automated software delivery",{"title":717,"description":718,"link":719,"items":724},"Security","Deliver code faster without compromising security",{"config":720},{"href":721,"dataGaName":722,"dataGaLocation":636,"icon":723},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[725,729,734],{"text":726,"config":727},"Application Security Testing",{"href":721,"dataGaName":728,"dataGaLocation":636},"Application security testing",{"text":730,"config":731},"Software Supply Chain Security",{"href":732,"dataGaLocation":636,"dataGaName":733},"/solutions/supply-chain/","Software supply chain security",{"text":735,"config":736},"Software Compliance",{"href":737,"dataGaName":738,"dataGaLocation":636},"/solutions/software-compliance/","software compliance",{"title":740,"link":741,"items":746},"Measurement",{"config":742},{"icon":743,"href":744,"dataGaName":745,"dataGaLocation":636},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[747,751,755],{"text":748,"config":749},"Visibility & Measurement",{"href":744,"dataGaLocation":636,"dataGaName":750},"Visibility and Measurement",{"text":752,"config":753},"Value Stream Management",{"href":754,"dataGaLocation":636,"dataGaName":752},"/solutions/value-stream-management/",{"text":756,"config":757},"Analytics & Insights",{"href":758,"dataGaLocation":636,"dataGaName":759},"/solutions/analytics-and-insights/","Analytics and insights",{"title":761,"type":686,"items":762},"GitLab for",[763,769,775],{"text":764,"config":765},"Enterprise",{"icon":766,"href":767,"dataGaLocation":636,"dataGaName":768},"Building","/enterprise/","enterprise",{"text":770,"config":771},"Small Business",{"icon":772,"href":773,"dataGaLocation":636,"dataGaName":774},"Work","/small-business/","small business",{"text":776,"config":777},"Public Sector",{"icon":778,"href":779,"dataGaLocation":636,"dataGaName":780},"Organization","/solutions/public-sector/","public sector",{"text":782,"config":783},"Pricing",{"href":784,"dataGaName":785,"dataGaLocation":636,"dataNavLevelOne":785},"/pricing/","pricing",{"text":787,"config":788,"menu":790},"Resources",{"dataNavLevelOne":789},"resources",{"type":686,"link":791,"columns":795,"feature":889},{"text":792,"config":793},"View all resources",{"href":794,"dataGaName":789,"dataGaLocation":636},"/resources/",[796,829,856],{"title":797,"items":798},"Getting started",[799,804,809,814,819,824],{"text":800,"config":801},"Install",{"href":802,"dataGaName":803,"dataGaLocation":636},"/install/","install",{"text":805,"config":806},"Quick start guides",{"href":807,"dataGaName":808,"dataGaLocation":636},"/get-started/","quick setup checklists",{"text":810,"config":811},"Learn",{"href":812,"dataGaLocation":636,"dataGaName":813},"https://university.gitlab.com/","learn",{"text":815,"config":816},"Product documentation",{"href":817,"dataGaName":818,"dataGaLocation":636},"https://docs.gitlab.com/","product documentation",{"text":820,"config":821},"Best practice videos",{"href":822,"dataGaName":823,"dataGaLocation":636},"/getting-started-videos/","best practice videos",{"text":825,"config":826},"Integrations",{"href":827,"dataGaName":828,"dataGaLocation":636},"/integrations/","integrations",{"title":830,"items":831},"Discover",[832,837,842,847,851],{"text":833,"config":834},"Customer success stories",{"href":835,"dataGaName":836,"dataGaLocation":636},"/customers/","customer success stories",{"text":838,"config":839},"Blog",{"href":840,"dataGaName":841,"dataGaLocation":636},"/blog/","blog",{"text":843,"config":844},"Demo Hub",{"href":845,"dataGaName":846,"dataGaLocation":636},"/demo-hub/","demo hub",{"text":848,"config":849},"The Source",{"href":850,"dataGaName":841,"dataGaLocation":636},"/the-source/",{"text":852,"config":853},"Remote",{"href":854,"dataGaName":855,"dataGaLocation":636},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":857,"items":858},"Connect",[859,864,869,874,879,884],{"text":860,"config":861},"GitLab Services",{"href":862,"dataGaName":863,"dataGaLocation":636},"/services/","services",{"text":865,"config":866},"Contribute",{"href":867,"dataGaName":868,"dataGaLocation":636},"https://contributors.gitlab.com","contribute",{"text":870,"config":871},"Community",{"href":872,"dataGaName":873,"dataGaLocation":636},"/community/","community",{"text":875,"config":876},"Forum",{"href":877,"dataGaName":878,"dataGaLocation":636},"https://forum.gitlab.com/","forum",{"text":880,"config":881},"Events",{"href":882,"dataGaName":883,"dataGaLocation":636},"/events/","events",{"text":885,"config":886},"Partners",{"href":887,"dataGaName":888,"dataGaLocation":636},"/partners/","partners",{"config":890,"title":893,"text":894,"link":895},{"background":891,"textColor":892},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":896,"config":897},"Read the latest",{"href":898,"dataGaName":899,"dataGaLocation":636},"/whats-new/","whats new",{"text":901,"config":902,"menu":904},"Company",{"dataNavLevelOne":903},"company",{"type":686,"columns":905},[906],{"items":907},[908,913,919,921,926,931,936,941,946,951],{"text":909,"config":910},"About",{"href":911,"dataGaName":912,"dataGaLocation":636},"/company/","about",{"text":914,"config":915,"footerGa":918},"Jobs",{"href":916,"dataGaName":917,"dataGaLocation":636},"/jobs/","jobs",{"dataGaName":917},{"text":880,"config":920},{"href":882,"dataGaName":883,"dataGaLocation":636},{"text":922,"config":923},"Leadership",{"href":924,"dataGaName":925,"dataGaLocation":636},"/company/team/e-group/","leadership",{"text":927,"config":928},"Handbook",{"href":929,"dataGaName":930,"dataGaLocation":636},"https://handbook.gitlab.com/","handbook",{"text":932,"config":933},"Investor relations",{"href":934,"dataGaName":935,"dataGaLocation":636},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":937,"config":938},"Trust Center",{"href":939,"dataGaName":940,"dataGaLocation":636},"/security/","trust center",{"text":942,"config":943},"AI Transparency Center",{"href":944,"dataGaName":945,"dataGaLocation":636},"/ai-transparency-center/","ai transparency center",{"text":947,"config":948},"Newsletter",{"href":949,"dataGaName":950,"dataGaLocation":636},"/company/contact/#contact-forms","newsletter",{"text":952,"config":953},"Press",{"href":954,"dataGaName":955,"dataGaLocation":636},"/press/","press",{"text":957,"config":958,"menu":959},"Contact us",{"dataNavLevelOne":903},{"type":686,"columns":960},[961],{"items":962},[963,968,973],{"text":964,"config":965},"Talk to sales",{"href":966,"dataGaName":967,"dataGaLocation":636},"/sales/","talk to sales",{"text":969,"config":970},"Support portal",{"href":971,"dataGaName":972,"dataGaLocation":636},"https://support.gitlab.com/hc/en-us","support portal",{"text":974,"config":975},"Customer portal",{"href":976,"dataGaName":977,"dataGaLocation":636},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":979,"login":980,"suggestions":987},"Close",{"text":981,"link":982},"To search repositories and projects, login to",{"text":983,"config":984},"gitlab.com",{"href":650,"dataGaName":985,"dataGaLocation":986},"search login","search",{"text":988,"default":989},"Suggestions",[990,992,996,998,1002,1006],{"text":667,"config":991},{"href":672,"dataGaName":667,"dataGaLocation":986},{"text":993,"config":994},"Code Suggestions (AI)",{"href":995,"dataGaName":993,"dataGaLocation":986},"/solutions/code-suggestions/",{"text":702,"config":997},{"href":704,"dataGaName":702,"dataGaLocation":986},{"text":999,"config":1000},"GitLab on AWS",{"href":1001,"dataGaName":999,"dataGaLocation":986},"/partners/technology-partners/aws/",{"text":1003,"config":1004},"GitLab on Google Cloud",{"href":1005,"dataGaName":1003,"dataGaLocation":986},"/partners/technology-partners/google-cloud-platform/",{"text":1007,"config":1008},"Why GitLab?",{"href":679,"dataGaName":1007,"dataGaLocation":986},{"freeTrial":1010,"mobileIcon":1015,"desktopIcon":1020,"secondaryButton":1023},{"text":1011,"config":1012},"Start free trial",{"href":1013,"dataGaName":641,"dataGaLocation":1014},"https://gitlab.com/-/trials/new/","nav",{"altText":1016,"config":1017},"Gitlab Icon",{"src":1018,"dataGaName":1019,"dataGaLocation":1014},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1016,"config":1021},{"src":1022,"dataGaName":1019,"dataGaLocation":1014},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1024,"config":1025},"Get Started",{"href":1026,"dataGaName":1027,"dataGaLocation":1014},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1029,"mobileIcon":1033,"desktopIcon":1035},{"text":1030,"config":1031},"Learn more about GitLab Duo",{"href":672,"dataGaName":1032,"dataGaLocation":1014},"gitlab duo",{"altText":1016,"config":1034},{"src":1018,"dataGaName":1019,"dataGaLocation":1014},{"altText":1016,"config":1036},{"src":1022,"dataGaName":1019,"dataGaLocation":1014},{"button":1038,"mobileIcon":1043,"desktopIcon":1045},{"text":1039,"config":1040},"/switch",{"href":1041,"dataGaName":1042,"dataGaLocation":1014},"#contact","switch",{"altText":1016,"config":1044},{"src":1018,"dataGaName":1019,"dataGaLocation":1014},{"altText":1016,"config":1046},{"src":1047,"dataGaName":1019,"dataGaLocation":1014},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1049,"mobileIcon":1054,"desktopIcon":1056},{"text":1050,"config":1051},"Back to pricing",{"href":784,"dataGaName":1052,"dataGaLocation":1014,"icon":1053},"back to pricing","GoBack",{"altText":1016,"config":1055},{"src":1018,"dataGaName":1019,"dataGaLocation":1014},{"altText":1016,"config":1057},{"src":1022,"dataGaName":1019,"dataGaLocation":1014},{"title":1059,"titleMobile":1060,"button":1061,"config":1066},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":563,"config":1062},{"href":1063,"dataGaName":1064,"dataGaLocation":1065},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1067,"disabled":620},"release",{"data":1069},{"text":1070,"source":1071,"edit":1077,"contribute":1082,"config":1087,"items":1092,"minimal":1301},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1072,"config":1073},"View page source",{"href":1074,"dataGaName":1075,"dataGaLocation":1076},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1078,"config":1079},"Edit this page",{"href":1080,"dataGaName":1081,"dataGaLocation":1076},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1083,"config":1084},"Please contribute",{"href":1085,"dataGaName":1086,"dataGaLocation":1076},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1088,"facebook":1089,"youtube":1090,"linkedin":1091},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1093,1140,1193,1237,1269],{"title":782,"links":1094,"subMenu":1109},[1095,1099,1104],{"text":1096,"config":1097},"View plans",{"href":784,"dataGaName":1098,"dataGaLocation":1076},"view plans",{"text":1100,"config":1101},"Why Premium?",{"href":1102,"dataGaName":1103,"dataGaLocation":1076},"/pricing/premium/","why premium",{"text":1105,"config":1106},"Why Ultimate?",{"href":1107,"dataGaName":1108,"dataGaLocation":1076},"/pricing/ultimate/","why ultimate",[1110],{"title":1111,"links":1112},"Contact Us",[1113,1116,1118,1120,1125,1130,1135],{"text":1114,"config":1115},"Contact sales",{"href":966,"dataGaName":646,"dataGaLocation":1076},{"text":969,"config":1117},{"href":971,"dataGaName":972,"dataGaLocation":1076},{"text":974,"config":1119},{"href":976,"dataGaName":977,"dataGaLocation":1076},{"text":1121,"config":1122},"Status",{"href":1123,"dataGaName":1124,"dataGaLocation":1076},"https://status.gitlab.com/","status",{"text":1126,"config":1127},"Terms of use",{"href":1128,"dataGaName":1129,"dataGaLocation":1076},"/terms/","terms of use",{"text":1131,"config":1132},"Privacy statement",{"href":1133,"dataGaName":1134,"dataGaLocation":1076},"/privacy/","privacy statement",{"text":1136,"config":1137},"Cookie preferences",{"dataGaName":1138,"dataGaLocation":1076,"id":1139,"isOneTrustButton":354},"cookie preferences","ot-sdk-btn",{"title":682,"links":1141,"subMenu":1150},[1142,1146],{"text":1143,"config":1144},"DevSecOps platform",{"href":665,"dataGaName":1145,"dataGaLocation":1076},"devsecops platform",{"text":1147,"config":1148},"AI-Assisted Development",{"href":672,"dataGaName":1149,"dataGaLocation":1076},"ai-assisted development",[1151],{"title":1152,"links":1153},"Topics",[1154,1159,1164,1169,1174,1178,1183,1188],{"text":1155,"config":1156},"CICD",{"href":1157,"dataGaName":1158,"dataGaLocation":1076},"/topics/ci-cd/","cicd",{"text":1160,"config":1161},"GitOps",{"href":1162,"dataGaName":1163,"dataGaLocation":1076},"/topics/gitops/","gitops",{"text":1165,"config":1166},"DevOps",{"href":1167,"dataGaName":1168,"dataGaLocation":1076},"/topics/devops/","devops",{"text":1170,"config":1171},"Version Control",{"href":1172,"dataGaName":1173,"dataGaLocation":1076},"/topics/version-control/","version control",{"text":628,"config":1175},{"href":1176,"dataGaName":1177,"dataGaLocation":1076},"/topics/devsecops/","devsecops",{"text":1179,"config":1180},"Cloud Native",{"href":1181,"dataGaName":1182,"dataGaLocation":1076},"/topics/cloud-native/","cloud native",{"text":1184,"config":1185},"AI for Coding",{"href":1186,"dataGaName":1187,"dataGaLocation":1076},"/topics/devops/ai-for-coding/","ai for coding",{"text":1189,"config":1190},"Agentic AI",{"href":1191,"dataGaName":1192,"dataGaLocation":1076},"/topics/agentic-ai/","agentic ai",{"title":1194,"links":1195},"Solutions",[1196,1198,1200,1205,1209,1212,1216,1219,1221,1224,1227,1232],{"text":726,"config":1197},{"href":721,"dataGaName":726,"dataGaLocation":1076},{"text":715,"config":1199},{"href":698,"dataGaName":699,"dataGaLocation":1076},{"text":1201,"config":1202},"Agile development",{"href":1203,"dataGaName":1204,"dataGaLocation":1076},"/solutions/agile-delivery/","agile delivery",{"text":1206,"config":1207},"SCM",{"href":711,"dataGaName":1208,"dataGaLocation":1076},"source code management",{"text":1155,"config":1210},{"href":704,"dataGaName":1211,"dataGaLocation":1076},"continuous integration & delivery",{"text":1213,"config":1214},"Value stream management",{"href":754,"dataGaName":1215,"dataGaLocation":1076},"value stream management",{"text":1160,"config":1217},{"href":1218,"dataGaName":1163,"dataGaLocation":1076},"/solutions/gitops/",{"text":764,"config":1220},{"href":767,"dataGaName":768,"dataGaLocation":1076},{"text":1222,"config":1223},"Small business",{"href":773,"dataGaName":774,"dataGaLocation":1076},{"text":1225,"config":1226},"Public sector",{"href":779,"dataGaName":780,"dataGaLocation":1076},{"text":1228,"config":1229},"Education",{"href":1230,"dataGaName":1231,"dataGaLocation":1076},"/solutions/education/","education",{"text":1233,"config":1234},"Financial services",{"href":1235,"dataGaName":1236,"dataGaLocation":1076},"/solutions/finance/","financial services",{"title":787,"links":1238},[1239,1241,1243,1245,1248,1250,1253,1255,1257,1259,1261,1263,1265,1267],{"text":800,"config":1240},{"href":802,"dataGaName":803,"dataGaLocation":1076},{"text":805,"config":1242},{"href":807,"dataGaName":808,"dataGaLocation":1076},{"text":810,"config":1244},{"href":812,"dataGaName":813,"dataGaLocation":1076},{"text":815,"config":1246},{"href":817,"dataGaName":1247,"dataGaLocation":1076},"docs",{"text":838,"config":1249},{"href":840,"dataGaName":841,"dataGaLocation":1076},{"text":1251,"config":1252},"What's new",{"href":898,"dataGaName":899,"dataGaLocation":1076},{"text":833,"config":1254},{"href":835,"dataGaName":836,"dataGaLocation":1076},{"text":852,"config":1256},{"href":854,"dataGaName":855,"dataGaLocation":1076},{"text":860,"config":1258},{"href":862,"dataGaName":863,"dataGaLocation":1076},{"text":865,"config":1260},{"href":867,"dataGaName":868,"dataGaLocation":1076},{"text":870,"config":1262},{"href":872,"dataGaName":873,"dataGaLocation":1076},{"text":875,"config":1264},{"href":877,"dataGaName":878,"dataGaLocation":1076},{"text":880,"config":1266},{"href":882,"dataGaName":883,"dataGaLocation":1076},{"text":885,"config":1268},{"href":887,"dataGaName":888,"dataGaLocation":1076},{"title":901,"links":1270},[1271,1273,1275,1277,1279,1281,1285,1290,1292,1294,1296],{"text":909,"config":1272},{"href":911,"dataGaName":903,"dataGaLocation":1076},{"text":914,"config":1274},{"href":916,"dataGaName":917,"dataGaLocation":1076},{"text":922,"config":1276},{"href":924,"dataGaName":925,"dataGaLocation":1076},{"text":927,"config":1278},{"href":929,"dataGaName":930,"dataGaLocation":1076},{"text":932,"config":1280},{"href":934,"dataGaName":935,"dataGaLocation":1076},{"text":1282,"config":1283},"Sustainability",{"href":1284,"dataGaName":1282,"dataGaLocation":1076},"/sustainability/",{"text":1286,"config":1287},"Diversity, inclusion and belonging (DIB)",{"href":1288,"dataGaName":1289,"dataGaLocation":1076},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":937,"config":1291},{"href":939,"dataGaName":940,"dataGaLocation":1076},{"text":947,"config":1293},{"href":949,"dataGaName":950,"dataGaLocation":1076},{"text":952,"config":1295},{"href":954,"dataGaName":955,"dataGaLocation":1076},{"text":1297,"config":1298},"Modern Slavery Transparency Statement",{"href":1299,"dataGaName":1300,"dataGaLocation":1076},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1302},[1303,1306,1309],{"text":1304,"config":1305},"Terms",{"href":1128,"dataGaName":1129,"dataGaLocation":1076},{"text":1307,"config":1308},"Cookies",{"dataGaName":1138,"dataGaLocation":1076,"id":1139,"isOneTrustButton":354},{"text":1310,"config":1311},"Privacy",{"href":1133,"dataGaName":1134,"dataGaLocation":1076},[1313],{"id":1314,"title":7,"body":615,"config":1315,"content":1317,"description":615,"extension":1321,"meta":1322,"navigation":354,"path":1323,"seo":1324,"stem":1325,"__hash__":1326},"blogAuthors/en-us/blog/authors/fernando-diaz.yml",{"template":1316},"BlogAuthor",{"name":7,"config":1318},{"headshot":1319,"ctfId":1320},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659556/Blog/Author%20Headshots/fern_diaz.png","fjdiaz","yml",{},"/en-us/blog/authors/fernando-diaz",{},"en-us/blog/authors/fernando-diaz","lxRJIOydP4_yzYZvsPcuQevP9AYAKREF7i8QmmdnOWc",[1328,1336,1344],{"title":1329,"description":1330,"heroImage":1331,"category":611,"date":1332,"authors":1333,"slug":1335,"externalUrl":615},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1334],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1337,"description":1338,"heroImage":1331,"category":611,"date":1339,"authors":1340,"slug":1343,"externalUrl":615},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1341,1342],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1345,"description":1346,"heroImage":1347,"category":611,"date":1348,"authors":1349,"slug":1351,"externalUrl":615},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1350],"Alisa Ho","claude-security-and-gitlab",{"promotions":1353},[1354,1368,1380,1391],{"id":1355,"categories":1356,"header":1358,"text":1359,"button":1360,"image":1365},"ai-modernization",[1357],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1361,"config":1362},"Get your AI maturity score",{"href":1363,"dataGaName":1364,"dataGaLocation":841},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1366},{"src":1367},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1369,"categories":1370,"header":1372,"text":1359,"button":1373,"image":1377},"devops-modernization",[1371,1177],"product","Are you just managing tools or shipping innovation?",{"text":1374,"config":1375},"Get your DevOps maturity score",{"href":1376,"dataGaName":1364,"dataGaLocation":841},"/assessments/devops-modernization-assessment/",{"config":1378},{"src":1379},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1381,"categories":1382,"header":1383,"text":1359,"button":1384,"image":1388},"security-modernization",[611],"Are you trading speed for security?",{"text":1385,"config":1386},"Get your security maturity score",{"href":1387,"dataGaName":1364,"dataGaLocation":841},"/assessments/security-modernization-assessment/",{"config":1389},{"src":1390},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1392,"paths":1393,"header":1396,"text":1397,"button":1398,"image":1403},"github-azure-migration",[1394,1395],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1399,"config":1400},"See how GitLab compares to GitHub",{"href":1401,"dataGaName":1402,"dataGaLocation":841},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1404},{"src":1379},{"header":1406,"blurb":1407,"button":1408,"secondaryButton":1413},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1409,"config":1410},"Get your free trial",{"href":1411,"dataGaName":641,"dataGaLocation":1412},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1114,"config":1414},{"href":966,"dataGaName":646,"dataGaLocation":1412},1786803756209]