[{"data":1,"prerenderedAt":1045},["ShallowReactive",2],{"/blog/what-the-solarwinds-attack-can-teach-us-about-devsecops":3,"navigation-en-us":251,"banner-en-us":678,"footer-en-us":688,"blog-post-authors-en-us-Pedro Fortuna|Sam Kerr":930,"blog-related-posts-en-us-what-the-solarwinds-attack-can-teach-us-about-devsecops":957,"blog-promotions-en-us":982,"next-steps-en-us":1035},{"id":4,"title":5,"authors":6,"body":9,"category":230,"date":231,"description":232,"extension":233,"externalUrl":234,"faq":234,"featured":235,"heroImage":236,"meta":237,"navigation":238,"path":239,"seo":240,"slug":244,"stem":245,"tags":246,"template":249,"updatedDate":234,"__hash__":250},"blogPosts/en-us/blog/what-the-solarwinds-attack-can-teach-us-about-devsecops.md","How DevSecOps can protect businesses from future supply chain attacks",[7,8],"Pedro Fortuna","Sam Kerr",{"type":10,"value":11,"toc":222},"minimark",[12,16,32,35,40,43,56,64,68,77,80,83,98,102,109,121,129,141,159,182,185,189,192,195,198,208],[13,14,15],"p",{},"One of the cybersecurity keywords for 2021 will undoubtedly be \"software supply chain attacks\". For decades, we've seen a global move toward connected systems and highly complex supply chains. Today these supply chains are under attack, with malicious actors jeopardizing the sensitive data of millions of users through attacks on the public and private sectors.",[13,17,18,19,25,26,31],{},"After public and federal entities were targeted in some high-profile supply chain attacks, the United States government released an ",[20,21,24],"a",{"href":22,"rel":23},"https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/",[],"executive order"," with plans to improve the security posture of the nation when it comes to software supply chains. The UK issued a similar ",[20,27,30],{"href":28,"rel":29},"https://www.gov.uk/government/publications/call-for-views-on-supply-chain-cyber-security/call-for-views-on-cyber-security-in-supply-chains-and-managed-service-providers",[],"call for views on cybersecurity in supply chains"," around the same time.",[13,33,34],{},"Supply chain security became a global priority after the SolarWinds attack, reminding businesses and institutions of the extensive damages caused by these vulnerabilities.",[36,37,39],"h2",{"id":38},"a-brief-summary-of-the-solarwinds-incident","A brief summary of the SolarWinds incident",[13,41,42],{},"Between April and June 2020, malicious actors exploited vulnerabilities in the Solarwinds Orion Platform and inserted a backdoor – allowing attackers to deploy multiple payloads like spyware, and leak confidential data from companies that used the platform, including some U.S. federal entities.",[13,44,45,50,51,55],{},[20,46,49],{"href":47,"rel":48},"https://www.zdnet.com/article/sec-filings-solarwinds-says-18000-customers-are-impacted-by-recent-hack/",[],"Current estimates are 18,000 organizations"," were impacted by the ",[20,52,54],{"href":53},"/blog/devops-platform-supply-chain-attacks/","SolarWinds attack",", but there's a lot we still don't know about the magnitude of the attack. One thing we know for certain is the number of successful supply chain attacks is increasing, and businesses need more effective security measures to protect their software supply chain.",[13,57,58,63],{},[20,59,62],{"href":60,"rel":61},"https://jscrambler.com/resources/white-papers/supply-chain-attacks?utm_source=about.gitlab.com&utm_medium=referral&utm_campaign=key-lessons-solarwinds",[],"Web-based supply chain attacks"," is a particularly concerning vector of attack. The number of web-based attacks have grown over the past few years and provide attackers with a lower barrier to entry when it comes to getting their hands on valuable user data.",[36,65,67],{"id":66},"an-emerging-attack-vector-web-supply-chain-attacks","An emerging attack vector: Web supply chain attacks",[13,69,70,71,76],{},"Today, the average website runs ",[20,72,75],{"href":73,"rel":74},"https://www.reflectiz.com/blog/looking-at-the-figures-of-third-party-application-security-on-websites-part-1/",[],"35 distinct third-party scripts",". Plus, it's estimated that only 3% of the source code of the actual website is written by the team developing the website, while the remaining 97% comes from third-party libraries used during development. Oftentimes, several pieces of third-party code will be coming from companies or individuals with fewer resources dedicated to security, which puts the typical website on precarious footing with an extremely high level of exposure to third-party risk.",[13,78,79],{},"The dependence on third-party code creates a significant opportunity for attackers by allowing them to breach a third-party code supplier and inject a malicious payload into the source code of the third-party script. The compromised source code will then make its way down the web supply chain, reaching hundreds or thousands of different websites.",[13,81,82],{},"Here's where things get even more complicated. In the context of the web, every website script has the same privileges, whether it is a first or third party. As such, a compromised third-party script will be able to harvest any user input, add extra code, hijack events, and fully modify the behavior of the web page. As a result, web supply chain attacks are now being used to leak sensitive user data, such as user credentials, credit card numbers, and other types of PII/PHI that are then sold on underground marketplaces.",[13,84,85,86,91,92,97],{},"A prime example of a web supply chain attack occurred in April 2021, when Codecov, a popular code coverage tool, was breached. The attackers modified the source code of the tool and leaked sensitive data, including dev credentials, tokens, and keys. At the time, more than 29,000 companies were potentially exposed to the attack and some companies reported being breached by ",[20,87,90],{"href":88,"rel":89},"https://www.bleepingcomputer.com/news/security/e-commerce-giant-suffers-major-data-breach-in-codecov-incident/",[],"Magecart web skimmers"," or ",[20,93,96],{"href":94,"rel":95},"https://www.bleepingcomputer.com/news/security/codecov-hackers-gained-access-to-mondaycom-source-code/",[],"having their source code exposed to attackers"," in the weeks that followed.",[36,99,101],{"id":100},"web-supply-chain-security-from-within-devsecops","Web supply chain security from within DevSecOps",[13,103,104,108],{},[20,105,107],{"href":106},"/topics/devsecops/","DevSecOps"," is a key resource in the global push toward more secure supply chains.",[13,110,111,112,116,117,120],{},"The whole premise of DevSecOps is to ingrain security controls throughout the entire software development lifecycle. Companies must adopt a multi-layered, defense-in-depth posture to reduce the risk of web supply chain attacks, which is ideally integrated into their DevSecOps workflow. Adopting DevSecOps practices will provide businesses with much-needed ",[113,114,115],"strong",{},"visibility"," and ",[113,118,119],{},"control"," over their website supply chain.",[13,122,123,124,128],{},"The ",[20,125,127],{"href":126},"/solutions/devops-platform/","GitLab DevOps platform"," provides the necessary layers of protection for improved web supply chain security in a single application.",[13,130,131,132,135,136,140],{},"First, GitLab automates the process of ",[113,133,134],{},"scanning the application"," using ",[20,137,139],{"href":138},"/stages-devops-lifecycle/secure/","several tools"," and techniques, such as SAST, DAST, dependency, container scanning, secrets detection, and fuzz testing (including API fuzzing). This robust scanning increases visibility over potentially insecure third-party code, while also giving full visibility into all code changes before they are pushed to the main branch.",[13,142,143,144,147,148,152,153,158],{},"While vulnerability scanning is an important step to minimize exposure to web supply chain attacks, the source code of the application is still exposed at the client-side and can be reverse-engineered or tampered with by attackers during the recon stage of the attack. To address this risk, GitLab provides ",[113,145,146],{},"source code protection"," through an ",[20,149,151],{"href":150},"/blog/how-to-protect-your-source-code-with-gitlab-and-jscrambler/","integration with Jscrambler",". ",[20,154,157],{"href":155,"rel":156},"https://jscrambler.com/?utm_source=about.gitlab.com&utm_medium=referral&utm_campaign=key-lessons-solarwinds",[],"Jscrambler"," adds key security layers such as obfuscation, code locks, and runtime protection, which thwart static and dynamic code analysis and locks out attackers.",[13,160,161,162,116,164,166,167,172,173,176,177,181],{},"GitLab's integration with Jscrambler also provides access to additional security layers that bring the required ",[113,163,115],{},[113,165,119],{}," over web supply chain attacks at runtime. One of these key layers is an ",[20,168,171],{"href":169,"rel":170},"https://jscrambler.com/free-website-inventory-report?utm_source=about.gitlab.com&utm_medium=referral&utm_campaign=key-lessons-solarwinds",[],"inventory of all the scripts running on the website"," and network requests, providing real-time alerts whenever malicious behavior is detected at the client-side. When coupled with ",[113,174,175],{},"Jscrambler's powerful rules engine",", GitLab provides a ",[20,178,180],{"href":179},"/blog/tags/zero-trust/","zero-trust"," approach to website security, blocking any malicious behavior originating from third-party code.",[13,183,184],{},"Finally, being a true end-to-end DevOps platform, GitLab has built-in security features that simplify the process of continuous iteration. This is key for any defense-in-depth strategy: Providing enough simplicity to enable security within any organization.",[36,186,188],{"id":187},"supply-chain-security-becomes-new-global-priority","Supply chain security becomes new global priority",[13,190,191],{},"There is no question that the SolarWinds supply chain attack is one for the ages, prompting a necessary global push for improved supply chain cybersecurity and highlighted the importance of protecting the web supply chain.",[13,193,194],{},"Reducing exposure to web supply chain attacks requires a defense-in-depth approach that should be built into companies' DevSecOps workflows. GitLab's end-to-end DevOps platform provides multiple layers of security to address this risk, namely through integration partners such as Jscrambler.",[13,196,197],{},"As we see more companies try to improve their security posture by using the right tools to mitigate web supply chain attacks, I'm confident that they will soon outpace attackers and succeed in keeping billions of users safe.",[13,199,200],{},[201,202,203,204,207],"em",{},"Pedro Fortuna is the founder of ",[20,205,157],{"href":155,"rel":206},[],".",[13,209,210,215,216,221],{},[20,211,214],{"href":212,"rel":213},"https://unsplash.com/photos/d7FbDJkJSFw",[],"Cover image"," by ",[20,217,220],{"href":218,"rel":219},"https://unsplash.com/@markusspiske?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText",[],"Markus Spiske"," on Unsplash",{"title":223,"searchDepth":224,"depth":224,"links":225},"",2,[226,227,228,229],{"id":38,"depth":224,"text":39},{"id":66,"depth":224,"text":67},{"id":100,"depth":224,"text":101},{"id":187,"depth":224,"text":188},"security","2021-08-18","Learn how GitLab's all-in-one DevSecOps solution can help businesses keep their supply chains secure.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669522/Blog/Hero%20Images/solarpanels.jpg",{},true,"/en-us/blog/what-the-solarwinds-attack-can-teach-us-about-devsecops",{"title":5,"description":232,"ogTitle":5,"ogDescription":232,"noIndex":235,"ogImage":236,"ogUrl":241,"ogSiteName":242,"ogType":243,"canonicalUrls":241},"https://about.gitlab.com/blog/what-the-solarwinds-attack-can-teach-us-about-devsecops","https://about.gitlab.com","article","what-the-solarwinds-attack-can-teach-us-about-devsecops","en-us/blog/what-the-solarwinds-attack-can-teach-us-about-devsecops",[247,230,248],"DevOps","integrations","BlogPost","1m95g3dN4HFsKjgWiP9owucaIPSYJLNO3WEYqeNNkts",{"logo":252,"freeTrial":257,"sales":262,"login":267,"items":272,"search":598,"minimal":629,"duo":648,"switchNav":657,"pricingDeployment":668},{"config":253},{"href":254,"dataGaName":255,"dataGaLocation":256},"/","gitlab logo","header",{"text":258,"config":259},"Get free trial",{"href":260,"dataGaName":261,"dataGaLocation":256},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":263,"config":264},"Request a demo",{"href":265,"dataGaName":266,"dataGaLocation":256},"/sales/?contact-topic=request-demo","sales",{"text":268,"config":269},"Sign in",{"href":270,"dataGaName":271,"dataGaLocation":256},"https://gitlab.com/users/sign_in/","sign in",[273,302,402,407,520,576],{"text":274,"config":275,"menu":277},"Platform",{"dataNavLevelOne":276},"platform",{"type":278,"columns":279},"cards",[280,286,294],{"title":274,"description":281,"link":282},"The intelligent orchestration platform for DevSecOps",{"text":283,"config":284},"Explore our Platform",{"href":285,"dataGaName":276,"dataGaLocation":256},"/platform/",{"title":287,"description":288,"link":289},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":290,"config":291},"Meet GitLab Duo",{"href":292,"dataGaName":293,"dataGaLocation":256},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":295,"description":296,"link":297},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":298,"config":299},"Learn more",{"href":300,"dataGaName":301,"dataGaLocation":256},"/why-gitlab/","why gitlab",{"text":303,"left":238,"config":304,"menu":306},"Product",{"dataNavLevelOne":305},"solutions",{"type":307,"link":308,"columns":312,"feature":381},"lists",{"text":309,"config":310},"View all Solutions",{"href":311,"dataGaName":305,"dataGaLocation":256},"/solutions/",[313,337,360],{"title":314,"description":315,"link":316,"items":321},"Automation","CI/CD and automation to accelerate deployment",{"config":317},{"icon":318,"href":319,"dataGaName":320,"dataGaLocation":256},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[322,326,329,333],{"text":323,"config":324},"CI/CD",{"href":325,"dataGaLocation":256,"dataGaName":323},"/solutions/continuous-integration/",{"text":287,"config":327},{"href":292,"dataGaLocation":256,"dataGaName":328},"gitlab duo agent platform - product menu",{"text":330,"config":331},"Source Code Management",{"href":332,"dataGaLocation":256,"dataGaName":330},"/solutions/source-code-management/",{"text":334,"config":335},"Automated Software Delivery",{"href":319,"dataGaLocation":256,"dataGaName":336},"Automated software delivery",{"title":338,"description":339,"link":340,"items":345},"Security","Deliver code faster without compromising security",{"config":341},{"href":342,"dataGaName":343,"dataGaLocation":256,"icon":344},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[346,350,355],{"text":347,"config":348},"Application Security Testing",{"href":342,"dataGaName":349,"dataGaLocation":256},"Application security testing",{"text":351,"config":352},"Software Supply Chain Security",{"href":353,"dataGaLocation":256,"dataGaName":354},"/solutions/supply-chain/","Software supply chain security",{"text":356,"config":357},"Software Compliance",{"href":358,"dataGaName":359,"dataGaLocation":256},"/solutions/software-compliance/","software compliance",{"title":361,"link":362,"items":367},"Measurement",{"config":363},{"icon":364,"href":365,"dataGaName":366,"dataGaLocation":256},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[368,372,376],{"text":369,"config":370},"Visibility & Measurement",{"href":365,"dataGaLocation":256,"dataGaName":371},"Visibility and Measurement",{"text":373,"config":374},"Value Stream Management",{"href":375,"dataGaLocation":256,"dataGaName":373},"/solutions/value-stream-management/",{"text":377,"config":378},"Analytics & Insights",{"href":379,"dataGaLocation":256,"dataGaName":380},"/solutions/analytics-and-insights/","Analytics and insights",{"title":382,"type":307,"items":383},"GitLab for",[384,390,396],{"text":385,"config":386},"Enterprise",{"icon":387,"href":388,"dataGaLocation":256,"dataGaName":389},"Building","/enterprise/","enterprise",{"text":391,"config":392},"Small Business",{"icon":393,"href":394,"dataGaLocation":256,"dataGaName":395},"Work","/small-business/","small business",{"text":397,"config":398},"Public Sector",{"icon":399,"href":400,"dataGaLocation":256,"dataGaName":401},"Organization","/solutions/public-sector/","public sector",{"text":403,"config":404},"Pricing",{"href":405,"dataGaName":406,"dataGaLocation":256,"dataNavLevelOne":406},"/pricing/","pricing",{"text":408,"config":409,"menu":411},"Resources",{"dataNavLevelOne":410},"resources",{"type":307,"link":412,"columns":416,"feature":509},{"text":413,"config":414},"View all resources",{"href":415,"dataGaName":410,"dataGaLocation":256},"/resources/",[417,449,476],{"title":418,"items":419},"Getting started",[420,425,430,435,440,445],{"text":421,"config":422},"Install",{"href":423,"dataGaName":424,"dataGaLocation":256},"/install/","install",{"text":426,"config":427},"Quick start guides",{"href":428,"dataGaName":429,"dataGaLocation":256},"/get-started/","quick setup checklists",{"text":431,"config":432},"Learn",{"href":433,"dataGaLocation":256,"dataGaName":434},"https://university.gitlab.com/","learn",{"text":436,"config":437},"Product documentation",{"href":438,"dataGaName":439,"dataGaLocation":256},"https://docs.gitlab.com/","product documentation",{"text":441,"config":442},"Best practice videos",{"href":443,"dataGaName":444,"dataGaLocation":256},"/getting-started-videos/","best practice videos",{"text":446,"config":447},"Integrations",{"href":448,"dataGaName":248,"dataGaLocation":256},"/integrations/",{"title":450,"items":451},"Discover",[452,457,462,467,471],{"text":453,"config":454},"Customer success stories",{"href":455,"dataGaName":456,"dataGaLocation":256},"/customers/","customer success stories",{"text":458,"config":459},"Blog",{"href":460,"dataGaName":461,"dataGaLocation":256},"/blog/","blog",{"text":463,"config":464},"Demo Hub",{"href":465,"dataGaName":466,"dataGaLocation":256},"/demo-hub/","demo hub",{"text":468,"config":469},"The Source",{"href":470,"dataGaName":461,"dataGaLocation":256},"/the-source/",{"text":472,"config":473},"Remote",{"href":474,"dataGaName":475,"dataGaLocation":256},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":477,"items":478},"Connect",[479,484,489,494,499,504],{"text":480,"config":481},"GitLab Services",{"href":482,"dataGaName":483,"dataGaLocation":256},"/services/","services",{"text":485,"config":486},"Contribute",{"href":487,"dataGaName":488,"dataGaLocation":256},"https://contributors.gitlab.com","contribute",{"text":490,"config":491},"Community",{"href":492,"dataGaName":493,"dataGaLocation":256},"/community/","community",{"text":495,"config":496},"Forum",{"href":497,"dataGaName":498,"dataGaLocation":256},"https://forum.gitlab.com/","forum",{"text":500,"config":501},"Events",{"href":502,"dataGaName":503,"dataGaLocation":256},"/events/","events",{"text":505,"config":506},"Partners",{"href":507,"dataGaName":508,"dataGaLocation":256},"/partners/","partners",{"config":510,"title":513,"text":514,"link":515},{"background":511,"textColor":512},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":516,"config":517},"Read the latest",{"href":518,"dataGaName":519,"dataGaLocation":256},"/whats-new/","whats new",{"text":521,"config":522,"menu":524},"Company",{"dataNavLevelOne":523},"company",{"type":307,"columns":525},[526],{"items":527},[528,533,539,541,546,551,556,561,566,571],{"text":529,"config":530},"About",{"href":531,"dataGaName":532,"dataGaLocation":256},"/company/","about",{"text":534,"config":535,"footerGa":538},"Jobs",{"href":536,"dataGaName":537,"dataGaLocation":256},"/jobs/","jobs",{"dataGaName":537},{"text":500,"config":540},{"href":502,"dataGaName":503,"dataGaLocation":256},{"text":542,"config":543},"Leadership",{"href":544,"dataGaName":545,"dataGaLocation":256},"/company/team/e-group/","leadership",{"text":547,"config":548},"Handbook",{"href":549,"dataGaName":550,"dataGaLocation":256},"https://handbook.gitlab.com/","handbook",{"text":552,"config":553},"Investor relations",{"href":554,"dataGaName":555,"dataGaLocation":256},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":557,"config":558},"Trust Center",{"href":559,"dataGaName":560,"dataGaLocation":256},"/security/","trust center",{"text":562,"config":563},"AI Transparency Center",{"href":564,"dataGaName":565,"dataGaLocation":256},"/ai-transparency-center/","ai transparency center",{"text":567,"config":568},"Newsletter",{"href":569,"dataGaName":570,"dataGaLocation":256},"/company/contact/#contact-forms","newsletter",{"text":572,"config":573},"Press",{"href":574,"dataGaName":575,"dataGaLocation":256},"/press/","press",{"text":577,"config":578,"menu":579},"Contact us",{"dataNavLevelOne":523},{"type":307,"columns":580},[581],{"items":582},[583,588,593],{"text":584,"config":585},"Talk to sales",{"href":586,"dataGaName":587,"dataGaLocation":256},"/sales/","talk to sales",{"text":589,"config":590},"Support portal",{"href":591,"dataGaName":592,"dataGaLocation":256},"https://support.gitlab.com/hc/en-us","support portal",{"text":594,"config":595},"Customer portal",{"href":596,"dataGaName":597,"dataGaLocation":256},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":599,"login":600,"suggestions":607},"Close",{"text":601,"link":602},"To search repositories and projects, login to",{"text":603,"config":604},"gitlab.com",{"href":270,"dataGaName":605,"dataGaLocation":606},"search login","search",{"text":608,"default":609},"Suggestions",[610,612,616,618,622,626],{"text":287,"config":611},{"href":292,"dataGaName":287,"dataGaLocation":606},{"text":613,"config":614},"Code Suggestions (AI)",{"href":615,"dataGaName":613,"dataGaLocation":606},"/solutions/code-suggestions/",{"text":323,"config":617},{"href":325,"dataGaName":323,"dataGaLocation":606},{"text":619,"config":620},"GitLab on AWS",{"href":621,"dataGaName":619,"dataGaLocation":606},"/partners/technology-partners/aws/",{"text":623,"config":624},"GitLab on Google Cloud",{"href":625,"dataGaName":623,"dataGaLocation":606},"/partners/technology-partners/google-cloud-platform/",{"text":627,"config":628},"Why GitLab?",{"href":300,"dataGaName":627,"dataGaLocation":606},{"freeTrial":630,"mobileIcon":635,"desktopIcon":640,"secondaryButton":643},{"text":631,"config":632},"Start free trial",{"href":633,"dataGaName":261,"dataGaLocation":634},"https://gitlab.com/-/trials/new/","nav",{"altText":636,"config":637},"Gitlab Icon",{"src":638,"dataGaName":639,"dataGaLocation":634},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":636,"config":641},{"src":642,"dataGaName":639,"dataGaLocation":634},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":644,"config":645},"Get Started",{"href":646,"dataGaName":647,"dataGaLocation":634},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":649,"mobileIcon":653,"desktopIcon":655},{"text":650,"config":651},"Learn more about GitLab Duo",{"href":292,"dataGaName":652,"dataGaLocation":634},"gitlab duo",{"altText":636,"config":654},{"src":638,"dataGaName":639,"dataGaLocation":634},{"altText":636,"config":656},{"src":642,"dataGaName":639,"dataGaLocation":634},{"button":658,"mobileIcon":663,"desktopIcon":665},{"text":659,"config":660},"/switch",{"href":661,"dataGaName":662,"dataGaLocation":634},"#contact","switch",{"altText":636,"config":664},{"src":638,"dataGaName":639,"dataGaLocation":634},{"altText":636,"config":666},{"src":667,"dataGaName":639,"dataGaLocation":634},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":669,"mobileIcon":674,"desktopIcon":676},{"text":670,"config":671},"Back to pricing",{"href":405,"dataGaName":672,"dataGaLocation":634,"icon":673},"back to pricing","GoBack",{"altText":636,"config":675},{"src":638,"dataGaName":639,"dataGaLocation":634},{"altText":636,"config":677},{"src":642,"dataGaName":639,"dataGaLocation":634},{"title":679,"titleMobile":680,"button":681,"config":686},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":298,"config":682},{"href":683,"dataGaName":684,"dataGaLocation":685},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":687,"disabled":235},"release",{"data":689},{"text":690,"source":691,"edit":697,"contribute":702,"config":707,"items":712,"minimal":919},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":692,"config":693},"View page source",{"href":694,"dataGaName":695,"dataGaLocation":696},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":698,"config":699},"Edit this page",{"href":700,"dataGaName":701,"dataGaLocation":696},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":703,"config":704},"Please contribute",{"href":705,"dataGaName":706,"dataGaLocation":696},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":708,"facebook":709,"youtube":710,"linkedin":711},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[713,760,811,855,887],{"title":403,"links":714,"subMenu":729},[715,719,724],{"text":716,"config":717},"View plans",{"href":405,"dataGaName":718,"dataGaLocation":696},"view plans",{"text":720,"config":721},"Why Premium?",{"href":722,"dataGaName":723,"dataGaLocation":696},"/pricing/premium/","why premium",{"text":725,"config":726},"Why Ultimate?",{"href":727,"dataGaName":728,"dataGaLocation":696},"/pricing/ultimate/","why ultimate",[730],{"title":731,"links":732},"Contact Us",[733,736,738,740,745,750,755],{"text":734,"config":735},"Contact sales",{"href":586,"dataGaName":266,"dataGaLocation":696},{"text":589,"config":737},{"href":591,"dataGaName":592,"dataGaLocation":696},{"text":594,"config":739},{"href":596,"dataGaName":597,"dataGaLocation":696},{"text":741,"config":742},"Status",{"href":743,"dataGaName":744,"dataGaLocation":696},"https://status.gitlab.com/","status",{"text":746,"config":747},"Terms of use",{"href":748,"dataGaName":749,"dataGaLocation":696},"/terms/","terms of use",{"text":751,"config":752},"Privacy statement",{"href":753,"dataGaName":754,"dataGaLocation":696},"/privacy/","privacy statement",{"text":756,"config":757},"Cookie preferences",{"dataGaName":758,"dataGaLocation":696,"id":759,"isOneTrustButton":238},"cookie preferences","ot-sdk-btn",{"title":303,"links":761,"subMenu":770},[762,766],{"text":763,"config":764},"DevSecOps platform",{"href":285,"dataGaName":765,"dataGaLocation":696},"devsecops platform",{"text":767,"config":768},"AI-Assisted Development",{"href":292,"dataGaName":769,"dataGaLocation":696},"ai-assisted development",[771],{"title":772,"links":773},"Topics",[774,779,784,788,793,796,801,806],{"text":775,"config":776},"CICD",{"href":777,"dataGaName":778,"dataGaLocation":696},"/topics/ci-cd/","cicd",{"text":780,"config":781},"GitOps",{"href":782,"dataGaName":783,"dataGaLocation":696},"/topics/gitops/","gitops",{"text":247,"config":785},{"href":786,"dataGaName":787,"dataGaLocation":696},"/topics/devops/","devops",{"text":789,"config":790},"Version Control",{"href":791,"dataGaName":792,"dataGaLocation":696},"/topics/version-control/","version control",{"text":107,"config":794},{"href":106,"dataGaName":795,"dataGaLocation":696},"devsecops",{"text":797,"config":798},"Cloud Native",{"href":799,"dataGaName":800,"dataGaLocation":696},"/topics/cloud-native/","cloud native",{"text":802,"config":803},"AI for Coding",{"href":804,"dataGaName":805,"dataGaLocation":696},"/topics/devops/ai-for-coding/","ai for coding",{"text":807,"config":808},"Agentic AI",{"href":809,"dataGaName":810,"dataGaLocation":696},"/topics/agentic-ai/","agentic ai",{"title":812,"links":813},"Solutions",[814,816,818,823,827,830,834,837,839,842,845,850],{"text":347,"config":815},{"href":342,"dataGaName":347,"dataGaLocation":696},{"text":336,"config":817},{"href":319,"dataGaName":320,"dataGaLocation":696},{"text":819,"config":820},"Agile development",{"href":821,"dataGaName":822,"dataGaLocation":696},"/solutions/agile-delivery/","agile delivery",{"text":824,"config":825},"SCM",{"href":332,"dataGaName":826,"dataGaLocation":696},"source code management",{"text":775,"config":828},{"href":325,"dataGaName":829,"dataGaLocation":696},"continuous integration & delivery",{"text":831,"config":832},"Value stream management",{"href":375,"dataGaName":833,"dataGaLocation":696},"value stream management",{"text":780,"config":835},{"href":836,"dataGaName":783,"dataGaLocation":696},"/solutions/gitops/",{"text":385,"config":838},{"href":388,"dataGaName":389,"dataGaLocation":696},{"text":840,"config":841},"Small business",{"href":394,"dataGaName":395,"dataGaLocation":696},{"text":843,"config":844},"Public sector",{"href":400,"dataGaName":401,"dataGaLocation":696},{"text":846,"config":847},"Education",{"href":848,"dataGaName":849,"dataGaLocation":696},"/solutions/education/","education",{"text":851,"config":852},"Financial services",{"href":853,"dataGaName":854,"dataGaLocation":696},"/solutions/finance/","financial services",{"title":408,"links":856},[857,859,861,863,866,868,871,873,875,877,879,881,883,885],{"text":421,"config":858},{"href":423,"dataGaName":424,"dataGaLocation":696},{"text":426,"config":860},{"href":428,"dataGaName":429,"dataGaLocation":696},{"text":431,"config":862},{"href":433,"dataGaName":434,"dataGaLocation":696},{"text":436,"config":864},{"href":438,"dataGaName":865,"dataGaLocation":696},"docs",{"text":458,"config":867},{"href":460,"dataGaName":461,"dataGaLocation":696},{"text":869,"config":870},"What's new",{"href":518,"dataGaName":519,"dataGaLocation":696},{"text":453,"config":872},{"href":455,"dataGaName":456,"dataGaLocation":696},{"text":472,"config":874},{"href":474,"dataGaName":475,"dataGaLocation":696},{"text":480,"config":876},{"href":482,"dataGaName":483,"dataGaLocation":696},{"text":485,"config":878},{"href":487,"dataGaName":488,"dataGaLocation":696},{"text":490,"config":880},{"href":492,"dataGaName":493,"dataGaLocation":696},{"text":495,"config":882},{"href":497,"dataGaName":498,"dataGaLocation":696},{"text":500,"config":884},{"href":502,"dataGaName":503,"dataGaLocation":696},{"text":505,"config":886},{"href":507,"dataGaName":508,"dataGaLocation":696},{"title":521,"links":888},[889,891,893,895,897,899,903,908,910,912,914],{"text":529,"config":890},{"href":531,"dataGaName":523,"dataGaLocation":696},{"text":534,"config":892},{"href":536,"dataGaName":537,"dataGaLocation":696},{"text":542,"config":894},{"href":544,"dataGaName":545,"dataGaLocation":696},{"text":547,"config":896},{"href":549,"dataGaName":550,"dataGaLocation":696},{"text":552,"config":898},{"href":554,"dataGaName":555,"dataGaLocation":696},{"text":900,"config":901},"Sustainability",{"href":902,"dataGaName":900,"dataGaLocation":696},"/sustainability/",{"text":904,"config":905},"Diversity, inclusion and belonging (DIB)",{"href":906,"dataGaName":907,"dataGaLocation":696},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":557,"config":909},{"href":559,"dataGaName":560,"dataGaLocation":696},{"text":567,"config":911},{"href":569,"dataGaName":570,"dataGaLocation":696},{"text":572,"config":913},{"href":574,"dataGaName":575,"dataGaLocation":696},{"text":915,"config":916},"Modern Slavery Transparency Statement",{"href":917,"dataGaName":918,"dataGaLocation":696},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":920},[921,924,927],{"text":922,"config":923},"Terms",{"href":748,"dataGaName":749,"dataGaLocation":696},{"text":925,"config":926},"Cookies",{"dataGaName":758,"dataGaLocation":696,"id":759,"isOneTrustButton":238},{"text":928,"config":929},"Privacy",{"href":753,"dataGaName":754,"dataGaLocation":696},[931,945],{"id":932,"title":7,"body":234,"config":933,"content":935,"description":234,"extension":939,"meta":940,"navigation":238,"path":941,"seo":942,"stem":943,"__hash__":944},"blogAuthors/en-us/blog/authors/pedro-fortuna.yml",{"template":934},"BlogAuthor",{"name":7,"config":936},{"headshot":937,"ctfId":938},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","7JwB4WZYF19OKwOo4yk5n4","yml",{},"/en-us/blog/authors/pedro-fortuna",{},"en-us/blog/authors/pedro-fortuna","tat-xdu47MNjny0M03KJsvl-f5fCwj0JD9GaCb3N3ns",{"id":946,"title":8,"body":234,"config":947,"content":948,"description":234,"extension":939,"meta":952,"navigation":238,"path":953,"seo":954,"stem":955,"__hash__":956},"blogAuthors/en-us/blog/authors/sam-kerr.yml",{"template":934},{"name":8,"config":949},{"headshot":950,"ctfId":951},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749668841/Blog/Author%20Headshots/stkerr-headshot.jpg","stkerr",{},"/en-us/blog/authors/sam-kerr",{},"en-us/blog/authors/sam-kerr","Uy_fuPl-EwaUBm9ppfxsmwgZvhXQR9HumvuLsv4cbko",[958,966,974],{"title":959,"description":960,"heroImage":961,"category":230,"date":962,"authors":963,"slug":965,"externalUrl":234},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[964],"Julian Thome","improved-scope-offset-fingerprinting",{"title":967,"description":968,"heroImage":961,"category":230,"date":969,"authors":970,"slug":973,"externalUrl":234},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[971,972],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":975,"description":976,"heroImage":977,"category":230,"date":978,"authors":979,"slug":981,"externalUrl":234},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[980],"Alisa Ho","claude-security-and-gitlab",{"promotions":983},[984,998,1010,1021],{"id":985,"categories":986,"header":988,"text":989,"button":990,"image":995},"ai-modernization",[987],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":991,"config":992},"Get your AI maturity score",{"href":993,"dataGaName":994,"dataGaLocation":461},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":996},{"src":997},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":999,"categories":1000,"header":1002,"text":989,"button":1003,"image":1007},"devops-modernization",[1001,795],"product","Are you just managing tools or shipping innovation?",{"text":1004,"config":1005},"Get your DevOps maturity score",{"href":1006,"dataGaName":994,"dataGaLocation":461},"/assessments/devops-modernization-assessment/",{"config":1008},{"src":1009},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1011,"categories":1012,"header":1013,"text":989,"button":1014,"image":1018},"security-modernization",[230],"Are you trading speed for security?",{"text":1015,"config":1016},"Get your security maturity score",{"href":1017,"dataGaName":994,"dataGaLocation":461},"/assessments/security-modernization-assessment/",{"config":1019},{"src":1020},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1022,"paths":1023,"header":1026,"text":1027,"button":1028,"image":1033},"github-azure-migration",[1024,1025],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1029,"config":1030},"See how GitLab compares to GitHub",{"href":1031,"dataGaName":1032,"dataGaLocation":461},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1034},{"src":1009},{"header":1036,"blurb":1037,"button":1038,"secondaryButton":1043},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1039,"config":1040},"Get your free trial",{"href":1041,"dataGaName":261,"dataGaLocation":1042},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":734,"config":1044},{"href":586,"dataGaName":266,"dataGaLocation":1042},1786803754435]