[{"data":1,"prerenderedAt":959},["ShallowReactive",2],{"/blog/why-security-champions":3,"navigation-en-us":176,"banner-en-us":602,"footer-en-us":612,"blog-post-authors-en-us-Valerie Silverthorne":856,"blog-related-posts-en-us-why-security-champions":871,"blog-promotions-en-us":896,"next-steps-en-us":949},{"id":4,"title":5,"authors":6,"body":8,"category":155,"date":156,"description":157,"extension":158,"externalUrl":159,"faq":159,"featured":160,"heroImage":161,"meta":162,"navigation":163,"path":164,"seo":165,"slug":169,"stem":170,"tags":171,"template":174,"updatedDate":159,"__hash__":175},"blogPosts/en-us/blog/why-security-champions.md","Why you need a security champions program",[7],"Valerie Silverthorne",{"type":9,"value":10,"toc":147},"minimark",[11,27,35,38,50,55,68,71,74,78,81,88,92,95,98,101,105,108,111,114,127,141],[12,13,14,15,21,22,26],"p",{},"In a recent survey of security professionals, Forrester Research found 33% of them had suffered a security breach. That’s not great news, but what was even more concerning is that the breaches were actually in the applications themselves, either via software vulnerabilities or web application flaws, explained ",[16,17,20],"a",{"href":18,"rel":19},"https://www.forrester.com/Amy-DeMartine",[],"Amy DeMartine",", VP and research director with Forrester. “What we’re seeing here is a nasty trend where applications are actually where malicious attackers...are getting into our sacred data,” Amy said during a presentation at our 2020 ",[16,23,25],{"href":24},"/events/","virtual user conference Commit",". “(When it comes to security,) applications are actually getting worse and everything else is getting slightly better. So this is where we really need to tighten up. We really need to make sure that our applications are secure.”",[12,28,29,30,34],{},"Developers and security pros certainly agree that apps need to be more secure, but it’s safe to say that’s where the consensus ends. In ",[16,31,33],{"href":32},"/resources/developer-survey/","GitLab’s 2020 Global DevSecOps Survey"," we found plenty of finger-pointing in both directions. Most developers weren’t running enough SAST, DAST, or IAST scans and fewer than 25% of them actually were able to get their results within their IDEs. Security pros said developers found too few bugs too late in the process, and neither side could come to any agreement on the question of security “ownership.”",[12,36,37],{},"Clearly there’s room for (major) improvement. To “fit the square peg of security into the round hole of DevOps” Amy said the solution was a security champions program, something that will help bridge the wide and pervasive gap between the two sides.",[12,39,40],{},[41,42,43,44,49],"em",{},"Our ",[16,45,48],{"href":46,"rel":47},"https://about.gitlab.com/resources/developer-survey/",[],"2022 Global DevSecOps Survey"," is out now! Learn the latest in DevOps insights from over 5,000 DevOps professionals.",[51,52,54],"h2",{"id":53},"begin-at-the-beginning","Begin at the beginning",[12,56,57,58,62,63,67],{},"Before a ",[16,59,61],{"href":60},"/topics/devops/","DevOps team"," can think about a security champion, Amy shed some light on the culture clash. Developers are measured on quality and customer feedback, two areas directly impacted by security, so that’s a good place to start, she said. Also developers want to release code more quickly, invest in more automation, and increase the use of open source code because they’re handy building blocks that make it easier to create code more quickly. But while open ",[16,64,66],{"href":65},"/solutions/source-code-management/","source code"," is handy, it’s often vulnerable; Forrester found 50% increases in open source code vulnerabilities in 2018 and 2019.",[12,69,70],{},"“So we may not be doing the right kind of checks that we should be doing to release these open source components,” Amy said. “And the developers are going to need help with this. They're going to need to understand when not to include a common component, what common component to use? What's safe?”",[12,72,73],{},"Unfortunately, devs may literally not know the answers to those questions because they may have had absolutely no professional training in security. Forrester examined the top 40 computer science programs in the US last year and found none of them taught secure coding practices. “So our developers, even the ones coming out of university today, do not know how to write secure code,” she said. “They don't understand that open source may have vulnerabilities, they don't know how to remediate weaknesses like SQL injection or cross-site scripting. And so as security pros, we really need to empathize with developers as they are trying to create good quality code that has great customer feedback, they don't know how to secure it, and that's where we come in.”",[51,75,77],{"id":76},"enter-the-champion","Enter the champion",[12,79,80],{},"Amy doesn’t see the American universities changing their curriculum substantially in the near future, nor does she have a lot of faith in one-off “security training classes.” Her take: Developers need to learn about security right in the moment while guided by a champion. “The best way to do this is to stop them once we know they’ve got a security flaw and say, ‘Hey, you’ve got a SQL injection or you’ve got cross-site scripting.’ And hopefully the security tool is able to give them the remediation advice in the form of sample code. It’s all about about ‘How do I learn right in this moment?’”",[12,82,83,84,87],{},"In an ideal world, a security champion will be that person who can bridge the gap between development and security, up to and including speaking ",[41,85,86],{},"both"," languages, Amy stressed. “(A security champion)...can translate the fact that security flaws equal quality issues. And they're able to make it real for developers that oftentimes security pros aren't able to make it real for them. Plus they're part of the team, so they're automatically trusted.” Done right, the champion answers the questions in real time and speeds up the learning curve and the delivery cycle.",[51,89,91],{"id":90},"make-it-happen","Make it happen",[12,93,94],{},"To get that obvious win-win in your organization, start by making the case, getting support, and finding funding, Amy said. “Even in this time of budget cuts it’s important to make sure you highlight the fact that what you’re trying to do is make your developers faster and have less flaws,” she said. Funding should come from both development and security.",[12,96,97],{},"After that, it’s critical to pick the right security leaders; they’ll train the champions so they need to be empathetic to developers. The right candidates for champions will be those who ask a lot of questions about security, are naturally good at finding flaws, and are inclined to help others, Amy offered. Once they’re in place, the security leaders need to train them on the common issues and how to fix them.",[12,99,100],{},"From there, it’s a matter of supporting, rewarding, and cheering them on, she stressed. Contests and friendly competitions “can go a long way to keeping developers interested and active as champions,” she said.",[51,102,104],{"id":103},"pay-attention-to-results","Pay attention to results",[12,106,107],{},"The final step in establishing a security champions program is measuring, monitoring, and continuously improving, Amy said. “If you see a huge uptick in SQL injection, it’s probably time to do some education either with a specific team or across the board.”",[12,109,110],{},"It will take some effort, she said, but it’s how companies are going to scale security successfully. “It’s not just automation (that leads to scale), but it’s also your security champions. (Focus on) those people who are embedded inside the developer teams.”",[12,112,113],{},"Watch Amy’s full presentation:",[115,116,119,120],"figure",{"className":117},[118],"video_container","\n  ",[121,122,126],"iframe",{"src":123,"frameBorder":124,"allowFullScreen":125},"https://www.youtube.com/embed/yX-uEkdpw2w","0","true"," ",[12,128,129,130,135,136],{},"Cover image by ",[16,131,134],{"href":132,"rel":133},"https://unsplash.com/@joelfilip",[],"Joel Filipe"," on ",[16,137,140],{"href":138,"rel":139},"https://unsplash.com",[],"Unsplash",[12,142,143],{},[41,144,43,145,49],{},[16,146,48],{"href":32},{"title":148,"searchDepth":149,"depth":149,"links":150},"",2,[151,152,153,154],{"id":53,"depth":149,"text":54},{"id":76,"depth":149,"text":77},{"id":90,"depth":149,"text":91},{"id":103,"depth":149,"text":104},"security","2020-10-14","Faster releases, more open source code, and developers unlikely to have formal security training = at risk software apps. The solution? A security champions program.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749664002/Blog/Hero%20Images/securitychampions.jpg",{},true,"/en-us/blog/why-security-champions",{"title":5,"description":157,"ogTitle":5,"ogDescription":157,"noIndex":160,"ogImage":161,"ogUrl":166,"ogSiteName":167,"ogType":168,"canonicalUrls":166},"https://about.gitlab.com/blog/why-security-champions","https://about.gitlab.com","article","why-security-champions","en-us/blog/why-security-champions",[155,172,173],"security research","developer survey","BlogPost","NYNJJUN6q_gPCogIr2fQ-4mU6vMYW-WkxQhub4_1q0E",{"logo":177,"freeTrial":182,"sales":187,"login":192,"items":197,"search":522,"minimal":553,"duo":572,"switchNav":581,"pricingDeployment":592},{"config":178},{"href":179,"dataGaName":180,"dataGaLocation":181},"/","gitlab logo","header",{"text":183,"config":184},"Get free trial",{"href":185,"dataGaName":186,"dataGaLocation":181},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":188,"config":189},"Request a demo",{"href":190,"dataGaName":191,"dataGaLocation":181},"/sales/?contact-topic=request-demo","sales",{"text":193,"config":194},"Sign in",{"href":195,"dataGaName":196,"dataGaLocation":181},"https://gitlab.com/users/sign_in/","sign in",[198,227,326,331,444,500],{"text":199,"config":200,"menu":202},"Platform",{"dataNavLevelOne":201},"platform",{"type":203,"columns":204},"cards",[205,211,219],{"title":199,"description":206,"link":207},"The intelligent orchestration platform for DevSecOps",{"text":208,"config":209},"Explore our Platform",{"href":210,"dataGaName":201,"dataGaLocation":181},"/platform/",{"title":212,"description":213,"link":214},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":215,"config":216},"Meet GitLab Duo",{"href":217,"dataGaName":218,"dataGaLocation":181},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":220,"description":221,"link":222},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":223,"config":224},"Learn more",{"href":225,"dataGaName":226,"dataGaLocation":181},"/why-gitlab/","why gitlab",{"text":228,"left":163,"config":229,"menu":231},"Product",{"dataNavLevelOne":230},"solutions",{"type":232,"link":233,"columns":237,"feature":305},"lists",{"text":234,"config":235},"View all Solutions",{"href":236,"dataGaName":230,"dataGaLocation":181},"/solutions/",[238,261,284],{"title":239,"description":240,"link":241,"items":246},"Automation","CI/CD and automation to accelerate deployment",{"config":242},{"icon":243,"href":244,"dataGaName":245,"dataGaLocation":181},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[247,251,254,257],{"text":248,"config":249},"CI/CD",{"href":250,"dataGaLocation":181,"dataGaName":248},"/solutions/continuous-integration/",{"text":212,"config":252},{"href":217,"dataGaLocation":181,"dataGaName":253},"gitlab duo agent platform - product menu",{"text":255,"config":256},"Source Code Management",{"href":65,"dataGaLocation":181,"dataGaName":255},{"text":258,"config":259},"Automated Software Delivery",{"href":244,"dataGaLocation":181,"dataGaName":260},"Automated software delivery",{"title":262,"description":263,"link":264,"items":269},"Security","Deliver code faster without compromising security",{"config":265},{"href":266,"dataGaName":267,"dataGaLocation":181,"icon":268},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[270,274,279],{"text":271,"config":272},"Application Security Testing",{"href":266,"dataGaName":273,"dataGaLocation":181},"Application security testing",{"text":275,"config":276},"Software Supply Chain Security",{"href":277,"dataGaLocation":181,"dataGaName":278},"/solutions/supply-chain/","Software supply chain security",{"text":280,"config":281},"Software Compliance",{"href":282,"dataGaName":283,"dataGaLocation":181},"/solutions/software-compliance/","software compliance",{"title":285,"link":286,"items":291},"Measurement",{"config":287},{"icon":288,"href":289,"dataGaName":290,"dataGaLocation":181},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[292,296,300],{"text":293,"config":294},"Visibility & Measurement",{"href":289,"dataGaLocation":181,"dataGaName":295},"Visibility and Measurement",{"text":297,"config":298},"Value Stream Management",{"href":299,"dataGaLocation":181,"dataGaName":297},"/solutions/value-stream-management/",{"text":301,"config":302},"Analytics & Insights",{"href":303,"dataGaLocation":181,"dataGaName":304},"/solutions/analytics-and-insights/","Analytics and insights",{"title":306,"type":232,"items":307},"GitLab for",[308,314,320],{"text":309,"config":310},"Enterprise",{"icon":311,"href":312,"dataGaLocation":181,"dataGaName":313},"Building","/enterprise/","enterprise",{"text":315,"config":316},"Small Business",{"icon":317,"href":318,"dataGaLocation":181,"dataGaName":319},"Work","/small-business/","small business",{"text":321,"config":322},"Public Sector",{"icon":323,"href":324,"dataGaLocation":181,"dataGaName":325},"Organization","/solutions/public-sector/","public sector",{"text":327,"config":328},"Pricing",{"href":329,"dataGaName":330,"dataGaLocation":181,"dataNavLevelOne":330},"/pricing/","pricing",{"text":332,"config":333,"menu":335},"Resources",{"dataNavLevelOne":334},"resources",{"type":232,"link":336,"columns":340,"feature":433},{"text":337,"config":338},"View all resources",{"href":339,"dataGaName":334,"dataGaLocation":181},"/resources/",[341,374,401],{"title":342,"items":343},"Getting started",[344,349,354,359,364,369],{"text":345,"config":346},"Install",{"href":347,"dataGaName":348,"dataGaLocation":181},"/install/","install",{"text":350,"config":351},"Quick start guides",{"href":352,"dataGaName":353,"dataGaLocation":181},"/get-started/","quick setup checklists",{"text":355,"config":356},"Learn",{"href":357,"dataGaLocation":181,"dataGaName":358},"https://university.gitlab.com/","learn",{"text":360,"config":361},"Product documentation",{"href":362,"dataGaName":363,"dataGaLocation":181},"https://docs.gitlab.com/","product documentation",{"text":365,"config":366},"Best practice videos",{"href":367,"dataGaName":368,"dataGaLocation":181},"/getting-started-videos/","best practice videos",{"text":370,"config":371},"Integrations",{"href":372,"dataGaName":373,"dataGaLocation":181},"/integrations/","integrations",{"title":375,"items":376},"Discover",[377,382,387,392,396],{"text":378,"config":379},"Customer success stories",{"href":380,"dataGaName":381,"dataGaLocation":181},"/customers/","customer success stories",{"text":383,"config":384},"Blog",{"href":385,"dataGaName":386,"dataGaLocation":181},"/blog/","blog",{"text":388,"config":389},"Demo Hub",{"href":390,"dataGaName":391,"dataGaLocation":181},"/demo-hub/","demo hub",{"text":393,"config":394},"The Source",{"href":395,"dataGaName":386,"dataGaLocation":181},"/the-source/",{"text":397,"config":398},"Remote",{"href":399,"dataGaName":400,"dataGaLocation":181},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":402,"items":403},"Connect",[404,409,414,419,424,428],{"text":405,"config":406},"GitLab Services",{"href":407,"dataGaName":408,"dataGaLocation":181},"/services/","services",{"text":410,"config":411},"Contribute",{"href":412,"dataGaName":413,"dataGaLocation":181},"https://contributors.gitlab.com","contribute",{"text":415,"config":416},"Community",{"href":417,"dataGaName":418,"dataGaLocation":181},"/community/","community",{"text":420,"config":421},"Forum",{"href":422,"dataGaName":423,"dataGaLocation":181},"https://forum.gitlab.com/","forum",{"text":425,"config":426},"Events",{"href":24,"dataGaName":427,"dataGaLocation":181},"events",{"text":429,"config":430},"Partners",{"href":431,"dataGaName":432,"dataGaLocation":181},"/partners/","partners",{"config":434,"title":437,"text":438,"link":439},{"background":435,"textColor":436},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":440,"config":441},"Read the latest",{"href":442,"dataGaName":443,"dataGaLocation":181},"/whats-new/","whats new",{"text":445,"config":446,"menu":448},"Company",{"dataNavLevelOne":447},"company",{"type":232,"columns":449},[450],{"items":451},[452,457,463,465,470,475,480,485,490,495],{"text":453,"config":454},"About",{"href":455,"dataGaName":456,"dataGaLocation":181},"/company/","about",{"text":458,"config":459,"footerGa":462},"Jobs",{"href":460,"dataGaName":461,"dataGaLocation":181},"/jobs/","jobs",{"dataGaName":461},{"text":425,"config":464},{"href":24,"dataGaName":427,"dataGaLocation":181},{"text":466,"config":467},"Leadership",{"href":468,"dataGaName":469,"dataGaLocation":181},"/company/team/e-group/","leadership",{"text":471,"config":472},"Handbook",{"href":473,"dataGaName":474,"dataGaLocation":181},"https://handbook.gitlab.com/","handbook",{"text":476,"config":477},"Investor relations",{"href":478,"dataGaName":479,"dataGaLocation":181},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":481,"config":482},"Trust Center",{"href":483,"dataGaName":484,"dataGaLocation":181},"/security/","trust center",{"text":486,"config":487},"AI Transparency Center",{"href":488,"dataGaName":489,"dataGaLocation":181},"/ai-transparency-center/","ai transparency center",{"text":491,"config":492},"Newsletter",{"href":493,"dataGaName":494,"dataGaLocation":181},"/company/contact/#contact-forms","newsletter",{"text":496,"config":497},"Press",{"href":498,"dataGaName":499,"dataGaLocation":181},"/press/","press",{"text":501,"config":502,"menu":503},"Contact us",{"dataNavLevelOne":447},{"type":232,"columns":504},[505],{"items":506},[507,512,517],{"text":508,"config":509},"Talk to sales",{"href":510,"dataGaName":511,"dataGaLocation":181},"/sales/","talk to sales",{"text":513,"config":514},"Support portal",{"href":515,"dataGaName":516,"dataGaLocation":181},"https://support.gitlab.com/hc/en-us","support portal",{"text":518,"config":519},"Customer portal",{"href":520,"dataGaName":521,"dataGaLocation":181},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":523,"login":524,"suggestions":531},"Close",{"text":525,"link":526},"To search repositories and projects, login to",{"text":527,"config":528},"gitlab.com",{"href":195,"dataGaName":529,"dataGaLocation":530},"search login","search",{"text":532,"default":533},"Suggestions",[534,536,540,542,546,550],{"text":212,"config":535},{"href":217,"dataGaName":212,"dataGaLocation":530},{"text":537,"config":538},"Code Suggestions (AI)",{"href":539,"dataGaName":537,"dataGaLocation":530},"/solutions/code-suggestions/",{"text":248,"config":541},{"href":250,"dataGaName":248,"dataGaLocation":530},{"text":543,"config":544},"GitLab on AWS",{"href":545,"dataGaName":543,"dataGaLocation":530},"/partners/technology-partners/aws/",{"text":547,"config":548},"GitLab on Google Cloud",{"href":549,"dataGaName":547,"dataGaLocation":530},"/partners/technology-partners/google-cloud-platform/",{"text":551,"config":552},"Why GitLab?",{"href":225,"dataGaName":551,"dataGaLocation":530},{"freeTrial":554,"mobileIcon":559,"desktopIcon":564,"secondaryButton":567},{"text":555,"config":556},"Start free trial",{"href":557,"dataGaName":186,"dataGaLocation":558},"https://gitlab.com/-/trials/new/","nav",{"altText":560,"config":561},"Gitlab Icon",{"src":562,"dataGaName":563,"dataGaLocation":558},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":560,"config":565},{"src":566,"dataGaName":563,"dataGaLocation":558},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":568,"config":569},"Get Started",{"href":570,"dataGaName":571,"dataGaLocation":558},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":573,"mobileIcon":577,"desktopIcon":579},{"text":574,"config":575},"Learn more about GitLab Duo",{"href":217,"dataGaName":576,"dataGaLocation":558},"gitlab duo",{"altText":560,"config":578},{"src":562,"dataGaName":563,"dataGaLocation":558},{"altText":560,"config":580},{"src":566,"dataGaName":563,"dataGaLocation":558},{"button":582,"mobileIcon":587,"desktopIcon":589},{"text":583,"config":584},"/switch",{"href":585,"dataGaName":586,"dataGaLocation":558},"#contact","switch",{"altText":560,"config":588},{"src":562,"dataGaName":563,"dataGaLocation":558},{"altText":560,"config":590},{"src":591,"dataGaName":563,"dataGaLocation":558},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":593,"mobileIcon":598,"desktopIcon":600},{"text":594,"config":595},"Back to pricing",{"href":329,"dataGaName":596,"dataGaLocation":558,"icon":597},"back to pricing","GoBack",{"altText":560,"config":599},{"src":562,"dataGaName":563,"dataGaLocation":558},{"altText":560,"config":601},{"src":566,"dataGaName":563,"dataGaLocation":558},{"title":603,"titleMobile":604,"button":605,"config":610},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":223,"config":606},{"href":607,"dataGaName":608,"dataGaLocation":609},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":611,"disabled":160},"release",{"data":613},{"text":614,"source":615,"edit":621,"contribute":626,"config":631,"items":636,"minimal":845},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":616,"config":617},"View page source",{"href":618,"dataGaName":619,"dataGaLocation":620},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":622,"config":623},"Edit this page",{"href":624,"dataGaName":625,"dataGaLocation":620},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":627,"config":628},"Please contribute",{"href":629,"dataGaName":630,"dataGaLocation":620},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":632,"facebook":633,"youtube":634,"linkedin":635},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[637,684,737,781,813],{"title":327,"links":638,"subMenu":653},[639,643,648],{"text":640,"config":641},"View plans",{"href":329,"dataGaName":642,"dataGaLocation":620},"view plans",{"text":644,"config":645},"Why Premium?",{"href":646,"dataGaName":647,"dataGaLocation":620},"/pricing/premium/","why premium",{"text":649,"config":650},"Why Ultimate?",{"href":651,"dataGaName":652,"dataGaLocation":620},"/pricing/ultimate/","why ultimate",[654],{"title":655,"links":656},"Contact Us",[657,660,662,664,669,674,679],{"text":658,"config":659},"Contact sales",{"href":510,"dataGaName":191,"dataGaLocation":620},{"text":513,"config":661},{"href":515,"dataGaName":516,"dataGaLocation":620},{"text":518,"config":663},{"href":520,"dataGaName":521,"dataGaLocation":620},{"text":665,"config":666},"Status",{"href":667,"dataGaName":668,"dataGaLocation":620},"https://status.gitlab.com/","status",{"text":670,"config":671},"Terms of use",{"href":672,"dataGaName":673,"dataGaLocation":620},"/terms/","terms of use",{"text":675,"config":676},"Privacy statement",{"href":677,"dataGaName":678,"dataGaLocation":620},"/privacy/","privacy statement",{"text":680,"config":681},"Cookie preferences",{"dataGaName":682,"dataGaLocation":620,"id":683,"isOneTrustButton":163},"cookie preferences","ot-sdk-btn",{"title":228,"links":685,"subMenu":694},[686,690],{"text":687,"config":688},"DevSecOps platform",{"href":210,"dataGaName":689,"dataGaLocation":620},"devsecops platform",{"text":691,"config":692},"AI-Assisted Development",{"href":217,"dataGaName":693,"dataGaLocation":620},"ai-assisted development",[695],{"title":696,"links":697},"Topics",[698,703,708,712,717,722,727,732],{"text":699,"config":700},"CICD",{"href":701,"dataGaName":702,"dataGaLocation":620},"/topics/ci-cd/","cicd",{"text":704,"config":705},"GitOps",{"href":706,"dataGaName":707,"dataGaLocation":620},"/topics/gitops/","gitops",{"text":709,"config":710},"DevOps",{"href":60,"dataGaName":711,"dataGaLocation":620},"devops",{"text":713,"config":714},"Version Control",{"href":715,"dataGaName":716,"dataGaLocation":620},"/topics/version-control/","version control",{"text":718,"config":719},"DevSecOps",{"href":720,"dataGaName":721,"dataGaLocation":620},"/topics/devsecops/","devsecops",{"text":723,"config":724},"Cloud Native",{"href":725,"dataGaName":726,"dataGaLocation":620},"/topics/cloud-native/","cloud native",{"text":728,"config":729},"AI for Coding",{"href":730,"dataGaName":731,"dataGaLocation":620},"/topics/devops/ai-for-coding/","ai for coding",{"text":733,"config":734},"Agentic AI",{"href":735,"dataGaName":736,"dataGaLocation":620},"/topics/agentic-ai/","agentic ai",{"title":738,"links":739},"Solutions",[740,742,744,749,753,756,760,763,765,768,771,776],{"text":271,"config":741},{"href":266,"dataGaName":271,"dataGaLocation":620},{"text":260,"config":743},{"href":244,"dataGaName":245,"dataGaLocation":620},{"text":745,"config":746},"Agile development",{"href":747,"dataGaName":748,"dataGaLocation":620},"/solutions/agile-delivery/","agile delivery",{"text":750,"config":751},"SCM",{"href":65,"dataGaName":752,"dataGaLocation":620},"source code management",{"text":699,"config":754},{"href":250,"dataGaName":755,"dataGaLocation":620},"continuous integration & delivery",{"text":757,"config":758},"Value stream management",{"href":299,"dataGaName":759,"dataGaLocation":620},"value stream management",{"text":704,"config":761},{"href":762,"dataGaName":707,"dataGaLocation":620},"/solutions/gitops/",{"text":309,"config":764},{"href":312,"dataGaName":313,"dataGaLocation":620},{"text":766,"config":767},"Small business",{"href":318,"dataGaName":319,"dataGaLocation":620},{"text":769,"config":770},"Public sector",{"href":324,"dataGaName":325,"dataGaLocation":620},{"text":772,"config":773},"Education",{"href":774,"dataGaName":775,"dataGaLocation":620},"/solutions/education/","education",{"text":777,"config":778},"Financial services",{"href":779,"dataGaName":780,"dataGaLocation":620},"/solutions/finance/","financial services",{"title":332,"links":782},[783,785,787,789,792,794,797,799,801,803,805,807,809,811],{"text":345,"config":784},{"href":347,"dataGaName":348,"dataGaLocation":620},{"text":350,"config":786},{"href":352,"dataGaName":353,"dataGaLocation":620},{"text":355,"config":788},{"href":357,"dataGaName":358,"dataGaLocation":620},{"text":360,"config":790},{"href":362,"dataGaName":791,"dataGaLocation":620},"docs",{"text":383,"config":793},{"href":385,"dataGaName":386,"dataGaLocation":620},{"text":795,"config":796},"What's new",{"href":442,"dataGaName":443,"dataGaLocation":620},{"text":378,"config":798},{"href":380,"dataGaName":381,"dataGaLocation":620},{"text":397,"config":800},{"href":399,"dataGaName":400,"dataGaLocation":620},{"text":405,"config":802},{"href":407,"dataGaName":408,"dataGaLocation":620},{"text":410,"config":804},{"href":412,"dataGaName":413,"dataGaLocation":620},{"text":415,"config":806},{"href":417,"dataGaName":418,"dataGaLocation":620},{"text":420,"config":808},{"href":422,"dataGaName":423,"dataGaLocation":620},{"text":425,"config":810},{"href":24,"dataGaName":427,"dataGaLocation":620},{"text":429,"config":812},{"href":431,"dataGaName":432,"dataGaLocation":620},{"title":445,"links":814},[815,817,819,821,823,825,829,834,836,838,840],{"text":453,"config":816},{"href":455,"dataGaName":447,"dataGaLocation":620},{"text":458,"config":818},{"href":460,"dataGaName":461,"dataGaLocation":620},{"text":466,"config":820},{"href":468,"dataGaName":469,"dataGaLocation":620},{"text":471,"config":822},{"href":473,"dataGaName":474,"dataGaLocation":620},{"text":476,"config":824},{"href":478,"dataGaName":479,"dataGaLocation":620},{"text":826,"config":827},"Sustainability",{"href":828,"dataGaName":826,"dataGaLocation":620},"/sustainability/",{"text":830,"config":831},"Diversity, inclusion and belonging (DIB)",{"href":832,"dataGaName":833,"dataGaLocation":620},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":481,"config":835},{"href":483,"dataGaName":484,"dataGaLocation":620},{"text":491,"config":837},{"href":493,"dataGaName":494,"dataGaLocation":620},{"text":496,"config":839},{"href":498,"dataGaName":499,"dataGaLocation":620},{"text":841,"config":842},"Modern Slavery Transparency Statement",{"href":843,"dataGaName":844,"dataGaLocation":620},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":846},[847,850,853],{"text":848,"config":849},"Terms",{"href":672,"dataGaName":673,"dataGaLocation":620},{"text":851,"config":852},"Cookies",{"dataGaName":682,"dataGaLocation":620,"id":683,"isOneTrustButton":163},{"text":854,"config":855},"Privacy",{"href":677,"dataGaName":678,"dataGaLocation":620},[857],{"id":858,"title":7,"body":159,"config":859,"content":861,"description":159,"extension":865,"meta":866,"navigation":163,"path":867,"seo":868,"stem":869,"__hash__":870},"blogAuthors/en-us/blog/authors/valerie-silverthorne.yml",{"template":860},"BlogAuthor",{"name":7,"config":862},{"headshot":863,"ctfId":864},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659488/Blog/Author%20Headshots/gitlab-logo-extra-whitespace.png","vsilverthorne","yml",{},"/en-us/blog/authors/valerie-silverthorne",{},"en-us/blog/authors/valerie-silverthorne","r2glbOZCR5HOKEwYKJRy7sOVW6u0oTjxVRg28ZvHJ-I",[872,880,888],{"title":873,"description":874,"heroImage":875,"category":155,"date":876,"authors":877,"slug":879,"externalUrl":159},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[878],"Julian Thome","improved-scope-offset-fingerprinting",{"title":881,"description":882,"heroImage":875,"category":155,"date":883,"authors":884,"slug":887,"externalUrl":159},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[885,886],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":889,"description":890,"heroImage":891,"category":155,"date":892,"authors":893,"slug":895,"externalUrl":159},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[894],"Alisa Ho","claude-security-and-gitlab",{"promotions":897},[898,912,924,935],{"id":899,"categories":900,"header":902,"text":903,"button":904,"image":909},"ai-modernization",[901],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":905,"config":906},"Get your AI maturity score",{"href":907,"dataGaName":908,"dataGaLocation":386},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":910},{"src":911},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":913,"categories":914,"header":916,"text":903,"button":917,"image":921},"devops-modernization",[915,721],"product","Are you just managing tools or shipping innovation?",{"text":918,"config":919},"Get your DevOps maturity score",{"href":920,"dataGaName":908,"dataGaLocation":386},"/assessments/devops-modernization-assessment/",{"config":922},{"src":923},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":925,"categories":926,"header":927,"text":903,"button":928,"image":932},"security-modernization",[155],"Are you trading speed for security?",{"text":929,"config":930},"Get your security maturity score",{"href":931,"dataGaName":908,"dataGaLocation":386},"/assessments/security-modernization-assessment/",{"config":933},{"src":934},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":936,"paths":937,"header":940,"text":941,"button":942,"image":947},"github-azure-migration",[938,939],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":943,"config":944},"See how GitLab compares to GitHub",{"href":945,"dataGaName":946,"dataGaLocation":386},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":948},{"src":923},{"header":950,"blurb":951,"button":952,"secondaryButton":957},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":953,"config":954},"Get your free trial",{"href":955,"dataGaName":186,"dataGaLocation":956},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":658,"config":958},{"href":510,"dataGaName":191,"dataGaLocation":956},1786803775346]