[{"data":1,"prerenderedAt":1044},["ShallowReactive",2],{"/blog/zero-trust-at-gitlab-data-zones-and-authentication-scoring":3,"navigation-en-us":258,"banner-en-us":686,"footer-en-us":696,"blog-post-authors-en-us-Mark Loveless":941,"blog-related-posts-en-us-zero-trust-at-gitlab-data-zones-and-authentication-scoring":956,"blog-promotions-en-us":981,"next-steps-en-us":1034},{"id":4,"title":5,"authors":6,"body":8,"category":236,"date":237,"description":238,"extension":239,"externalUrl":240,"faq":240,"featured":241,"heroImage":242,"meta":243,"navigation":244,"path":245,"seo":246,"slug":251,"stem":252,"tags":253,"template":256,"updatedDate":240,"__hash__":257},"blogPosts/en-us/blog/zero-trust-at-gitlab-data-zones-and-authentication-scoring.md","Zero Trust at GitLab: Mitigating challenges with data zones and authentication scoring",[7],"Mark Loveless",{"type":9,"value":10,"toc":224},"minimark",[11,26,29,54,57,68,73,86,89,92,106,109,114,125,132,135,139,142,149,153,158,161,165,168,172,175,179,182,186,189,193,196,201,204,210],[12,13,14,15,20,21,25],"p",{},"Update: This is part 4 of an ongoing ",[16,17,19],"a",{"href":18},"/blog/tags/zero-trust/","Zero Trust series",". See our next post: ",[16,22,24],{"href":23},"/blog/zero-trust-at-gitlab-implementation-challenges/","Zero Trust at GitLab: Implementation challenges (and a few solutions)",".",[12,27,28],{},"Zero Trust is the practice of shifting access control from the perimeter of the organization to the individuals, the assets, and the endpoints. For GitLab, Zero Trust means that all devices trying to access an endpoint or asset within our GitLab environment will need to authenticate and be authorized. This is part four of a multi-part series.",[30,31,32,40,47],"ul",{},[33,34,35,36],"li",{},"Part one: ",[16,37,39],{"href":38},"/blog/evolution-of-zero-trust/","The evolution of Zero Trust",[33,41,42,43],{},"Part two: ",[16,44,46],{"href":45},"/blog/zero-trust-at-gitlab-problems-goals-challenges/","Zero Trust at GitLab: problems, goals, and coming challenges",[33,48,49,50],{},"Part three: ",[16,51,53],{"href":52},"/blog/zero-trust-at-gitlab-the-data-classification-and-infrastructure-challenge/","Zero Trust at GitLab: The data classification and infrastructure challenge",[12,55,56],{},"In previous blog posts we’ve covered both the history of the whole Zero Trust Networking (ZTN) scenario, and some of the areas where we expect challenges to successful implementation. In this post we’ll discuss the concept of “data zones” as well as an “authentication scoring system.” The general concept of data zones is not new; it is an established part of a layered security approach where zones of trust are created around groups of data, usually on the same network segment or system. A few things to note:",[30,58,59,62,65],{},[33,60,61],{},"Our data zone concept simply groups the data according to access controls available for a system when granular control is not possible.",[33,63,64],{},"Our authentication scoring system is intended to augment our ability to allow access.",[33,66,67],{},"We’ve set up all of our access based upon the team member’s identity and job description, but it should also include information about the device and even the geographic location of the team member (as we shall see later).",[69,70,72],"h2",{"id":71},"defining-data-zones","Defining data zones",[12,74,75,76,81,82,85],{},"We have previously defined the ",[16,77,80],{"href":78,"rel":79},"https://handbook.gitlab.com/handbook/security/policies_and_standards/data-classification-standard/",[],"classification of data"," to include RED, ORANGE, YELLOW, and GREEN. We’ve also touched on the concept of ",[16,83,84],{"href":52},"moving data either via automated or manual means, and data being transformed",". Where the data is stored should reflect the classification.",[12,87,88],{},"The immediate challenge with regards to data access is when data that is considered RED or ORANGE is stored on a system that has limited access controls, and granting granular access isn’t possible. In other words, we need to define zones where multiple classes of data may reside on a system that is unable to provide separation of access controls based upon our own data classification. The most common scenario will be either a legacy system or a system developed outside of our control, such as a SaaS company offering.",[12,90,91],{},"We’ve defined four zones that match the data classifications, and named them after the colors of the data classification:",[30,93,94,97,100,103],{},[33,95,96],{},"RED ZONE for RED and lower data",[33,98,99],{},"ORANGE ZONE for ORANGE and lower data",[33,101,102],{},"YELLOW ZONE for YELLOW and lower data",[33,104,105],{},"GREEN ZONE for GREEN (this may not be needed as it is the lowest classification)",[12,107,108],{},"In general, the zones apply to data at rest. Data in transit, either transitioning in system memory between subsystems or transferred over a network between systems, defaults to RED ZONE since access at that level is considered critical. Therefore the ability to access systems at a low enough level to examine RAM or monitoring calls between systems is definitely considered the highest level of restriction, and data moving between systems is subject to the highest levels of encryption.",[110,111,113],"h3",{"id":112},"here-are-the-basic-rules-for-a-zone","Here are the basic rules for a zone:",[30,115,116,119,122],{},[33,117,118],{},"A zone can contain its own “color” of data or lower, not higher.",[33,120,121],{},"A zone will not allow access to a lower “color” of data within its boundaries without authorization to access the highest designation of “color” for that zone.",[33,123,124],{},"The boundaries of a zone are defined by the access controls specific to that zone.",[12,126,127,128],{},"To illustrate, if a YELLOW ZONE is set up to contain YELLOW data, it cannot contain RED or ORANGE. And while it can contain GREEN data, team members with access to GREEN cannot access that data while it resides in the YELLOW ZONE. ",[129,130,131],"strong",{},"In essence, each zone where data resides must have controls that consider what data they might possibly contain.",[12,133,134],{},"To explain this further, let’s say that there is a database that contains ORANGE and YELLOW data within it, but the controls in place are not granular – access to the database means access to all of the data contained within it. Therefore this database would be considered ORANGE ZONE, and those with access to only YELLOW data could not be allowed access that data in this database because it is in ORANGE ZONE.",[69,136,138],{"id":137},"authentication-scoring","Authentication scoring",[12,140,141],{},"There will be a scoring system for access to data, where a team member is ranked. This isn’t so much an actual system for points, but more of a reference guide on what it takes to be able to access different data.",[12,143,144],{},[145,146],"img",{"alt":147,"src":148},"Authentication scoring reference guide","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782397975/blog/Content%20Images/authentication-scoring.png",[110,150,152],{"id":151},"the-earning-of-points-is-as-follows","The earning of points is as follows:",[154,155,157],"h4",{"id":156},"basic-access","Basic access",[12,159,160],{},"One point for basic authentication. This gets you access to the GREEN ZONE and GREEN data.",[154,162,164],{"id":163},"basic-access-with-u2f","Basic access with U2F",[12,166,167],{},"One point if second factor authentication comes through the proper channel (for GitLab team members that is Okta with approved MFA, such as U2F). Two points are required to access the YELLOW ZONE and YELLOW data, so this, coupled with the previous one point for authentication, allows the access.",[154,169,171],{"id":170},"managed-device","Managed device",[12,173,174],{},"One more point if the authentication comes via a managed device (a device GitLab has issued to the team member). This is sufficient to allow access to ORANGE ZONE and ORANGE data.",[154,176,178],{"id":177},"healthy-managed-device","Healthy managed device",[12,180,181],{},"If the managed device is in proper health (passes checks for patches, proper configuration, etc) an additional point is given, which allows access to the RED ZONE and RED data. This is not to imply that we will allow “unhealthy devices” to access ORANGE data (for example), but that the requirement is strictly enforced for RED ZONE and RED data.",[154,183,185],{"id":184},"geolocation","Geolocation",[12,187,188],{},"A final point is given for a managed device with proper health from proper geolocation (this is dependent on the particular RED data being accessed). There may be a requirement that specific data can only be accessed from specific countries, and this is to account for that.",[69,190,192],{"id":191},"a-summary-and-whats-next","A summary and what’s next",[12,194,195],{},"It should be apparent at this point we have a fairly complex situation to administer. We do protect our data but we want more granular control over the access to the data. In a lot of organizations, administrators will end up denying access to parts of their system to employees, and end up having to export portions of the data to those denied access. Additionally, sometimes administrators will grant too much access to employees who simply need to access small segments and do not need the full access.",[12,197,198],{},[129,199,200],{},"At GitLab we not only want to avoid that, but we want to document, log, and automate as much of the granular control as possible. This makes other challenges such as onboarding, offboarding, provisioning of access devices, auditing, and other processes much easier. And if it is easier on both the team member and the administrators managing the systems, full adoption is much simpler. The last thing GitLab wants to do is to prevent or curtail the rapid growth we are experiencing.",[12,202,203],{},"Designing data zones and coming up with an authentication method to gain access to the data in its zone will help clarify how we want to approach some of the challenges. We have a decent start, but to fully explain how they will need to be applied, we’ll go into a lot more detail in the next post. We’ll also discuss some specific ways to address challenges involving our infrastructure, including the role of managed devices.",[12,205,206],{},[207,208,209],"em",{},"Special shout-out to the entire security team for their input on this blog series.",[12,211,212,213,218,219],{},"Photo by ",[16,214,217],{"href":215,"rel":216},"https://unsplash.com/@fabioha?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText",[],"fabio"," on ",[16,220,223],{"href":221,"rel":222},"https://unsplash.com",[],"Unsplash",{"title":225,"searchDepth":226,"depth":226,"links":227},"",2,[228,232,235],{"id":71,"depth":226,"text":72,"children":229},[230],{"id":112,"depth":231,"text":113},3,{"id":137,"depth":226,"text":138,"children":233},[234],{"id":151,"depth":231,"text":152},{"id":191,"depth":226,"text":192},"security","2019-09-06","How we're defining and aligning data zones in our Zero Trust implementation.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749680808/Blog/Hero%20Images/fabio-oyXis2kALVg-unsplash.png",{},true,"/en-us/blog/zero-trust-at-gitlab-data-zones-and-authentication-scoring",{"title":247,"description":238,"ogTitle":247,"ogDescription":238,"noIndex":241,"ogImage":242,"ogUrl":248,"ogSiteName":249,"ogType":250,"canonicalUrls":248},"Zero Trust at GitLab: Data zones & authentication scoring","https://about.gitlab.com/blog/zero-trust-at-gitlab-data-zones-and-authentication-scoring","https://about.gitlab.com","article","zero-trust-at-gitlab-data-zones-and-authentication-scoring","en-us/blog/zero-trust-at-gitlab-data-zones-and-authentication-scoring",[254,236,255],"inside GitLab","zero trust","BlogPost","VGGCmkge8GuX-Uhjnw2U9PbEm8Me77KI3qtzQkOTBWI",{"logo":259,"freeTrial":264,"sales":269,"login":274,"items":279,"search":606,"minimal":637,"duo":656,"switchNav":665,"pricingDeployment":676},{"config":260},{"href":261,"dataGaName":262,"dataGaLocation":263},"/","gitlab logo","header",{"text":265,"config":266},"Get free trial",{"href":267,"dataGaName":268,"dataGaLocation":263},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":270,"config":271},"Request a demo",{"href":272,"dataGaName":273,"dataGaLocation":263},"/sales/?contact-topic=request-demo","sales",{"text":275,"config":276},"Sign in",{"href":277,"dataGaName":278,"dataGaLocation":263},"https://gitlab.com/users/sign_in/","sign in",[280,309,409,414,528,584],{"text":281,"config":282,"menu":284},"Platform",{"dataNavLevelOne":283},"platform",{"type":285,"columns":286},"cards",[287,293,301],{"title":281,"description":288,"link":289},"The intelligent orchestration platform for DevSecOps",{"text":290,"config":291},"Explore our Platform",{"href":292,"dataGaName":283,"dataGaLocation":263},"/platform/",{"title":294,"description":295,"link":296},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":297,"config":298},"Meet GitLab Duo",{"href":299,"dataGaName":300,"dataGaLocation":263},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":302,"description":303,"link":304},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":305,"config":306},"Learn more",{"href":307,"dataGaName":308,"dataGaLocation":263},"/why-gitlab/","why gitlab",{"text":310,"left":244,"config":311,"menu":313},"Product",{"dataNavLevelOne":312},"solutions",{"type":314,"link":315,"columns":319,"feature":388},"lists",{"text":316,"config":317},"View all Solutions",{"href":318,"dataGaName":312,"dataGaLocation":263},"/solutions/",[320,344,367],{"title":321,"description":322,"link":323,"items":328},"Automation","CI/CD and automation to accelerate deployment",{"config":324},{"icon":325,"href":326,"dataGaName":327,"dataGaLocation":263},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[329,333,336,340],{"text":330,"config":331},"CI/CD",{"href":332,"dataGaLocation":263,"dataGaName":330},"/solutions/continuous-integration/",{"text":294,"config":334},{"href":299,"dataGaLocation":263,"dataGaName":335},"gitlab duo agent platform - product menu",{"text":337,"config":338},"Source Code Management",{"href":339,"dataGaLocation":263,"dataGaName":337},"/solutions/source-code-management/",{"text":341,"config":342},"Automated Software Delivery",{"href":326,"dataGaLocation":263,"dataGaName":343},"Automated software delivery",{"title":345,"description":346,"link":347,"items":352},"Security","Deliver code faster without compromising security",{"config":348},{"href":349,"dataGaName":350,"dataGaLocation":263,"icon":351},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[353,357,362],{"text":354,"config":355},"Application Security Testing",{"href":349,"dataGaName":356,"dataGaLocation":263},"Application security testing",{"text":358,"config":359},"Software Supply Chain Security",{"href":360,"dataGaLocation":263,"dataGaName":361},"/solutions/supply-chain/","Software supply chain security",{"text":363,"config":364},"Software Compliance",{"href":365,"dataGaName":366,"dataGaLocation":263},"/solutions/software-compliance/","software compliance",{"title":368,"link":369,"items":374},"Measurement",{"config":370},{"icon":371,"href":372,"dataGaName":373,"dataGaLocation":263},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[375,379,383],{"text":376,"config":377},"Visibility & Measurement",{"href":372,"dataGaLocation":263,"dataGaName":378},"Visibility and Measurement",{"text":380,"config":381},"Value Stream Management",{"href":382,"dataGaLocation":263,"dataGaName":380},"/solutions/value-stream-management/",{"text":384,"config":385},"Analytics & Insights",{"href":386,"dataGaLocation":263,"dataGaName":387},"/solutions/analytics-and-insights/","Analytics and insights",{"title":389,"type":314,"items":390},"GitLab for",[391,397,403],{"text":392,"config":393},"Enterprise",{"icon":394,"href":395,"dataGaLocation":263,"dataGaName":396},"Building","/enterprise/","enterprise",{"text":398,"config":399},"Small Business",{"icon":400,"href":401,"dataGaLocation":263,"dataGaName":402},"Work","/small-business/","small business",{"text":404,"config":405},"Public Sector",{"icon":406,"href":407,"dataGaLocation":263,"dataGaName":408},"Organization","/solutions/public-sector/","public sector",{"text":410,"config":411},"Pricing",{"href":412,"dataGaName":413,"dataGaLocation":263,"dataNavLevelOne":413},"/pricing/","pricing",{"text":415,"config":416,"menu":418},"Resources",{"dataNavLevelOne":417},"resources",{"type":314,"link":419,"columns":423,"feature":517},{"text":420,"config":421},"View all resources",{"href":422,"dataGaName":417,"dataGaLocation":263},"/resources/",[424,457,484],{"title":425,"items":426},"Getting started",[427,432,437,442,447,452],{"text":428,"config":429},"Install",{"href":430,"dataGaName":431,"dataGaLocation":263},"/install/","install",{"text":433,"config":434},"Quick start guides",{"href":435,"dataGaName":436,"dataGaLocation":263},"/get-started/","quick setup checklists",{"text":438,"config":439},"Learn",{"href":440,"dataGaLocation":263,"dataGaName":441},"https://university.gitlab.com/","learn",{"text":443,"config":444},"Product documentation",{"href":445,"dataGaName":446,"dataGaLocation":263},"https://docs.gitlab.com/","product documentation",{"text":448,"config":449},"Best practice videos",{"href":450,"dataGaName":451,"dataGaLocation":263},"/getting-started-videos/","best practice videos",{"text":453,"config":454},"Integrations",{"href":455,"dataGaName":456,"dataGaLocation":263},"/integrations/","integrations",{"title":458,"items":459},"Discover",[460,465,470,475,479],{"text":461,"config":462},"Customer success stories",{"href":463,"dataGaName":464,"dataGaLocation":263},"/customers/","customer success stories",{"text":466,"config":467},"Blog",{"href":468,"dataGaName":469,"dataGaLocation":263},"/blog/","blog",{"text":471,"config":472},"Demo Hub",{"href":473,"dataGaName":474,"dataGaLocation":263},"/demo-hub/","demo hub",{"text":476,"config":477},"The Source",{"href":478,"dataGaName":469,"dataGaLocation":263},"/the-source/",{"text":480,"config":481},"Remote",{"href":482,"dataGaName":483,"dataGaLocation":263},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":485,"items":486},"Connect",[487,492,497,502,507,512],{"text":488,"config":489},"GitLab Services",{"href":490,"dataGaName":491,"dataGaLocation":263},"/services/","services",{"text":493,"config":494},"Contribute",{"href":495,"dataGaName":496,"dataGaLocation":263},"https://contributors.gitlab.com","contribute",{"text":498,"config":499},"Community",{"href":500,"dataGaName":501,"dataGaLocation":263},"/community/","community",{"text":503,"config":504},"Forum",{"href":505,"dataGaName":506,"dataGaLocation":263},"https://forum.gitlab.com/","forum",{"text":508,"config":509},"Events",{"href":510,"dataGaName":511,"dataGaLocation":263},"/events/","events",{"text":513,"config":514},"Partners",{"href":515,"dataGaName":516,"dataGaLocation":263},"/partners/","partners",{"config":518,"title":521,"text":522,"link":523},{"background":519,"textColor":520},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":524,"config":525},"Read the latest",{"href":526,"dataGaName":527,"dataGaLocation":263},"/whats-new/","whats new",{"text":529,"config":530,"menu":532},"Company",{"dataNavLevelOne":531},"company",{"type":314,"columns":533},[534],{"items":535},[536,541,547,549,554,559,564,569,574,579],{"text":537,"config":538},"About",{"href":539,"dataGaName":540,"dataGaLocation":263},"/company/","about",{"text":542,"config":543,"footerGa":546},"Jobs",{"href":544,"dataGaName":545,"dataGaLocation":263},"/jobs/","jobs",{"dataGaName":545},{"text":508,"config":548},{"href":510,"dataGaName":511,"dataGaLocation":263},{"text":550,"config":551},"Leadership",{"href":552,"dataGaName":553,"dataGaLocation":263},"/company/team/e-group/","leadership",{"text":555,"config":556},"Handbook",{"href":557,"dataGaName":558,"dataGaLocation":263},"https://handbook.gitlab.com/","handbook",{"text":560,"config":561},"Investor relations",{"href":562,"dataGaName":563,"dataGaLocation":263},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":565,"config":566},"Trust Center",{"href":567,"dataGaName":568,"dataGaLocation":263},"/security/","trust center",{"text":570,"config":571},"AI Transparency Center",{"href":572,"dataGaName":573,"dataGaLocation":263},"/ai-transparency-center/","ai transparency center",{"text":575,"config":576},"Newsletter",{"href":577,"dataGaName":578,"dataGaLocation":263},"/company/contact/#contact-forms","newsletter",{"text":580,"config":581},"Press",{"href":582,"dataGaName":583,"dataGaLocation":263},"/press/","press",{"text":585,"config":586,"menu":587},"Contact us",{"dataNavLevelOne":531},{"type":314,"columns":588},[589],{"items":590},[591,596,601],{"text":592,"config":593},"Talk to sales",{"href":594,"dataGaName":595,"dataGaLocation":263},"/sales/","talk to sales",{"text":597,"config":598},"Support portal",{"href":599,"dataGaName":600,"dataGaLocation":263},"https://support.gitlab.com/hc/en-us","support portal",{"text":602,"config":603},"Customer portal",{"href":604,"dataGaName":605,"dataGaLocation":263},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":607,"login":608,"suggestions":615},"Close",{"text":609,"link":610},"To search repositories and projects, login to",{"text":611,"config":612},"gitlab.com",{"href":277,"dataGaName":613,"dataGaLocation":614},"search login","search",{"text":616,"default":617},"Suggestions",[618,620,624,626,630,634],{"text":294,"config":619},{"href":299,"dataGaName":294,"dataGaLocation":614},{"text":621,"config":622},"Code Suggestions (AI)",{"href":623,"dataGaName":621,"dataGaLocation":614},"/solutions/code-suggestions/",{"text":330,"config":625},{"href":332,"dataGaName":330,"dataGaLocation":614},{"text":627,"config":628},"GitLab on AWS",{"href":629,"dataGaName":627,"dataGaLocation":614},"/partners/technology-partners/aws/",{"text":631,"config":632},"GitLab on Google Cloud",{"href":633,"dataGaName":631,"dataGaLocation":614},"/partners/technology-partners/google-cloud-platform/",{"text":635,"config":636},"Why GitLab?",{"href":307,"dataGaName":635,"dataGaLocation":614},{"freeTrial":638,"mobileIcon":643,"desktopIcon":648,"secondaryButton":651},{"text":639,"config":640},"Start free trial",{"href":641,"dataGaName":268,"dataGaLocation":642},"https://gitlab.com/-/trials/new/","nav",{"altText":644,"config":645},"Gitlab Icon",{"src":646,"dataGaName":647,"dataGaLocation":642},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":644,"config":649},{"src":650,"dataGaName":647,"dataGaLocation":642},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":652,"config":653},"Get Started",{"href":654,"dataGaName":655,"dataGaLocation":642},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":657,"mobileIcon":661,"desktopIcon":663},{"text":658,"config":659},"Learn more about GitLab Duo",{"href":299,"dataGaName":660,"dataGaLocation":642},"gitlab duo",{"altText":644,"config":662},{"src":646,"dataGaName":647,"dataGaLocation":642},{"altText":644,"config":664},{"src":650,"dataGaName":647,"dataGaLocation":642},{"button":666,"mobileIcon":671,"desktopIcon":673},{"text":667,"config":668},"/switch",{"href":669,"dataGaName":670,"dataGaLocation":642},"#contact","switch",{"altText":644,"config":672},{"src":646,"dataGaName":647,"dataGaLocation":642},{"altText":644,"config":674},{"src":675,"dataGaName":647,"dataGaLocation":642},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":677,"mobileIcon":682,"desktopIcon":684},{"text":678,"config":679},"Back to pricing",{"href":412,"dataGaName":680,"dataGaLocation":642,"icon":681},"back to pricing","GoBack",{"altText":644,"config":683},{"src":646,"dataGaName":647,"dataGaLocation":642},{"altText":644,"config":685},{"src":650,"dataGaName":647,"dataGaLocation":642},{"title":687,"titleMobile":688,"button":689,"config":694},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":305,"config":690},{"href":691,"dataGaName":692,"dataGaLocation":693},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":695,"disabled":241},"release",{"data":697},{"text":698,"source":699,"edit":705,"contribute":710,"config":715,"items":720,"minimal":930},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":700,"config":701},"View page source",{"href":702,"dataGaName":703,"dataGaLocation":704},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":706,"config":707},"Edit this page",{"href":708,"dataGaName":709,"dataGaLocation":704},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":711,"config":712},"Please contribute",{"href":713,"dataGaName":714,"dataGaLocation":704},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":716,"facebook":717,"youtube":718,"linkedin":719},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[721,768,822,866,898],{"title":410,"links":722,"subMenu":737},[723,727,732],{"text":724,"config":725},"View plans",{"href":412,"dataGaName":726,"dataGaLocation":704},"view plans",{"text":728,"config":729},"Why Premium?",{"href":730,"dataGaName":731,"dataGaLocation":704},"/pricing/premium/","why premium",{"text":733,"config":734},"Why Ultimate?",{"href":735,"dataGaName":736,"dataGaLocation":704},"/pricing/ultimate/","why ultimate",[738],{"title":739,"links":740},"Contact Us",[741,744,746,748,753,758,763],{"text":742,"config":743},"Contact sales",{"href":594,"dataGaName":273,"dataGaLocation":704},{"text":597,"config":745},{"href":599,"dataGaName":600,"dataGaLocation":704},{"text":602,"config":747},{"href":604,"dataGaName":605,"dataGaLocation":704},{"text":749,"config":750},"Status",{"href":751,"dataGaName":752,"dataGaLocation":704},"https://status.gitlab.com/","status",{"text":754,"config":755},"Terms of use",{"href":756,"dataGaName":757,"dataGaLocation":704},"/terms/","terms of use",{"text":759,"config":760},"Privacy statement",{"href":761,"dataGaName":762,"dataGaLocation":704},"/privacy/","privacy statement",{"text":764,"config":765},"Cookie preferences",{"dataGaName":766,"dataGaLocation":704,"id":767,"isOneTrustButton":244},"cookie preferences","ot-sdk-btn",{"title":310,"links":769,"subMenu":778},[770,774],{"text":771,"config":772},"DevSecOps platform",{"href":292,"dataGaName":773,"dataGaLocation":704},"devsecops platform",{"text":775,"config":776},"AI-Assisted Development",{"href":299,"dataGaName":777,"dataGaLocation":704},"ai-assisted development",[779],{"title":780,"links":781},"Topics",[782,787,792,797,802,807,812,817],{"text":783,"config":784},"CICD",{"href":785,"dataGaName":786,"dataGaLocation":704},"/topics/ci-cd/","cicd",{"text":788,"config":789},"GitOps",{"href":790,"dataGaName":791,"dataGaLocation":704},"/topics/gitops/","gitops",{"text":793,"config":794},"DevOps",{"href":795,"dataGaName":796,"dataGaLocation":704},"/topics/devops/","devops",{"text":798,"config":799},"Version Control",{"href":800,"dataGaName":801,"dataGaLocation":704},"/topics/version-control/","version control",{"text":803,"config":804},"DevSecOps",{"href":805,"dataGaName":806,"dataGaLocation":704},"/topics/devsecops/","devsecops",{"text":808,"config":809},"Cloud Native",{"href":810,"dataGaName":811,"dataGaLocation":704},"/topics/cloud-native/","cloud native",{"text":813,"config":814},"AI for Coding",{"href":815,"dataGaName":816,"dataGaLocation":704},"/topics/devops/ai-for-coding/","ai for coding",{"text":818,"config":819},"Agentic AI",{"href":820,"dataGaName":821,"dataGaLocation":704},"/topics/agentic-ai/","agentic ai",{"title":823,"links":824},"Solutions",[825,827,829,834,838,841,845,848,850,853,856,861],{"text":354,"config":826},{"href":349,"dataGaName":354,"dataGaLocation":704},{"text":343,"config":828},{"href":326,"dataGaName":327,"dataGaLocation":704},{"text":830,"config":831},"Agile development",{"href":832,"dataGaName":833,"dataGaLocation":704},"/solutions/agile-delivery/","agile delivery",{"text":835,"config":836},"SCM",{"href":339,"dataGaName":837,"dataGaLocation":704},"source code management",{"text":783,"config":839},{"href":332,"dataGaName":840,"dataGaLocation":704},"continuous integration & delivery",{"text":842,"config":843},"Value stream management",{"href":382,"dataGaName":844,"dataGaLocation":704},"value stream management",{"text":788,"config":846},{"href":847,"dataGaName":791,"dataGaLocation":704},"/solutions/gitops/",{"text":392,"config":849},{"href":395,"dataGaName":396,"dataGaLocation":704},{"text":851,"config":852},"Small business",{"href":401,"dataGaName":402,"dataGaLocation":704},{"text":854,"config":855},"Public sector",{"href":407,"dataGaName":408,"dataGaLocation":704},{"text":857,"config":858},"Education",{"href":859,"dataGaName":860,"dataGaLocation":704},"/solutions/education/","education",{"text":862,"config":863},"Financial services",{"href":864,"dataGaName":865,"dataGaLocation":704},"/solutions/finance/","financial services",{"title":415,"links":867},[868,870,872,874,877,879,882,884,886,888,890,892,894,896],{"text":428,"config":869},{"href":430,"dataGaName":431,"dataGaLocation":704},{"text":433,"config":871},{"href":435,"dataGaName":436,"dataGaLocation":704},{"text":438,"config":873},{"href":440,"dataGaName":441,"dataGaLocation":704},{"text":443,"config":875},{"href":445,"dataGaName":876,"dataGaLocation":704},"docs",{"text":466,"config":878},{"href":468,"dataGaName":469,"dataGaLocation":704},{"text":880,"config":881},"What's new",{"href":526,"dataGaName":527,"dataGaLocation":704},{"text":461,"config":883},{"href":463,"dataGaName":464,"dataGaLocation":704},{"text":480,"config":885},{"href":482,"dataGaName":483,"dataGaLocation":704},{"text":488,"config":887},{"href":490,"dataGaName":491,"dataGaLocation":704},{"text":493,"config":889},{"href":495,"dataGaName":496,"dataGaLocation":704},{"text":498,"config":891},{"href":500,"dataGaName":501,"dataGaLocation":704},{"text":503,"config":893},{"href":505,"dataGaName":506,"dataGaLocation":704},{"text":508,"config":895},{"href":510,"dataGaName":511,"dataGaLocation":704},{"text":513,"config":897},{"href":515,"dataGaName":516,"dataGaLocation":704},{"title":529,"links":899},[900,902,904,906,908,910,914,919,921,923,925],{"text":537,"config":901},{"href":539,"dataGaName":531,"dataGaLocation":704},{"text":542,"config":903},{"href":544,"dataGaName":545,"dataGaLocation":704},{"text":550,"config":905},{"href":552,"dataGaName":553,"dataGaLocation":704},{"text":555,"config":907},{"href":557,"dataGaName":558,"dataGaLocation":704},{"text":560,"config":909},{"href":562,"dataGaName":563,"dataGaLocation":704},{"text":911,"config":912},"Sustainability",{"href":913,"dataGaName":911,"dataGaLocation":704},"/sustainability/",{"text":915,"config":916},"Diversity, inclusion and belonging (DIB)",{"href":917,"dataGaName":918,"dataGaLocation":704},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":565,"config":920},{"href":567,"dataGaName":568,"dataGaLocation":704},{"text":575,"config":922},{"href":577,"dataGaName":578,"dataGaLocation":704},{"text":580,"config":924},{"href":582,"dataGaName":583,"dataGaLocation":704},{"text":926,"config":927},"Modern Slavery Transparency Statement",{"href":928,"dataGaName":929,"dataGaLocation":704},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":931},[932,935,938],{"text":933,"config":934},"Terms",{"href":756,"dataGaName":757,"dataGaLocation":704},{"text":936,"config":937},"Cookies",{"dataGaName":766,"dataGaLocation":704,"id":767,"isOneTrustButton":244},{"text":939,"config":940},"Privacy",{"href":761,"dataGaName":762,"dataGaLocation":704},[942],{"id":943,"title":7,"body":240,"config":944,"content":946,"description":240,"extension":950,"meta":951,"navigation":244,"path":952,"seo":953,"stem":954,"__hash__":955},"blogAuthors/en-us/blog/authors/mark-loveless.yml",{"template":945},"BlogAuthor",{"name":7,"config":947},{"headshot":948,"ctfId":949},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749664093/Blog/Author%20Headshots/mloveless-headshot.png","mloveless","yml",{},"/en-us/blog/authors/mark-loveless",{},"en-us/blog/authors/mark-loveless","gYgzUdwKCnypExwE5MZ2RPPrl97ftdqEfuAoem8PmXM",[957,965,973],{"title":958,"description":959,"heroImage":960,"category":236,"date":961,"authors":962,"slug":964,"externalUrl":240},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[963],"Julian Thome","improved-scope-offset-fingerprinting",{"title":966,"description":967,"heroImage":960,"category":236,"date":968,"authors":969,"slug":972,"externalUrl":240},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[970,971],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":974,"description":975,"heroImage":976,"category":236,"date":977,"authors":978,"slug":980,"externalUrl":240},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[979],"Alisa Ho","claude-security-and-gitlab",{"promotions":982},[983,997,1009,1020],{"id":984,"categories":985,"header":987,"text":988,"button":989,"image":994},"ai-modernization",[986],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":990,"config":991},"Get your AI maturity score",{"href":992,"dataGaName":993,"dataGaLocation":469},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":995},{"src":996},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":998,"categories":999,"header":1001,"text":988,"button":1002,"image":1006},"devops-modernization",[1000,806],"product","Are you just managing tools or shipping innovation?",{"text":1003,"config":1004},"Get your DevOps maturity score",{"href":1005,"dataGaName":993,"dataGaLocation":469},"/assessments/devops-modernization-assessment/",{"config":1007},{"src":1008},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1010,"categories":1011,"header":1012,"text":988,"button":1013,"image":1017},"security-modernization",[236],"Are you trading speed for security?",{"text":1014,"config":1015},"Get your security maturity score",{"href":1016,"dataGaName":993,"dataGaLocation":469},"/assessments/security-modernization-assessment/",{"config":1018},{"src":1019},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1021,"paths":1022,"header":1025,"text":1026,"button":1027,"image":1032},"github-azure-migration",[1023,1024],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1028,"config":1029},"See how GitLab compares to GitHub",{"href":1030,"dataGaName":1031,"dataGaLocation":469},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1033},{"src":1008},{"header":1035,"blurb":1036,"button":1037,"secondaryButton":1042},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1038,"config":1039},"Get your free trial",{"href":1040,"dataGaName":268,"dataGaLocation":1041},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":742,"config":1043},{"href":594,"dataGaName":273,"dataGaLocation":1041},1786803739578]