[{"data":1,"prerenderedAt":2061},["ShallowReactive",2],{"/fr-fr/blog/severity-override-vulnerability-management-policy":3,"navigation-fr-fr":1281,"banner-fr-fr":1715,"footer-fr-fr":1723,"blog-post-authors-fr-fr-Grant Hickman":1962,"blog-related-posts-fr-fr-severity-override-vulnerability-management-policy":1977,"blog-promotions-fr-fr":1999,"next-steps-fr-fr":2052},{"id":4,"title":5,"authors":6,"body":8,"category":1261,"date":1262,"description":1263,"extension":1264,"externalUrl":1265,"faq":1265,"featured":1266,"heroImage":1267,"meta":1268,"navigation":1269,"path":1270,"seo":1271,"slug":1275,"stem":1276,"tags":1277,"template":1279,"updatedDate":1265,"__hash__":1280},"blogPosts/fr-fr/blog/severity-override-vulnerability-management-policy.md","GitLab : 5 façons de corriger les niveaux de gravité trompeurs des vulnérabilités",[7],"Grant Hickman",{"type":9,"value":10,"toc":1247},"minimark",[11,15,18,23,33,36,59,62,66,69,74,77,80,275,282,286,305,308,463,472,476,479,482,621,624,628,637,640,778,781,785,792,795,968,971,975,978,1015,1019,1181,1185,1197,1207,1213,1219,1225,1243],[12,13,14],"p",{},"Un rapport de vulnérabilités d'entreprise typique fait remonter des centaines de résultats à chaque cycle d'analyse, tous classés selon le Common Vulnerability Scoring System (CVSS). Le problème : le CVSS décrit les caractéristiques théoriques d'une vulnérabilité et exposition communes (CVE), et non sa pertinence dans votre environnement. Une vulnérabilité critique dans une bibliothèque utilitaire à usage interne ne représente pas le même risque qu'une vulnérabilité modérée dans un service d'authentification exposé au public. Pourtant, ces deux cas sont traités de manière identique jusqu'à ce que quelqu'un les analyse manuellement. Il est également impossible de mettre à l'échelle ce travail de classement.",[12,16,17],{},"Les politiques de gestion des vulnérabilités de GitLab peuvent désormais remplacer automatiquement ces niveaux de gravité CVSS par défaut, selon des conditions que vous définissez : votre rapport de vulnérabilités reflète ainsi votre modèle de risque réel plutôt qu'un modèle générique.",[19,20,22],"h2",{"id":21},"fonctionnement-des-politiques-de-remplacement-de-la-gravité","Fonctionnement des politiques de remplacement de la gravité",[12,24,25,26,32],{},"Une politique de remplacement de la gravité est un type de ",[27,28,31],"a",{"href":29,"rel":30},"https://docs.gitlab.com/user/application_security/policies/vulnerability_management_policy/",[],"politique de gestion des vulnérabilités"," qui ajuste automatiquement les niveaux de gravité des vulnérabilités de chaque pipeline de la branche par défaut. Vous définissez des règles avec des critères de correspondance (identifiant CVE, identifiant CWE, chemin de fichier ou répertoire) et une action de remplacement. Lorsqu'une vulnérabilité correspond, le Security Policy Bot de GitLab met immédiatement à jour sa gravité.",[12,34,35],{},"Trois opérations de remplacement sont disponibles :",[37,38,39,47,53],"ul",{},[40,41,42,46],"li",{},[43,44,45],"strong",{},"Définir la gravité"," : force la gravité à un niveau précis (information, faible, modéré, élevé ou critique).",[40,48,49,52],{},[43,50,51],{},"Augmenter la gravité"," : fait monter la gravité d'un niveau.",[40,54,55,58],{},[43,56,57],{},"Diminuer la gravité"," : fait descendre la gravité d'un niveau.",[12,60,61],{},"Les remplacements manuels effectués par des utilisateurs autorisés ont toujours la priorité sur les remplacements définis par politique. Chaque modification automatisée est consignée dans l'historique de la vulnérabilité et dans les événements d'audit, ce qui vous garantit une traçabilité complète de ce qui a été modifié et pourquoi.",[19,63,65],{"id":64},"cas-dutilisation-avec-configurations-prêtes-à-lemploi","Cas d'utilisation avec configurations prêtes à l'emploi",[12,67,68],{},"Chaque exemple ci-dessous inclut une configuration de politique que vous pouvez copier, personnaliser et appliquer immédiatement.",[70,71,73],"h3",{"id":72},"_1-rétrograder-les-cve-à-faible-risque-dans-les-services-internes","1. Rétrograder les CVE à faible risque dans les services internes",[12,75,76],{},"Les scanners de sécurité ne savent pas quels projets sont des outils internes, des utilitaires de test ou des services en production. Ils évaluent chaque CVE de la même façon, quel que soit le contexte de déploiement. Pour les équipes qui gèrent des tableaux de bord d'administration internes, des outils de développement ou des traitements par lots sans exposition au trafic externe, une vulnérabilité de dépendance classée comme critique ne justifie souvent pas la même réponse que si elle se trouvait dans une API exposée aux clients.",[12,78,79],{},"Cette politique diminue la gravité de CVE spécifiques détectées dans les répertoires de services internes :",[81,82,87],"pre",{"className":83,"code":84,"language":85,"meta":86,"style":86},"language-yaml shiki shiki-themes github-light","vulnerability_management_policy:\n  - name: \"Downgrade CVEs in internal services\"\n    description: \"Internal-only services have lower exposure risk\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cve\n            values:\n              - \"CVE-2023-44487\"\n              - \"CVE-2024-29041\"\n          - type: directory\n            value: \"internal/**/*\"\n    actions:\n      - type: severity_override\n        severity_override_operation: decrease\n","yaml","",[88,89,90,103,119,130,142,150,164,172,185,196,204,213,221,233,244,252,264],"code",{"__ignoreMap":86},[91,92,95,99],"span",{"class":93,"line":94},"line",1,[91,96,98],{"class":97},"shJU0","vulnerability_management_policy",[91,100,102],{"class":101},"sgsFI",":\n",[91,104,106,109,112,115],{"class":93,"line":105},2,[91,107,108],{"class":101},"  - ",[91,110,111],{"class":97},"name",[91,113,114],{"class":101},": ",[91,116,118],{"class":117},"sYBdl","\"Downgrade CVEs in internal services\"\n",[91,120,122,125,127],{"class":93,"line":121},3,[91,123,124],{"class":97},"    description",[91,126,114],{"class":101},[91,128,129],{"class":117},"\"Internal-only services have lower exposure risk\"\n",[91,131,133,136,138],{"class":93,"line":132},4,[91,134,135],{"class":97},"    enabled",[91,137,114],{"class":101},[91,139,141],{"class":140},"sYu0t","true\n",[91,143,145,148],{"class":93,"line":144},5,[91,146,147],{"class":97},"    rules",[91,149,102],{"class":101},[91,151,153,156,159,161],{"class":93,"line":152},6,[91,154,155],{"class":101},"      - ",[91,157,158],{"class":97},"type",[91,160,114],{"class":101},[91,162,163],{"class":117},"detected\n",[91,165,167,170],{"class":93,"line":166},7,[91,168,169],{"class":97},"        criteria",[91,171,102],{"class":101},[91,173,175,178,180,182],{"class":93,"line":174},8,[91,176,177],{"class":101},"          - ",[91,179,158],{"class":97},[91,181,114],{"class":101},[91,183,184],{"class":117},"identifier\n",[91,186,188,191,193],{"class":93,"line":187},9,[91,189,190],{"class":97},"            identifier_type",[91,192,114],{"class":101},[91,194,195],{"class":117},"cve\n",[91,197,199,202],{"class":93,"line":198},10,[91,200,201],{"class":97},"            values",[91,203,102],{"class":101},[91,205,207,210],{"class":93,"line":206},11,[91,208,209],{"class":101},"              - ",[91,211,212],{"class":117},"\"CVE-2023-44487\"\n",[91,214,216,218],{"class":93,"line":215},12,[91,217,209],{"class":101},[91,219,220],{"class":117},"\"CVE-2024-29041\"\n",[91,222,224,226,228,230],{"class":93,"line":223},13,[91,225,177],{"class":101},[91,227,158],{"class":97},[91,229,114],{"class":101},[91,231,232],{"class":117},"directory\n",[91,234,236,239,241],{"class":93,"line":235},14,[91,237,238],{"class":97},"            value",[91,240,114],{"class":101},[91,242,243],{"class":117},"\"internal/**/*\"\n",[91,245,247,250],{"class":93,"line":246},15,[91,248,249],{"class":97},"    actions",[91,251,102],{"class":101},[91,253,255,257,259,261],{"class":93,"line":254},16,[91,256,155],{"class":101},[91,258,158],{"class":97},[91,260,114],{"class":101},[91,262,263],{"class":117},"severity_override\n",[91,265,267,270,272],{"class":93,"line":266},17,[91,268,269],{"class":97},"        severity_override_operation",[91,271,114],{"class":101},[91,273,274],{"class":117},"decrease\n",[12,276,277,278,281],{},"Remplacez les valeurs CVE par les identifiants que votre équipe a évalués comme présentant un risque moindre pour les déploiements internes. L'opération ",[88,279,280],{},"decrease"," fait baisser la gravité d'un niveau (critique devient élevée, élevée devient modérée), ce qui préserve la priorité relative sans surréagir à des scores inadaptés au contexte.",[70,283,285],{"id":284},"_2-augmenter-la-gravité-des-vulnérabilités-dinjection-dans-le-code-en-production","2. Augmenter la gravité des vulnérabilités d'injection dans le code en production",[12,287,288,289,294,295,300,301,304],{},"Certaines catégories de vulnérabilités nécessitent une réponse plus forte lorsqu'elles sont détectées dans le code source en production. Le cross-site scripting, ou XSS (CWE-79), et l'injection SQL (CWE-89) figurent régulièrement parmi les types de vulnérabilités les plus exploités, selon l'",[27,290,293],{"href":291,"rel":292},"https://about.gitlab.com/blog/2025-owasp-top-10-whats-changed-and-why-it-matters/",[],"Open Web Application Security Project (OWASP)"," et la ",[27,296,299],{"href":297,"rel":298},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog",[],"base de données des vulnérabilités exploitées connues (Known Exploited Vulnerabilities ou KEV)"," de l'Agence de cybersécurité et de sécurité des infrastructures (CISA). Si votre scanner signale ces vulnérabilités comme modérées ou élevées dans votre répertoire ",[88,302,303],{},"src/",", votre processus de classement doit les traiter comme critiques.",[12,306,307],{},"Cette politique définit la gravité à critique pour les résultats XSS et SQLi dans le code en production :",[81,309,311],{"className":83,"code":310,"language":85,"meta":86,"style":86},"vulnerability_management_policy:\n  - name: \"Upgrade XSS and SQLi in production code\"\n    description: \"Injection vulnerabilities in src/ are always Critical\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cwe\n            values:\n              - \"CWE-79\"\n              - \"CWE-89\"\n          - type: directory\n            value: \"src/**/*\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: critical\n",[88,312,313,319,330,339,347,353,363,369,379,388,394,401,408,418,427,433,443,452],{"__ignoreMap":86},[91,314,315,317],{"class":93,"line":94},[91,316,98],{"class":97},[91,318,102],{"class":101},[91,320,321,323,325,327],{"class":93,"line":105},[91,322,108],{"class":101},[91,324,111],{"class":97},[91,326,114],{"class":101},[91,328,329],{"class":117},"\"Upgrade XSS and SQLi in production code\"\n",[91,331,332,334,336],{"class":93,"line":121},[91,333,124],{"class":97},[91,335,114],{"class":101},[91,337,338],{"class":117},"\"Injection vulnerabilities in src/ are always Critical\"\n",[91,340,341,343,345],{"class":93,"line":132},[91,342,135],{"class":97},[91,344,114],{"class":101},[91,346,141],{"class":140},[91,348,349,351],{"class":93,"line":144},[91,350,147],{"class":97},[91,352,102],{"class":101},[91,354,355,357,359,361],{"class":93,"line":152},[91,356,155],{"class":101},[91,358,158],{"class":97},[91,360,114],{"class":101},[91,362,163],{"class":117},[91,364,365,367],{"class":93,"line":166},[91,366,169],{"class":97},[91,368,102],{"class":101},[91,370,371,373,375,377],{"class":93,"line":174},[91,372,177],{"class":101},[91,374,158],{"class":97},[91,376,114],{"class":101},[91,378,184],{"class":117},[91,380,381,383,385],{"class":93,"line":187},[91,382,190],{"class":97},[91,384,114],{"class":101},[91,386,387],{"class":117},"cwe\n",[91,389,390,392],{"class":93,"line":198},[91,391,201],{"class":97},[91,393,102],{"class":101},[91,395,396,398],{"class":93,"line":206},[91,397,209],{"class":101},[91,399,400],{"class":117},"\"CWE-79\"\n",[91,402,403,405],{"class":93,"line":215},[91,404,209],{"class":101},[91,406,407],{"class":117},"\"CWE-89\"\n",[91,409,410,412,414,416],{"class":93,"line":223},[91,411,177],{"class":101},[91,413,158],{"class":97},[91,415,114],{"class":101},[91,417,232],{"class":117},[91,419,420,422,424],{"class":93,"line":235},[91,421,238],{"class":97},[91,423,114],{"class":101},[91,425,426],{"class":117},"\"src/**/*\"\n",[91,428,429,431],{"class":93,"line":246},[91,430,249],{"class":97},[91,432,102],{"class":101},[91,434,435,437,439,441],{"class":93,"line":254},[91,436,155],{"class":101},[91,438,158],{"class":97},[91,440,114],{"class":101},[91,442,263],{"class":117},[91,444,445,447,449],{"class":93,"line":266},[91,446,269],{"class":97},[91,448,114],{"class":101},[91,450,451],{"class":117},"set\n",[91,453,455,458,460],{"class":93,"line":454},18,[91,456,457],{"class":97},"        severity_override_value",[91,459,114],{"class":101},[91,461,462],{"class":117},"critical\n",[12,464,465,466,471],{},"Associez cette politique à une ",[27,467,470],{"href":468,"rel":469},"https://docs.gitlab.com/user/application_security/policies/merge_request_approval_policies/",[],"politique d'approbation des merge requests"," qui exige l'approbation de l'équipe de sécurité pour les résultats critiques. La politique de remplacement de la gravité garantit que les bons résultats sont signalés et priorisés dans le rapport de vulnérabilités, tandis que la politique d'approbation s'assure que les nouvelles vulnérabilités détectées ne peuvent pas atteindre la production sans révision.",[70,473,475],{"id":474},"_3-normaliser-la-gravité-entre-les-différents-scanners","3. Normaliser la gravité entre les différents scanners",[12,477,478],{},"Il arrive que des scanners différents attribuent des niveaux de gravité différents à la même CVE. Votre scanner d'analyse statique de sécurité des applications (SAST) peut évaluer un résultat comme élevé, tandis que l'analyse des dépendances le qualifiera de modéré. Ces incohérences créent de la confusion lors du classement et compliquent la définition de seuils d'approbation cohérents entre les types d'analyse.",[12,480,481],{},"Utilisez une politique de remplacement de la gravité pour imposer un niveau de référence cohérent. Si votre équipe de sécurité a évalué une famille de CVE spécifique et déterminé qu'elle doit toujours être élevée quel que soit le scanner, définissez ce paramètre explicitement :",[81,483,485],{"className":83,"code":484,"language":85,"meta":86,"style":86},"vulnerability_management_policy:\n  - name: \"Normalize log4j severity to High\"\n    description: \"Consistent severity for log4j CVEs across all scanners\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cve\n            values:\n              - \"CVE-2021-44228\"\n              - \"CVE-2021-45046\"\n              - \"CVE-2021-45105\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: high\n",[88,486,487,493,504,513,521,527,537,543,553,561,567,574,581,588,594,604,612],{"__ignoreMap":86},[91,488,489,491],{"class":93,"line":94},[91,490,98],{"class":97},[91,492,102],{"class":101},[91,494,495,497,499,501],{"class":93,"line":105},[91,496,108],{"class":101},[91,498,111],{"class":97},[91,500,114],{"class":101},[91,502,503],{"class":117},"\"Normalize log4j severity to High\"\n",[91,505,506,508,510],{"class":93,"line":121},[91,507,124],{"class":97},[91,509,114],{"class":101},[91,511,512],{"class":117},"\"Consistent severity for log4j CVEs across all scanners\"\n",[91,514,515,517,519],{"class":93,"line":132},[91,516,135],{"class":97},[91,518,114],{"class":101},[91,520,141],{"class":140},[91,522,523,525],{"class":93,"line":144},[91,524,147],{"class":97},[91,526,102],{"class":101},[91,528,529,531,533,535],{"class":93,"line":152},[91,530,155],{"class":101},[91,532,158],{"class":97},[91,534,114],{"class":101},[91,536,163],{"class":117},[91,538,539,541],{"class":93,"line":166},[91,540,169],{"class":97},[91,542,102],{"class":101},[91,544,545,547,549,551],{"class":93,"line":174},[91,546,177],{"class":101},[91,548,158],{"class":97},[91,550,114],{"class":101},[91,552,184],{"class":117},[91,554,555,557,559],{"class":93,"line":187},[91,556,190],{"class":97},[91,558,114],{"class":101},[91,560,195],{"class":117},[91,562,563,565],{"class":93,"line":198},[91,564,201],{"class":97},[91,566,102],{"class":101},[91,568,569,571],{"class":93,"line":206},[91,570,209],{"class":101},[91,572,573],{"class":117},"\"CVE-2021-44228\"\n",[91,575,576,578],{"class":93,"line":215},[91,577,209],{"class":101},[91,579,580],{"class":117},"\"CVE-2021-45046\"\n",[91,582,583,585],{"class":93,"line":223},[91,584,209],{"class":101},[91,586,587],{"class":117},"\"CVE-2021-45105\"\n",[91,589,590,592],{"class":93,"line":235},[91,591,249],{"class":97},[91,593,102],{"class":101},[91,595,596,598,600,602],{"class":93,"line":246},[91,597,155],{"class":101},[91,599,158],{"class":97},[91,601,114],{"class":101},[91,603,263],{"class":117},[91,605,606,608,610],{"class":93,"line":254},[91,607,269],{"class":97},[91,609,114],{"class":101},[91,611,451],{"class":117},[91,613,614,616,618],{"class":93,"line":266},[91,615,457],{"class":97},[91,617,114],{"class":101},[91,619,620],{"class":117},"high\n",[12,622,623],{},"Cette approche est particulièrement utile pour les organisations qui utilisent plusieurs types d'analyse (SAST, analyse des dépendances, analyse des conteneurs) et pour lesquelles la même vulnérabilité sous-jacente apparaît avec des évaluations différentes selon la méthode de détection.",[70,625,627],{"id":626},"_4-aligner-la-gravité-sur-les-renseignements-dexploitation","4. Aligner la gravité sur les renseignements d'exploitation",[12,629,630,631,636],{},"Les scores CVSS sont statiques. Ils n'évoluent pas lorsqu'une vulnérabilité commence à être activement exploitée, et ils ne tiennent pas compte de la probabilité d'exploitation réelle. Le ",[27,632,635],{"href":633,"rel":634},"https://www.first.org/epss/",[],"score EPSS (Exploit Prediction Scoring System)"," de FIRST et le catalogue KEV de la CISA fournissent les informations manquantes.",[12,638,639],{},"Lorsque vos renseignements sur les menaces indiquent qu'une CVE de gravité modérée est désormais activement exploitée (KEV) ou présente une forte probabilité d'exploitation (score EPSS supérieur à 0,5), utilisez un remplacement de la gravité pour l'augmenter :",[81,641,643],{"className":83,"code":642,"language":85,"meta":86,"style":86},"vulnerability_management_policy:\n  - name: \"Upgrade actively exploited CVEs\"\n    description: \"CVEs in CISA KEV catalog should be treated as Critical\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cve\n            values:\n              - \"CVE-2024-3094\"\n              - \"CVE-2023-4966\"\n              - \"CVE-2023-22515\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: critical\n",[88,644,645,651,662,671,679,685,695,701,711,719,725,732,739,746,752,762,770],{"__ignoreMap":86},[91,646,647,649],{"class":93,"line":94},[91,648,98],{"class":97},[91,650,102],{"class":101},[91,652,653,655,657,659],{"class":93,"line":105},[91,654,108],{"class":101},[91,656,111],{"class":97},[91,658,114],{"class":101},[91,660,661],{"class":117},"\"Upgrade actively exploited CVEs\"\n",[91,663,664,666,668],{"class":93,"line":121},[91,665,124],{"class":97},[91,667,114],{"class":101},[91,669,670],{"class":117},"\"CVEs in CISA KEV catalog should be treated as Critical\"\n",[91,672,673,675,677],{"class":93,"line":132},[91,674,135],{"class":97},[91,676,114],{"class":101},[91,678,141],{"class":140},[91,680,681,683],{"class":93,"line":144},[91,682,147],{"class":97},[91,684,102],{"class":101},[91,686,687,689,691,693],{"class":93,"line":152},[91,688,155],{"class":101},[91,690,158],{"class":97},[91,692,114],{"class":101},[91,694,163],{"class":117},[91,696,697,699],{"class":93,"line":166},[91,698,169],{"class":97},[91,700,102],{"class":101},[91,702,703,705,707,709],{"class":93,"line":174},[91,704,177],{"class":101},[91,706,158],{"class":97},[91,708,114],{"class":101},[91,710,184],{"class":117},[91,712,713,715,717],{"class":93,"line":187},[91,714,190],{"class":97},[91,716,114],{"class":101},[91,718,195],{"class":117},[91,720,721,723],{"class":93,"line":198},[91,722,201],{"class":97},[91,724,102],{"class":101},[91,726,727,729],{"class":93,"line":206},[91,728,209],{"class":101},[91,730,731],{"class":117},"\"CVE-2024-3094\"\n",[91,733,734,736],{"class":93,"line":215},[91,735,209],{"class":101},[91,737,738],{"class":117},"\"CVE-2023-4966\"\n",[91,740,741,743],{"class":93,"line":223},[91,742,209],{"class":101},[91,744,745],{"class":117},"\"CVE-2023-22515\"\n",[91,747,748,750],{"class":93,"line":235},[91,749,249],{"class":97},[91,751,102],{"class":101},[91,753,754,756,758,760],{"class":93,"line":246},[91,755,155],{"class":101},[91,757,158],{"class":97},[91,759,114],{"class":101},[91,761,263],{"class":117},[91,763,764,766,768],{"class":93,"line":254},[91,765,269],{"class":97},[91,767,114],{"class":101},[91,769,451],{"class":117},[91,771,772,774,776],{"class":93,"line":266},[91,773,457],{"class":97},[91,775,114],{"class":101},[91,777,462],{"class":117},[12,779,780],{},"Maintenez une liste évolutive des entrées KEV pertinentes pour votre pile et mettez la politique à jour au fur et à mesure que de nouvelles CVE sont ajoutées au catalogue. Vous créez ainsi une boucle de rétroaction entre les renseignements sur les menaces et la gravité visible par les développeurs, sans que les analystes aient à ajuster manuellement chaque résultat.",[70,782,784],{"id":783},"_5-appliquer-des-modèles-de-risque-au-niveau-du-groupe-dans-lorganisation","5. Appliquer des modèles de risque au niveau du groupe dans l'organisation",[12,786,787,788,791],{},"Les politiques des projets individuels ne sont pas évolutives lorsque votre organisation compte des centaines ou des milliers de projets. Les politiques de remplacement de la gravité peuvent être appliquées au niveau du groupe, ce qui affecte tous les projets du groupe. Combinez-les à ",[88,789,790],{},"policy_scope"," pour cibler des politiques sur les projets correspondant à un label de framework de conformité spécifique.",[12,793,794],{},"Par exemple, une organisation disposant d'un framework de conformité « PCI-DSS » peut imposer un traitement de gravité plus strict pour les vulnérabilités d'injection dans tous les projets à périmètre PCI, tout en appliquant une politique plus légère aux groupes d'outils internes :",[81,796,798],{"className":83,"code":797,"language":85,"meta":86,"style":86},"vulnerability_management_policy:\n  - name: \"PCI projects: upgrade injection severity\"\n    description: \"All injection vulnerabilities are Critical in PCI scope\"\n    enabled: true\n    policy_scope:\n      compliance_frameworks:\n        - id: 12345\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cwe\n            values:\n              - \"CWE-79\"\n              - \"CWE-89\"\n              - \"CWE-78\"\n              - \"CWE-94\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: critical\n",[88,799,800,806,817,826,834,841,848,861,867,877,883,893,901,907,913,919,926,933,939,950,959],{"__ignoreMap":86},[91,801,802,804],{"class":93,"line":94},[91,803,98],{"class":97},[91,805,102],{"class":101},[91,807,808,810,812,814],{"class":93,"line":105},[91,809,108],{"class":101},[91,811,111],{"class":97},[91,813,114],{"class":101},[91,815,816],{"class":117},"\"PCI projects: upgrade injection severity\"\n",[91,818,819,821,823],{"class":93,"line":121},[91,820,124],{"class":97},[91,822,114],{"class":101},[91,824,825],{"class":117},"\"All injection vulnerabilities are Critical in PCI scope\"\n",[91,827,828,830,832],{"class":93,"line":132},[91,829,135],{"class":97},[91,831,114],{"class":101},[91,833,141],{"class":140},[91,835,836,839],{"class":93,"line":144},[91,837,838],{"class":97},"    policy_scope",[91,840,102],{"class":101},[91,842,843,846],{"class":93,"line":152},[91,844,845],{"class":97},"      compliance_frameworks",[91,847,102],{"class":101},[91,849,850,853,856,858],{"class":93,"line":166},[91,851,852],{"class":101},"        - ",[91,854,855],{"class":97},"id",[91,857,114],{"class":101},[91,859,860],{"class":140},"12345\n",[91,862,863,865],{"class":93,"line":174},[91,864,147],{"class":97},[91,866,102],{"class":101},[91,868,869,871,873,875],{"class":93,"line":187},[91,870,155],{"class":101},[91,872,158],{"class":97},[91,874,114],{"class":101},[91,876,163],{"class":117},[91,878,879,881],{"class":93,"line":198},[91,880,169],{"class":97},[91,882,102],{"class":101},[91,884,885,887,889,891],{"class":93,"line":206},[91,886,177],{"class":101},[91,888,158],{"class":97},[91,890,114],{"class":101},[91,892,184],{"class":117},[91,894,895,897,899],{"class":93,"line":215},[91,896,190],{"class":97},[91,898,114],{"class":101},[91,900,387],{"class":117},[91,902,903,905],{"class":93,"line":223},[91,904,201],{"class":97},[91,906,102],{"class":101},[91,908,909,911],{"class":93,"line":235},[91,910,209],{"class":101},[91,912,400],{"class":117},[91,914,915,917],{"class":93,"line":246},[91,916,209],{"class":101},[91,918,407],{"class":117},[91,920,921,923],{"class":93,"line":254},[91,922,209],{"class":101},[91,924,925],{"class":117},"\"CWE-78\"\n",[91,927,928,930],{"class":93,"line":266},[91,929,209],{"class":101},[91,931,932],{"class":117},"\"CWE-94\"\n",[91,934,935,937],{"class":93,"line":454},[91,936,249],{"class":97},[91,938,102],{"class":101},[91,940,942,944,946,948],{"class":93,"line":941},19,[91,943,155],{"class":101},[91,945,158],{"class":97},[91,947,114],{"class":101},[91,949,263],{"class":117},[91,951,953,955,957],{"class":93,"line":952},20,[91,954,269],{"class":97},[91,956,114],{"class":101},[91,958,451],{"class":117},[91,960,962,964,966],{"class":93,"line":961},21,[91,963,457],{"class":97},[91,965,114],{"class":101},[91,967,462],{"class":117},[12,969,970],{},"Avec ce modèle, l'équipe de sécurité définit le modèle de risque une seule fois pour qu'il s'applique de manière cohérente partout. Aucune configuration par projet. Aucune dépendance vis-à-vis du bon vouloir de chaque équipe pour configurer les choses correctement.",[19,972,974],{"id":973},"premiers-pas","Premiers pas",[12,976,977],{},"Suivez ces étapes pour créer des politiques de gestion des vulnérabilités :",[979,980,981,987,993,999,1009],"ol",{},[40,982,983,986],{},[43,984,985],{},"Identifiez le décalage."," Ouvrez votre rapport de vulnérabilités et filtrez par « Nécessite un classement ». Recherchez des schémas : résultats critiques dans du code de test, résultats modérés faisant l'objet d'une exploitation active, évaluations incohérentes entre les types d'analyse.",[40,988,989,992],{},[43,990,991],{},"Choisissez un cas d'utilisation."," Commencez par le scénario ci-dessus qui couvre le plus grand nombre de résultats incohérents.",[40,994,995,998],{},[43,996,997],{},"Définissez votre base de référence."," Notez la distribution des gravités avant de créer une politique (nombre de résultats critiques, élevés, modérés dans le périmètre cible).",[40,1000,1001,1004,1005,1008],{},[43,1002,1003],{},"Créez et appliquez une politique."," Accédez à ",[43,1006,1007],{},"Sécurisation > Politiques > Nouvelle politique > Politique de gestion des vulnérabilités",". Collez la configuration du cas d'utilisation ci-dessus, puis fusionnez la merge request.",[40,1010,1011,1014],{},[43,1012,1013],{},"Validez les résultats."," Après le prochain pipeline de la branche par défaut, vérifiez les gravités mises à jour dans le rapport de vulnérabilités. Filtrez le journal d'activité pour identifier les résultats ajustés et confirmer leur exactitude.",[70,1016,1018],{"id":1017},"référence-rapide","Référence rapide",[1020,1021,1022,1035],"table",{},[1023,1024,1025],"thead",{},[1026,1027,1028,1032],"tr",{},[1029,1030,1031],"th",{},"Paramètre",[1029,1033,1034],{},"Détails",[1036,1037,1038,1073,1093,1117,1138,1148,1158,1171],"tbody",{},[1026,1039,1040,1046],{},[1041,1042,1043],"td",{},[43,1044,1045],{},"Types de critères",[1041,1047,1048,1051,1052,1051,1055,1058,1059,1062,1063,1051,1066,1051,1069,1072],{},[88,1049,1050],{},"file_path",", ",[88,1053,1054],{},"directory",[88,1056,1057],{},"identifier"," (avec ",[88,1060,1061],{},"identifier_type"," facultatif : ",[88,1064,1065],{},"cve",[88,1067,1068],{},"cwe",[88,1070,1071],{},"owasp",")",[1026,1074,1075,1080],{},[1041,1076,1077],{},[43,1078,1079],{},"Opérations de remplacement",[1041,1081,1082,1085,1086,1089,1090,1092],{},[88,1083,1084],{},"set"," (niveau précis), ",[88,1087,1088],{},"increase"," (niveau supérieur), ",[88,1091,280],{}," (niveau inférieur)",[1026,1094,1095,1100],{},[1041,1096,1097],{},[43,1098,1099],{},"Niveaux de gravité",[1041,1101,1102,1051,1105,1051,1108,1051,1111,1051,1114],{},[88,1103,1104],{},"info",[88,1106,1107],{},"low",[88,1109,1110],{},"medium",[88,1112,1113],{},"high",[88,1115,1116],{},"critical",[1026,1118,1119,1124],{},[1041,1120,1121],{},[43,1122,1123],{},"Valeurs",[1041,1125,1126,1127,1130,1131,1134,1135,1072],{},"Valeur unique ",[88,1128,1129],{},"value"," ou tableau ",[88,1132,1133],{},"values"," (jusqu'à 1 000 éléments, logique OU). Caractères génériques pris en charge (ex. : ",[88,1136,1137],{},"CVE-2023-*",[1026,1139,1140,1145],{},[1041,1141,1142],{},[43,1143,1144],{},"Logique des critères",[1041,1146,1147],{},"Plusieurs critères dans une règle = ET (tous doivent correspondre). Plusieurs règles dans une politique = OU (au moins une doit correspondre)",[1026,1149,1150,1155],{},[1041,1151,1152],{},[43,1153,1154],{},"Limites",[1041,1156,1157],{},"3 critères par règle, 5 règles par politique, 5 politiques par projet de politique de sécurité",[1026,1159,1160,1165],{},[1041,1161,1162],{},[43,1163,1164],{},"Portée",[1041,1166,1167,1168,1170],{},"Niveau du projet ou niveau du groupe. ",[88,1169,790],{}," pour le ciblage par framework de conformité",[1026,1172,1173,1178],{},[1041,1174,1175],{},[43,1176,1177],{},"Priorité des remplacements manuels",[1041,1179,1180],{},"Les remplacements manuels effectués par des utilisateurs autorisés ont toujours la priorité",[19,1182,1184],{"id":1183},"faq","FAQ",[12,1186,1187,1196],{},[43,1188,1189,1190,1195],{},"Quelle est la différence entre le ",[27,1191,1194],{"href":1192,"rel":1193},"https://about.gitlab.com/fr-fr/blog/auto-dismiss-vulnerability-management-policy/",[],"rejet automatique"," et le remplacement de la gravité ?","\nLe rejet automatique supprime les résultats de votre file de classement active. Le remplacement de la gravité les conserve, mais ajuste leur niveau de priorité : ils continuent d'être suivis et examinés avec l'urgence appropriée.",[12,1198,1199,1202,1203,1206],{},[43,1200,1201],{},"Peut-on combiner des remplacements de gravité avec d'autres types de politiques ?","\nOui. Les remplacements de gravité s'appliquent aux résultats sur la branche ",[88,1204,1205],{},"default",", ce qui affecte les vulnérabilités apparaissant dans les rapports de vulnérabilités GitLab. Vous pouvez ensuite utiliser des politiques d'approbation des merge requests pour contrôler les nouvelles vulnérabilités détectées.",[12,1208,1209,1212],{},[43,1210,1211],{},"Les remplacements de gravité s'appliquent-ils rétroactivement aux vulnérabilités existantes ?","\nOui. Lorsqu'une politique de remplacement de gravité est appliquée, elle traite les vulnérabilités correspondantes dont le statut est « Nécessite un classement » ou « Confirmé » lors du prochain pipeline de la branche par défaut, jusqu'à 1 000 par exécution.",[12,1214,1215,1218],{},[43,1216,1217],{},"Que se passe-t-il si deux politiques définissent des gravités contradictoires ?","\nLes remplacements manuels ont toujours la priorité. En cas de conflit entre politiques, la politique la plus récente a la priorité. Examinez régulièrement vos politiques pour éviter les critères qui se chevauchent.",[12,1220,1221,1224],{},[43,1222,1223],{},"Les équipes de développement peuvent-elles contourner les politiques de remplacement de gravité ?","\nNon. Les politiques sont gérées dans un projet de politique de sécurité à accès restreint. Les équipes de développement ne peuvent ni les modifier ni les désactiver. Les utilisateurs autorisés peuvent appliquer des remplacements manuels sur des vulnérabilités individuelles, qui auront la priorité.",[1226,1227,1228],"blockquote",{},[12,1229,1230,1231,1236,1237,1242],{},"Envie de faire en sorte que votre rapport de vulnérabilités reflète les risques réels ? ",[27,1232,1235],{"href":1233,"rel":1234},"https://docs.gitlab.com/user/application_security/policies/vulnerability_management_policy/#severity-override-policies",[],"Consultez la documentation sur les politiques de remplacement de la gravité"," ou ",[27,1238,1241],{"href":1239,"rel":1240},"https://about.gitlab.com/fr-fr/free-trial/?utm_medium=blog&utm_source=blog&utm_campaign=eg_emea_x_trial_x_fr_blog_fr",[],"démarrez un essai gratuit de GitLab Ultimate"," pour essayer cette fonctionnalité dès aujourd'hui.",[1244,1245,1246],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":86,"searchDepth":105,"depth":105,"links":1248},[1249,1250,1257,1260],{"id":21,"depth":105,"text":22},{"id":64,"depth":105,"text":65,"children":1251},[1252,1253,1254,1255,1256],{"id":72,"depth":121,"text":73},{"id":284,"depth":121,"text":285},{"id":474,"depth":121,"text":475},{"id":626,"depth":121,"text":627},{"id":783,"depth":121,"text":784},{"id":973,"depth":105,"text":974,"children":1258},[1259],{"id":1017,"depth":121,"text":1018},{"id":1183,"depth":105,"text":1184},"security","2026-07-07","Les scores CVSS par défaut ne reflètent pas vos risques réels. Utilisez les politiques de remplacement de la gravité GitLab pour automatiser les ajustements en fonction des CVE, des CWE, du chemin de fichier et du répertoire.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/f_auto,q_auto,c_lfill/v1772630163/akp8ly2mrsfrhsb0liyb.png",{},true,"/fr-fr/blog/severity-override-vulnerability-management-policy",{"config":1272,"title":1273,"description":1274},{"noIndex":1266},"GitLab : corriger les niveaux de gravité des vulnérabilités","Les scores CVSS ne reflètent pas vos risques réels. Automatisez les ajustements avec les politiques de GitLab selon les CVE, CWE et le répertoire.","severity-override-vulnerability-management-policy","fr-fr/blog/severity-override-vulnerability-management-policy",[1261,1278],"tutorial","BlogPost","mYJyM1EPKgfq8U7PllDGrNvdFoONJZKGD87HUF1S1wg",{"logo":1282,"freeTrial":1287,"sales":1292,"login":1297,"items":1302,"search":1630,"minimal":1666,"duo":1685,"switchNav":1694,"pricingDeployment":1705},{"config":1283},{"href":1284,"dataGaName":1285,"dataGaLocation":1286},"/fr-fr/","gitlab logo","header",{"text":1288,"config":1289},"Commencer un essai gratuit",{"href":1290,"dataGaName":1291,"dataGaLocation":1286},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/fr-fr&glm_content=default-saas-trial/","free trial",{"text":1293,"config":1294},"Demander une démo",{"href":1295,"dataGaName":1296,"dataGaLocation":1286},"/fr-fr/sales/?contact-topic=request-demo","sales",{"text":1298,"config":1299},"Connexion",{"href":1300,"dataGaName":1301,"dataGaLocation":1286},"https://gitlab.com/users/sign_in/","sign in",[1303,1332,1434,1439,1552,1608],{"text":1304,"config":1305,"menu":1307},"Plateforme",{"dataNavLevelOne":1306},"platform",{"type":1308,"columns":1309},"cards",[1310,1316,1324],{"title":1304,"description":1311,"link":1312},"La plateforme d'orchestration intelligente pour le DevSecOps",{"text":1313,"config":1314},"Explorer notre plateforme",{"href":1315,"dataGaName":1306,"dataGaLocation":1286},"/fr-fr/platform/",{"title":1317,"description":1318,"link":1319},"GitLab Duo Agent Platform","L'IA agentique pour l'ensemble du cycle de développement logiciel",{"text":1320,"config":1321},"Découvrir GitLab Duo",{"href":1322,"dataGaName":1323,"dataGaLocation":1286},"/fr-fr/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1325,"description":1326,"link":1327},"Pourquoi GitLab ?","Découvrez les principales raisons pour lesquelles les entreprises choisissent GitLab",{"text":1328,"config":1329},"En savoir plus",{"href":1330,"dataGaName":1331,"dataGaLocation":1286},"/fr-fr/why-gitlab/","why gitlab",{"text":1333,"left":1269,"config":1334,"menu":1336},"Produit",{"dataNavLevelOne":1335},"solutions",{"type":1337,"link":1338,"columns":1342,"feature":1413},"lists",{"text":1339,"config":1340},"Voir toutes les solutions",{"href":1341,"dataGaName":1335,"dataGaLocation":1286},"/fr-fr/solutions/",[1343,1368,1391],{"title":1344,"description":1345,"link":1346,"items":1351},"Automatisation","CI/CD et automatisation pour accélérer le déploiement",{"config":1347},{"icon":1348,"href":1349,"dataGaName":1350,"dataGaLocation":1286},"AutomatedCodeAlt","/fr-fr/solutions/delivery-automation/","automated software delivery",[1352,1356,1359,1364],{"text":1353,"config":1354},"CI/CD",{"href":1355,"dataGaLocation":1286,"dataGaName":1353},"/fr-fr/solutions/continuous-integration/",{"text":1317,"config":1357},{"href":1322,"dataGaLocation":1286,"dataGaName":1358},"gitlab duo agent platform - product menu",{"text":1360,"config":1361},"Gestion du code source",{"href":1362,"dataGaLocation":1286,"dataGaName":1363},"/fr-fr/solutions/source-code-management/","Source Code Management",{"text":1365,"config":1366},"Livraison de logiciels automatisée",{"href":1349,"dataGaLocation":1286,"dataGaName":1367},"Automated software delivery",{"title":1369,"description":1370,"link":1371,"items":1376},"Sécurité","Livrez du code plus rapidement sans compromettre la sécurité",{"config":1372},{"href":1373,"dataGaName":1374,"dataGaLocation":1286,"icon":1375},"/fr-fr/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1377,1381,1386],{"text":1378,"config":1379},"Tests de sécurité des applications",{"href":1373,"dataGaName":1380,"dataGaLocation":1286},"Application security testing",{"text":1382,"config":1383},"Sécurité de la chaîne d'approvisionnement logicielle",{"href":1384,"dataGaLocation":1286,"dataGaName":1385},"/fr-fr/solutions/supply-chain/","Software supply chain security",{"text":1387,"config":1388},"Conformité logicielle",{"href":1389,"dataGaName":1390,"dataGaLocation":1286},"/fr-fr/solutions/software-compliance/","software compliance",{"title":1392,"link":1393,"items":1398},"Mesures",{"config":1394},{"icon":1395,"href":1396,"dataGaName":1397,"dataGaLocation":1286},"DigitalTransformation","/fr-fr/solutions/visibility-measurement/","visibility and measurement",[1399,1403,1408],{"text":1400,"config":1401},"Visibilité et mesures",{"href":1396,"dataGaLocation":1286,"dataGaName":1402},"Visibility and Measurement",{"text":1404,"config":1405},"Gestion de la chaîne de valeur",{"href":1406,"dataGaLocation":1286,"dataGaName":1407},"/fr-fr/solutions/value-stream-management/","Value Stream Management",{"text":1409,"config":1410},"Analyses et informations",{"href":1411,"dataGaLocation":1286,"dataGaName":1412},"/fr-fr/solutions/analytics-and-insights/","Analytics and insights",{"title":1414,"type":1337,"items":1415},"GitLab",[1416,1422,1428],{"text":1417,"config":1418},"Entreprises",{"icon":1419,"href":1420,"dataGaLocation":1286,"dataGaName":1421},"Building","/fr-fr/enterprise/","enterprise",{"text":1423,"config":1424},"Pour les PME",{"icon":1425,"href":1426,"dataGaLocation":1286,"dataGaName":1427},"Work","/fr-fr/small-business/","small business",{"text":1429,"config":1430},"Pour le secteur public",{"icon":1431,"href":1432,"dataGaLocation":1286,"dataGaName":1433},"Organization","/fr-fr/solutions/public-sector/","public sector",{"text":1435,"config":1436},"Tarifs",{"href":1437,"dataGaName":1438,"dataGaLocation":1286,"dataNavLevelOne":1438},"/fr-fr/pricing/","pricing",{"text":1440,"config":1441,"menu":1443},"Ressources",{"dataNavLevelOne":1442},"resources",{"type":1337,"link":1444,"columns":1448,"feature":1541},{"text":1445,"config":1446},"Afficher toutes les ressources",{"href":1447,"dataGaName":1442,"dataGaLocation":1286},"/fr-fr/resources/",[1449,1481,1508],{"title":974,"items":1450},[1451,1456,1461,1466,1471,1476],{"text":1452,"config":1453},"Installation",{"href":1454,"dataGaName":1455,"dataGaLocation":1286},"/fr-fr/install/","install",{"text":1457,"config":1458},"Guides de démarrage",{"href":1459,"dataGaName":1460,"dataGaLocation":1286},"/fr-fr/get-started/","quick setup checklists",{"text":1462,"config":1463},"Apprentissage",{"href":1464,"dataGaLocation":1286,"dataGaName":1465},"https://university.gitlab.com/","learn",{"text":1467,"config":1468},"Documentation",{"href":1469,"dataGaName":1470,"dataGaLocation":1286},"https://docs.gitlab.com/","product documentation",{"text":1472,"config":1473},"Vidéos sur les bonnes pratiques",{"href":1474,"dataGaName":1475,"dataGaLocation":1286},"/fr-fr/getting-started-videos/","best practice videos",{"text":1477,"config":1478},"Intégrations",{"href":1479,"dataGaName":1480,"dataGaLocation":1286},"/fr-fr/integrations/","integrations",{"title":1482,"items":1483},"Découvrir",[1484,1489,1494,1499,1503],{"text":1485,"config":1486},"Témoignages clients",{"href":1487,"dataGaName":1488,"dataGaLocation":1286},"/fr-fr/customers/","customer success stories",{"text":1490,"config":1491},"Blog",{"href":1492,"dataGaName":1493,"dataGaLocation":1286},"/fr-fr/blog/","blog",{"text":1495,"config":1496},"Demo Hub",{"href":1497,"dataGaName":1498,"dataGaLocation":1286},"/fr-fr/demo-hub/","demo hub",{"text":1500,"config":1501},"The Source",{"href":1502,"dataGaName":1493,"dataGaLocation":1286},"/fr-fr/the-source/",{"text":1504,"config":1505},"Travail à distance",{"href":1506,"dataGaName":1507,"dataGaLocation":1286},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1509,"items":1510},"Connecter",[1511,1516,1521,1526,1531,1536],{"text":1512,"config":1513},"Services GitLab",{"href":1514,"dataGaName":1515,"dataGaLocation":1286},"/fr-fr/services/","services",{"text":1517,"config":1518},"Contribuer",{"href":1519,"dataGaName":1520,"dataGaLocation":1286},"https://contributors.gitlab.com","contribute",{"text":1522,"config":1523},"Communauté",{"href":1524,"dataGaName":1525,"dataGaLocation":1286},"/community/","community",{"text":1527,"config":1528},"Forum",{"href":1529,"dataGaName":1530,"dataGaLocation":1286},"https://forum.gitlab.com/","forum",{"text":1532,"config":1533},"Événements",{"href":1534,"dataGaName":1535,"dataGaLocation":1286},"/events/","events",{"text":1537,"config":1538},"Partenaires",{"href":1539,"dataGaName":1540,"dataGaLocation":1286},"/fr-fr/partners/","partners",{"config":1542,"title":1545,"text":1546,"link":1547},{"background":1543,"textColor":1544},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","Nouveautés de GitLab","Découvrez les dernières fonctionnalités et améliorations.",{"text":1548,"config":1549},"Lire les articles les plus récents",{"href":1550,"dataGaName":1551,"dataGaLocation":1286},"/fr-fr/whats-new/","whats new",{"text":1553,"config":1554,"menu":1556},"Société",{"dataNavLevelOne":1555},"company",{"type":1337,"columns":1557},[1558],{"items":1559},[1560,1565,1571,1573,1578,1583,1588,1593,1598,1603],{"text":1561,"config":1562},"À propos",{"href":1563,"dataGaName":1564,"dataGaLocation":1286},"/fr-fr/company/","about",{"text":1566,"config":1567,"footerGa":1570},"Carrières",{"href":1568,"dataGaName":1569,"dataGaLocation":1286},"/jobs/","jobs",{"dataGaName":1569},{"text":1532,"config":1572},{"href":1534,"dataGaName":1535,"dataGaLocation":1286},{"text":1574,"config":1575},"Leadership",{"href":1576,"dataGaName":1577,"dataGaLocation":1286},"/company/team/e-group/","leadership",{"text":1579,"config":1580},"Manuel",{"href":1581,"dataGaName":1582,"dataGaLocation":1286},"https://handbook.gitlab.com/","handbook",{"text":1584,"config":1585},"Relations avec les investisseurs",{"href":1586,"dataGaName":1587,"dataGaLocation":1286},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1589,"config":1590},"Trust Center",{"href":1591,"dataGaName":1592,"dataGaLocation":1286},"/fr-fr/security/","trust center",{"text":1594,"config":1595},"Centre pour la transparence de l'IA",{"href":1596,"dataGaName":1597,"dataGaLocation":1286},"/fr-fr/ai-transparency-center/","ai transparency center",{"text":1599,"config":1600},"Newsletter",{"href":1601,"dataGaName":1602,"dataGaLocation":1286},"/company/contact/#contact-forms","newsletter",{"text":1604,"config":1605},"Presse",{"href":1606,"dataGaName":1607,"dataGaLocation":1286},"/press/","press",{"text":1609,"config":1610,"menu":1611},"Nous contacter",{"dataNavLevelOne":1555},{"type":1337,"columns":1612},[1613],{"items":1614},[1615,1620,1625],{"text":1616,"config":1617},"Contacter l'équipe commerciale",{"href":1618,"dataGaName":1619,"dataGaLocation":1286},"/fr-fr/sales/","talk to sales",{"text":1621,"config":1622},"Assistance GitLab",{"href":1623,"dataGaName":1624,"dataGaLocation":1286},"https://support.gitlab.com/hc/en-us","support portal",{"text":1626,"config":1627},"Portail clients GitLab",{"href":1628,"dataGaName":1629,"dataGaLocation":1286},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1631,"login":1632,"suggestions":1639},"Fermer",{"text":1633,"link":1634},"Pour rechercher des dépôts et des projets, connectez-vous à",{"text":1635,"config":1636},"GitLab.com",{"href":1300,"dataGaName":1637,"dataGaLocation":1638},"search login","search",{"text":1640,"default":1641},"Suggestions",[1642,1645,1650,1652,1657,1662],{"text":1317,"config":1643},{"href":1322,"dataGaName":1644,"dataGaLocation":1638},"GitLab Duo Agent Platform",{"text":1646,"config":1647},"Suggestions de code (IA)",{"href":1648,"dataGaName":1649,"dataGaLocation":1638},"/fr-fr/solutions/code-suggestions/","Code Suggestions (AI)",{"text":1353,"config":1651},{"href":1355,"dataGaName":1353,"dataGaLocation":1638},{"text":1653,"config":1654},"GitLab sur AWS",{"href":1655,"dataGaName":1656,"dataGaLocation":1638},"/fr-fr/partners/technology-partners/aws/","GitLab on AWS",{"text":1658,"config":1659},"GitLab sur Google Cloud",{"href":1660,"dataGaName":1661,"dataGaLocation":1638},"/fr-fr/partners/technology-partners/google-cloud-platform/","GitLab on Google Cloud",{"text":1663,"config":1664},"Pourquoi utiliser GitLab ?",{"href":1330,"dataGaName":1665,"dataGaLocation":1638},"Why GitLab?",{"freeTrial":1667,"mobileIcon":1672,"desktopIcon":1677,"secondaryButton":1680},{"text":1668,"config":1669},"Commencer votre essai gratuit",{"href":1670,"dataGaName":1291,"dataGaLocation":1671},"https://gitlab.com/-/trials/new/","nav",{"altText":1673,"config":1674},"Icône GitLab",{"src":1675,"dataGaName":1676,"dataGaLocation":1671},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1673,"config":1678},{"src":1679,"dataGaName":1676,"dataGaLocation":1671},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1681,"config":1682},"Commencer",{"href":1683,"dataGaName":1684,"dataGaLocation":1671},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/fr-fr/get-started/","get started",{"freeTrial":1686,"mobileIcon":1690,"desktopIcon":1692},{"text":1687,"config":1688},"En savoir plus sur GitLab Duo",{"href":1322,"dataGaName":1689,"dataGaLocation":1671},"gitlab duo",{"altText":1673,"config":1691},{"src":1675,"dataGaName":1676,"dataGaLocation":1671},{"altText":1673,"config":1693},{"src":1679,"dataGaName":1676,"dataGaLocation":1671},{"button":1695,"mobileIcon":1700,"desktopIcon":1702},{"text":1696,"config":1697},"/switch",{"href":1698,"dataGaName":1699,"dataGaLocation":1671},"#contact","switch",{"altText":1673,"config":1701},{"src":1675,"dataGaName":1676,"dataGaLocation":1671},{"altText":1673,"config":1703},{"src":1704,"dataGaName":1676,"dataGaLocation":1671},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1706,"mobileIcon":1711,"desktopIcon":1713},{"text":1707,"config":1708},"Retour aux tarifs",{"href":1437,"dataGaName":1709,"dataGaLocation":1671,"icon":1710},"back to pricing","GoBack",{"altText":1673,"config":1712},{"src":1675,"dataGaName":1676,"dataGaLocation":1671},{"altText":1673,"config":1714},{"src":1679,"dataGaName":1676,"dataGaLocation":1671},{"title":1716,"button":1717,"config":1721},"GitLab Orbit est arrivé : la couche de contexte pour les agents d'IA.",{"text":1328,"config":1718},{"href":1719,"dataGaName":1720,"dataGaLocation":1286},"/fr-fr/gitlab-orbit/","orbit",{"layout":1722,"disabled":1266},"release",{"data":1724},{"text":1725,"source":1726,"edit":1732,"contribute":1737,"config":1741,"items":1746,"minimal":1954},"Git est une marque déposée de Software Freedom Conservancy et notre utilisation de « GitLab » est sous licence.",{"text":1727,"config":1728},"Afficher le code source de la page",{"href":1729,"dataGaName":1730,"dataGaLocation":1731},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1733,"config":1734},"Modifier cette page",{"href":1735,"dataGaName":1736,"dataGaLocation":1731},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1517,"config":1738},{"href":1739,"dataGaName":1740,"dataGaLocation":1731},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1742,"facebook":1743,"youtube":1744,"linkedin":1745},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1747,1793,1846,1889,1921],{"title":1435,"links":1748,"subMenu":1763},[1749,1753,1758],{"text":1750,"config":1751},"Voir les forfaits",{"href":1437,"dataGaName":1752,"dataGaLocation":1731},"view plans",{"text":1754,"config":1755},"GitLab Premium",{"href":1756,"dataGaName":1757,"dataGaLocation":1731},"/fr-fr/pricing/premium/","why premium",{"text":1759,"config":1760},"GitLab Ultimate",{"href":1761,"dataGaName":1762,"dataGaLocation":1731},"/fr-fr/pricing/ultimate/","why ultimate",[1764],{"title":1609,"links":1765},[1766,1768,1770,1773,1778,1783,1788],{"text":1616,"config":1767},{"href":1618,"dataGaName":1296,"dataGaLocation":1731},{"text":1621,"config":1769},{"href":1623,"dataGaName":1624,"dataGaLocation":1731},{"text":1771,"config":1772},"Portail clients",{"href":1628,"dataGaName":1629,"dataGaLocation":1731},{"text":1774,"config":1775},"Statut",{"href":1776,"dataGaName":1777,"dataGaLocation":1731},"https://status.gitlab.com/","status",{"text":1779,"config":1780},"Conditions d'utilisation",{"href":1781,"dataGaName":1782,"dataGaLocation":1731},"/terms/","terms of use",{"text":1784,"config":1785},"Politique de confidentialité",{"href":1786,"dataGaName":1787,"dataGaLocation":1731},"/fr-fr/privacy/","privacy statement",{"text":1789,"config":1790},"Gestion des cookies",{"dataGaName":1791,"dataGaLocation":1731,"id":1792,"isOneTrustButton":1269},"cookie preferences","ot-sdk-btn",{"title":1333,"links":1794,"subMenu":1803},[1795,1799],{"text":1796,"config":1797},"Plateforme DevSecOps",{"href":1315,"dataGaName":1798,"dataGaLocation":1731},"devsecops platform",{"text":1800,"config":1801},"Développement assisté par l'IA",{"href":1322,"dataGaName":1802,"dataGaLocation":1731},"ai-assisted development",[1804],{"title":1805,"links":1806},"Thèmes",[1807,1811,1816,1821,1826,1831,1836,1841],{"text":1353,"config":1808},{"href":1809,"dataGaName":1810,"dataGaLocation":1731},"/fr-fr/topics/ci-cd/","cicd",{"text":1812,"config":1813},"GitOps",{"href":1814,"dataGaName":1815,"dataGaLocation":1731},"/fr-fr/topics/gitops/","gitops",{"text":1817,"config":1818},"DevOps",{"href":1819,"dataGaName":1820,"dataGaLocation":1731},"/fr-fr/topics/devops/","devops",{"text":1822,"config":1823},"Contrôle de version",{"href":1824,"dataGaName":1825,"dataGaLocation":1731},"/fr-fr/topics/version-control/","version control",{"text":1827,"config":1828},"DevSecOps",{"href":1829,"dataGaName":1830,"dataGaLocation":1731},"/fr-fr/topics/devsecops/","devsecops",{"text":1832,"config":1833},"Cloud-native",{"href":1834,"dataGaName":1835,"dataGaLocation":1731},"/fr-fr/topics/cloud-native/","cloud native",{"text":1837,"config":1838},"IA pour la programmation",{"href":1839,"dataGaName":1840,"dataGaLocation":1731},"/fr-fr/topics/devops/ai-for-coding/","ai for coding",{"text":1842,"config":1843},"IA agentique",{"href":1844,"dataGaName":1845,"dataGaLocation":1731},"/fr-fr/topics/agentic-ai/","agentic ai",{"title":1847,"links":1848},"Solutions",[1849,1852,1854,1859,1862,1865,1868,1871,1873,1876,1879,1884],{"text":1378,"config":1850},{"href":1373,"dataGaName":1851,"dataGaLocation":1731},"Application Security Testing",{"text":1365,"config":1853},{"href":1349,"dataGaName":1350,"dataGaLocation":1731},{"text":1855,"config":1856},"Développement Agile",{"href":1857,"dataGaName":1858,"dataGaLocation":1731},"/fr-fr/solutions/agile-delivery/","agile delivery",{"text":1360,"config":1860},{"href":1362,"dataGaName":1861,"dataGaLocation":1731},"source code management",{"text":1353,"config":1863},{"href":1355,"dataGaName":1864,"dataGaLocation":1731},"continuous integration & delivery",{"text":1404,"config":1866},{"href":1406,"dataGaName":1867,"dataGaLocation":1731},"value stream management",{"text":1812,"config":1869},{"href":1870,"dataGaName":1815,"dataGaLocation":1731},"/fr-fr/solutions/gitops/",{"text":1417,"config":1872},{"href":1420,"dataGaName":1421,"dataGaLocation":1731},{"text":1874,"config":1875},"PME",{"href":1426,"dataGaName":1427,"dataGaLocation":1731},{"text":1877,"config":1878},"Secteur public",{"href":1432,"dataGaName":1433,"dataGaLocation":1731},{"text":1880,"config":1881},"Éducation",{"href":1882,"dataGaName":1883,"dataGaLocation":1731},"/fr-fr/solutions/education/","education",{"text":1885,"config":1886},"Services financiers",{"href":1887,"dataGaName":1888,"dataGaLocation":1731},"/fr-fr/solutions/finance/","financial services",{"title":1440,"links":1890},[1891,1893,1895,1897,1900,1902,1905,1907,1909,1911,1913,1915,1917,1919],{"text":1452,"config":1892},{"href":1454,"dataGaName":1455,"dataGaLocation":1731},{"text":1457,"config":1894},{"href":1459,"dataGaName":1460,"dataGaLocation":1731},{"text":1462,"config":1896},{"href":1464,"dataGaName":1465,"dataGaLocation":1731},{"text":1467,"config":1898},{"href":1469,"dataGaName":1899,"dataGaLocation":1731},"docs",{"text":1490,"config":1901},{"href":1492,"dataGaName":1493,"dataGaLocation":1731},{"text":1903,"config":1904},"Nouveautés",{"href":1550,"dataGaName":1551,"dataGaLocation":1731},{"text":1485,"config":1906},{"href":1487,"dataGaName":1488,"dataGaLocation":1731},{"text":1504,"config":1908},{"href":1506,"dataGaName":1507,"dataGaLocation":1731},{"text":1512,"config":1910},{"href":1514,"dataGaName":1515,"dataGaLocation":1731},{"text":1517,"config":1912},{"href":1519,"dataGaName":1520,"dataGaLocation":1731},{"text":1522,"config":1914},{"href":1524,"dataGaName":1525,"dataGaLocation":1731},{"text":1527,"config":1916},{"href":1529,"dataGaName":1530,"dataGaLocation":1731},{"text":1532,"config":1918},{"href":1534,"dataGaName":1535,"dataGaLocation":1731},{"text":1537,"config":1920},{"href":1539,"dataGaName":1540,"dataGaLocation":1731},{"title":1553,"links":1922},[1923,1925,1927,1929,1931,1933,1938,1943,1945,1947,1949],{"text":1561,"config":1924},{"href":1563,"dataGaName":1555,"dataGaLocation":1731},{"text":1566,"config":1926},{"href":1568,"dataGaName":1569,"dataGaLocation":1731},{"text":1574,"config":1928},{"href":1576,"dataGaName":1577,"dataGaLocation":1731},{"text":1579,"config":1930},{"href":1581,"dataGaName":1582,"dataGaLocation":1731},{"text":1584,"config":1932},{"href":1586,"dataGaName":1587,"dataGaLocation":1731},{"text":1934,"config":1935},"Développement durable",{"href":1936,"dataGaName":1937,"dataGaLocation":1731},"/sustainability/","Sustainability",{"text":1939,"config":1940},"Diversité, inclusion et appartenance (DIB)",{"href":1941,"dataGaName":1942,"dataGaLocation":1731},"/fr-fr/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1589,"config":1944},{"href":1591,"dataGaName":1592,"dataGaLocation":1731},{"text":1599,"config":1946},{"href":1601,"dataGaName":1602,"dataGaLocation":1731},{"text":1604,"config":1948},{"href":1606,"dataGaName":1607,"dataGaLocation":1731},{"text":1950,"config":1951},"Déclaration de transparence sur l'esclavage moderne",{"href":1952,"dataGaName":1953,"dataGaLocation":1731},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1955},[1956,1958,1960],{"text":1779,"config":1957},{"href":1781,"dataGaName":1782,"dataGaLocation":1731},{"text":1789,"config":1959},{"dataGaName":1791,"dataGaLocation":1731,"id":1792,"isOneTrustButton":1269},{"text":1784,"config":1961},{"href":1786,"dataGaName":1787,"dataGaLocation":1731},[1963],{"id":1964,"title":7,"body":1265,"config":1965,"content":1967,"description":1265,"extension":1971,"meta":1972,"navigation":1269,"path":1973,"seo":1974,"stem":1975,"__hash__":1976},"blogAuthors/en-us/blog/authors/grant-hickman.yml",{"template":1966},"BlogAuthor",{"name":7,"config":1968},{"headshot":1969,"ctfId":1970},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749682570/Blog/Author%20Headshots/g.png","ghickman","yml",{},"/en-us/blog/authors/grant-hickman",{},"en-us/blog/authors/grant-hickman","3OY7ZjUzeOb_im7m1kimID61q_0OEhuzipAc3AHq2WM",[1978,1986,1991],{"title":1979,"description":1980,"heroImage":1981,"category":1261,"date":1982,"authors":1983,"slug":1985,"externalUrl":1265},"Le flow GitLab Duo Security Review détecte les failles logiques que les scanners n'identifient pas","Utilisez le raisonnement de sécurité piloté par l'IA pour détecter les failles d'autorisation, les erreurs de logique métier et les conditions de concurrence pendant la revue de code.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1783980535/t3gez0gpayfndrhncunf.png","2026-07-17",[1984],"Mark Settle","gitlab-duo-security-review-flow",{"title":1987,"description":1988,"heroImage":1981,"category":1261,"date":1982,"authors":1989,"slug":1990,"externalUrl":1265},"Une mise à jour de version fait échouer votre build ? GitLab le corrige !","Mettez à niveau vos dépendances automatiquement, adaptez le code en cas de changements cassants et transférez les modifications pour approbation : découvrez ces fonctionnalités natives uniquement proposées par GitLab, avec un contexte complet.",[1984],"dependency-scanning-auto-remediation",{"title":1992,"description":1993,"heroImage":1994,"category":1261,"date":1995,"authors":1996,"slug":1998,"externalUrl":1265},"Vue unifiée des vulnérabilités : de la couverture des scanners à la gouvernance de l'IA","Alors que l'IA génère davantage de code, la sécurité doit suivre le rythme. GitLab offre une plateforme unique pour la couverture, la détection et la correction des vulnérabilités, avec une gouvernance de l'IA sur les agents.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1781621337/mtjqzed2cqtef0frmor2.png","2026-06-19",[1997],"Alisa Ho","one-vulnerability-view",{"promotions":2000},[2001,2015,2027,2038],{"id":2002,"categories":2003,"header":2005,"text":2006,"button":2007,"image":2012},"ai-modernization",[2004],"ai","L'IA tient-elle ses promesses à grande échelle ?","Le questionnaire ne prendra pas plus de 5 minutes.",{"text":2008,"config":2009},"Obtenez votre score de maturité IA",{"href":2010,"dataGaName":2011,"dataGaLocation":1493},"/fr-fr/assessments/ai-modernization-assessment/","modernization assessment",{"config":2013},{"src":2014},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":2016,"categories":2017,"header":2019,"text":2006,"button":2020,"image":2024},"devops-modernization",[2018,1830],"product","Vous contentez-vous de gérer des outils ou de livrer des innovations ?",{"text":2021,"config":2022},"Obtenez votre score de maturité DevOps",{"href":2023,"dataGaName":2011,"dataGaLocation":1493},"/fr-fr/assessments/devops-modernization-assessment/",{"config":2025},{"src":2026},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":2028,"categories":2029,"header":2030,"text":2006,"button":2031,"image":2035},"security-modernization",[1261],"Faut-il sacrifier la rapidité pour garantir la sécurité ?",{"text":2032,"config":2033},"Obtenez votre score de maturité en matière de sécurité",{"href":2034,"dataGaName":2011,"dataGaLocation":1493},"/fr-fr/assessments/security-modernization-assessment/",{"config":2036},{"src":2037},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":2039,"paths":2040,"header":2043,"text":2044,"button":2045,"image":2050},"github-azure-migration",[2041,2042],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Votre équipe est-elle prête pour la migration de GitHub vers Azure ?","GitHub a déjà commencé sa migration vers Azure. Découvrez ce que cela signifie pour vous.",{"text":2046,"config":2047},"Découvrez les différences entre GitLab et GitHub",{"href":2048,"dataGaName":2049,"dataGaLocation":1493},"/fr-fr/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":2051},{"src":2026},{"header":2053,"blurb":2054,"button":2055,"secondaryButton":2059},"Commencez à développer plus rapidement dès aujourd'hui","Découvrez ce que votre équipe peut accomplir avec la plateforme d'orchestration intelligente pour le DevSecOps.\n",{"text":1288,"config":2056},{"href":2057,"dataGaName":1291,"dataGaLocation":2058},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/fr-fr/","feature",{"text":1616,"config":2060},{"href":1618,"dataGaName":1296,"dataGaLocation":2058},1786803765040]