[{"data":1,"prerenderedAt":988},["ShallowReactive",2],{"/blog/gitlab-business-logic-security-analyzer":3,"navigation-en-us":227,"banner-en-us":658,"footer-en-us":668,"blog-post-authors-en-us-Chris Widstrom":929,"blog-related-posts-en-us-gitlab-business-logic-security-analyzer":944,"blog-share-wrapper-en-us":968,"next-steps-en-us":978},{"id":4,"title":5,"authors":6,"body":8,"category":207,"date":208,"description":209,"extension":210,"externalUrl":211,"faq":211,"featured":212,"heroImage":213,"meta":214,"navigation":212,"path":215,"seo":216,"slug":219,"stem":220,"tags":221,"template":225,"updatedDate":211,"__hash__":226},"blogPosts/en-us/blog/gitlab-business-logic-security-analyzer.md","Uncover the business logic vulnerabilities SAST scanners miss",[7],"Chris Widstrom",{"type":9,"value":10,"toc":198},"minimark",[11,28,37,42,45,58,61,82,91,95,99,107,110,118,122,125,134,154,161,165,168,177,181,184],[12,13,14,15,21,22,27],"p",{},"Broken object-level authorization ranks first on the ",[16,17,20],"a",{"href":18,"rel":19},"https://owasp.org/API-Security/editions/2023/en/0x11-t10/",[],"OWASP API Security Top 10",", and ",[16,23,26],{"href":24,"rel":25},"https://owasp.org/www-community/Source_Code_Analysis_Tools",[],"OWASP says"," that traditional static application security testing (SAST) tools struggle to find access control flaws. A missing authorization check is an absence of code, so a scanner that matches patterns has nothing to match. You can find the gap only if you already know what the endpoint is meant to enforce.",[12,29,30,31,36],{},"We're building ",[16,32,35],{"href":33,"rel":34},"https://docs.gitlab.com/user/application_security/business_logic_scanning/",[],"Business Logic Security Analyzer"," in GitLab Duo Agent Platform to catch business logic vulnerabilities that pattern-based scanners miss. It is now in early access for GitLab Ultimate customers on GitLab.com.",[38,39,41],"h2",{"id":40},"valid-code-wrong-intent","Valid code, wrong intent",[12,43,44],{},"Any application security team will recognize these three findings:",[46,47,48,52,55],"ol",{},[49,50,51],"li",{},"An endpoint takes an order ID from the request and returns the order without checking who owns it.",[49,53,54],{},"A role field on a user profile accepts whatever JSON the client sends.",[49,56,57],{},"A user ID is a sequential integer.",[12,59,60],{},"Each one is valid code that slips past most taint and pattern rules in a conventional SAST engine, because no untrusted data reaches a dangerous sink, and no known-bad signature appears. Chained together, they hand an attacker every customer's order and an administrator role.",[12,62,63,64,69,70,75,76,81],{},"Across GitLab's customer base, codebase size has grown ",[16,65,68],{"href":66,"rel":67},"https://about.gitlab.com/gitlab-security-standard/",[],"as much as 500%"," as agents write code. CVE disclosures through April ran 46% above the February forecast from the ",[16,71,74],{"href":72,"rel":73},"https://www.first.org/newsroom/releases/20260615",[],"Forum of Incident Response and Security Teams",". The same AI models that generate code also make existing weaknesses less expensive to discover and chain. Authorization logic is where that pressure lands: Developers and agents write a check in a line or two, but when one is missing, the gap often goes unnoticed. As Omer Azaria, vice president of Product Management at GitLab, put it at ",[16,77,80],{"href":78,"rel":79},"https://about.gitlab.com/blog/transcend-india-announcements/",[],"GitLab Transcend",", \"We're caught in the middle: more code, faster attacks, same teams.\"",[83,84],"iframe",{"src":85,"frameBorder":86,"allow":87,"referrerPolicy":88,"style":89,"title":90},"https://player.vimeo.com/video/1233523012?title=0&byline=0&portrait=0&badge=0&autopause=0&player_id=0&app_id=58479","0","autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share","strict-origin-when-cross-origin","position:absolute;top:0;left:0;width:100%;height:100%;","Transcend 3 Omer Azaria and Rajat Pandit_100626",[92,93],"script",{"src":94},"https://player.vimeo.com/api/player.js",[38,96,98],{"id":97},"why-whole-repository-scanning-starts-here","Why whole-repository scanning starts here",[12,100,101,106],{},[16,102,105],{"href":103,"rel":104},"https://about.gitlab.com/blog/gitlab-duo-security-review-flow/",[],"GitLab Duo Security Review"," looks for authorization flaws in merge requests, but many business logic flaws aren't visible in a diff. Whether an endpoint should check ownership depends on the data model, the roles the application defines, and how other endpoints treat the same records. Judging one handler means reading the application around it.",[12,108,109],{},"That is why Business Logic Security Analyzer scans the whole repository, and why GitLab is the platform to do it on. The source code, the pipelines that build it, the security findings attached to it, and the policies that gate it all live in one system. An agent that scans here sees the full application and writes its findings where the security team already works.",[12,111,112,113,117],{},"At Transcend, we introduced the ",[16,114,116],{"href":66,"rel":115},[],"GitLab Security Standard",": five stages each agent must clear to earn more autonomy, built on the premise that code is now abundant and trust is scarce. Its Verify stage requires every change, whether written by a person or agent, to pass controls the author cannot touch. Business Logic Security Analyzer runs outside the author's hands, and its findings persist in the same report and dashboards that govern the rest of the codebase.",[38,119,121],{"id":120},"how-the-analyzer-works","How the analyzer works",[12,123,124],{},"Business Logic Security Analyzer is a foundational flow on GitLab Duo Agent Platform that targets business logic flaws, starting with broken object-level authorization, missing or improper authorization, and mass assignment. A practitioner can run a whole-repository scan, and scan each merge request automatically after its pipeline passes.",[12,126,127,128,133],{},"Detecting any of these flaws requires a model of what the application is meant to do. Pattern scanners have none, but an agent that reads the repository can build one. The analyzer starts by enumerating the application’s entry points and mapping who should be allowed to do what: which records belong to which user, and which actions are administrative. It then reads each handler in scope and checks whether the handler enforces that rule before touching the record. Findings land in the ",[16,129,132],{"href":130,"rel":131},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"Vulnerability Report"," and the merge request security widget as first-class SAST results, to support triage, remediation, and auditing.",[12,135,136,137,141,142,145,146,149,150,153],{},"In the demo application below, ",[138,139,140],"code",{},"refund_order"," accepts an ",[138,143,144],{},"order_id"," from the request and sets ",[138,147,148],{},"refunded=1"," without checking that the caller owns the order or is an administrator. Taint rules stay silent because the query is parameterized. The analyzer reports it as CWE-639, Critical, at ",[138,151,152],{},"app/orders.py:17",", and its explanation names the missing ownership check.",[12,155,156],{},[157,158],"img",{"alt":159,"src":160},"Screenshot of findings from a Business Logic Security Analyzer scan of a demo application, shown in the GitLab Vulnerability Report.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1792521341/w2sdpy8hv2ucqxfejmn6.png",[38,162,164],{"id":163},"the-models-behind-the-analyzer","The models behind the analyzer",[12,166,167],{},"Business Logic Security Analyzer is the first GitLab capability supporting Anthropic's Claude Mythos 5.1, and is available in early access to customers in approved environments. The model sees only GitLab's prompts and the customer's repository, which holds the context the analyzer needs: the data model, roles, and rules each endpoint enforces. As Rajat Pandit, Head of Applied AI, Anthropic India, said at Transcend, \"When defenders have more context than attackers, advanced models change the math in their favor.\"",[12,169,170,171,176],{},"Alongside Mythos, the analyzer supports Anthropic’s Claude Opus 5.5, Sonnet 5.5, Sonnet 5, and Sonnet 4.6, with more models planned for future releases. All of them run as GitLab-managed models through GitLab’s AI gateway, under the ",[16,172,175],{"href":173,"rel":174},"https://docs.gitlab.com/user/gitlab_duo/data_usage/",[],"same data handling terms"," as the rest of GitLab Duo Agent Platform.",[38,178,180],{"id":179},"request-early-access","Request early access",[12,182,183],{},"Business Logic Security Analyzer is in early access for a small group of GitLab Ultimate customers on GitLab.com. Participants run the analyzer on their codebases to find true positives their security teams didn’t already know about. We will work with each team to learn where the analyzer is correct, wrong, or silent. Each scan consumes GitLab Credits, and cost scales with the size of the application's attack surface.",[12,185,186,187,192,193,197],{},"To be considered, contact your account team, or, if you are not yet a GitLab customer, contact our ",[16,188,191],{"href":189,"rel":190},"https://about.gitlab.com/sales/",[],"sales team",". Once your group is enabled, start a whole-repository scan from GitLab Duo Chat or through the API, and attach the Business Logic scan profile to a project to scan its merge requests. The ",[16,194,196],{"href":33,"rel":195},[],"Business Logic Security Analyzer documentation"," covers prerequisites and setup.",{"title":199,"searchDepth":200,"depth":200,"links":201},"",2,[202,203,204,205,206],{"id":40,"depth":200,"text":41},{"id":97,"depth":200,"text":98},{"id":120,"depth":200,"text":121},{"id":163,"depth":200,"text":164},{"id":179,"depth":200,"text":180},"security","2026-10-20","Now in early access, Business Logic Security Analyzer reads your repository, infers what each endpoint should enforce, and flags the gaps.","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png",{},"/en-us/blog/gitlab-business-logic-security-analyzer",{"config":217,"title":5,"description":209},{"noIndex":218},false,"gitlab-business-logic-security-analyzer","en-us/blog/gitlab-business-logic-security-analyzer",[222,223,224],"AI","features","product","BlogPost","3nbrwuzcnmV3B0d4l1fF_35clk1BqhroNKaAHwPhjNI",{"logo":228,"freeTrial":233,"sales":238,"login":243,"items":248,"search":578,"minimal":609,"duo":628,"switchNav":637,"pricingDeployment":648},{"config":229},{"href":230,"dataGaName":231,"dataGaLocation":232},"/","gitlab logo","header",{"text":234,"config":235},"Get free trial",{"href":236,"dataGaName":237,"dataGaLocation":232},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":239,"config":240},"Request a demo",{"href":241,"dataGaName":242,"dataGaLocation":232},"/request-a-demo/","sales",{"text":244,"config":245},"Sign in",{"href":246,"dataGaName":247,"dataGaLocation":232},"https://gitlab.com/users/sign_in/","sign in",[249,335,422,427,502,556],{"text":250,"left":212,"config":251,"menu":253},"Platform",{"dataNavLevelOne":252},"platform",{"type":254,"link":255,"columns":259,"feature":324},"lists",{"text":256,"config":257},"Explore the Platform",{"href":258,"dataGaName":252,"dataGaLocation":232},"/platform/",[260,283,306],{"title":261,"items":262},"Execution & Workflows",[263,268,273,278],{"text":264,"config":265},"CI/CD",{"href":266,"dataGaLocation":232,"dataGaName":267},"/solutions/continuous-integration/","ci/cd",{"text":269,"config":270},"Source Code Management",{"href":271,"dataGaLocation":232,"dataGaName":272},"/solutions/source-code-management/","source code management",{"text":274,"config":275},"Agile Delivery",{"href":276,"dataGaLocation":232,"dataGaName":277},"/solutions/agile-delivery/","agile delivery",{"text":279,"config":280},"Artifact Management",{"href":281,"dataGaLocation":232,"dataGaName":282},"/artifact-central/","artifact management",{"title":284,"items":285},"Security & Governance",[286,291,296,301],{"text":287,"config":288},"Application Security Testing",{"href":289,"dataGaLocation":232,"dataGaName":290},"/solutions/application-security-testing/","application security testing",{"text":292,"config":293},"Governance & Compliance",{"href":294,"dataGaLocation":232,"dataGaName":295},"/solutions/software-compliance/","governance and compliance",{"text":297,"config":298},"Secrets Management",{"href":299,"dataGaLocation":232,"dataGaName":300},"/gitlab-secrets-manager/","secrets management",{"text":302,"config":303},"Supply Chain Security",{"href":304,"dataGaLocation":232,"dataGaName":305},"/solutions/supply-chain/","supply chain security",{"title":307,"items":308},"Context & AI",[309,314,319],{"text":310,"config":311},"Agentic Orchestration",{"href":312,"dataGaLocation":232,"dataGaName":313},"/gitlab-duo-agent-platform/","agentic orchestration",{"text":315,"config":316},"Context Graph",{"href":317,"dataGaLocation":232,"dataGaName":318},"/gitlab-orbit/","context graph",{"text":320,"config":321},"Visibility & Measurement",{"href":322,"dataGaLocation":232,"dataGaName":323},"/solutions/visibility-measurement/","visibility and measurement",{"config":325,"title":328,"text":329,"link":330},{"background":326,"textColor":327},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","Why GitLab","One platform for speed with control across your software lifecycle.",{"text":331,"config":332},"Learn more",{"href":333,"dataGaName":334,"dataGaLocation":232},"/why-gitlab/","why gitlab",{"text":336,"left":212,"config":337,"menu":339},"Solutions",{"dataNavLevelOne":338},"solutions",{"type":254,"link":340,"columns":344,"feature":414},{"text":341,"config":342},"View all Solutions",{"href":343,"dataGaName":338,"dataGaLocation":232},"/solutions/",[345,363,381],{"title":346,"items":347},"Outcomes",[348,353,358],{"text":349,"config":350},"DevOps Modernization",{"href":351,"dataGaLocation":232,"dataGaName":352},"/assessments/devops-modernization-assessment/","devops modernization",{"text":354,"config":355},"Security Modernization",{"href":356,"dataGaLocation":232,"dataGaName":357},"/assessments/security-modernization-assessment/","security modernization",{"text":359,"config":360},"AI Modernization",{"href":361,"dataGaLocation":232,"dataGaName":362},"/assessments/ai-modernization-assessment/","ai modernization",{"title":364,"items":365},"By size",[366,371,376],{"text":367,"config":368},"Enterprise",{"href":369,"dataGaLocation":232,"dataGaName":370},"/enterprise/","enterprise",{"text":372,"config":373},"Small Business",{"href":374,"dataGaLocation":232,"dataGaName":375},"/small-business/","small business",{"text":377,"config":378},"Startups",{"href":379,"dataGaLocation":232,"dataGaName":380},"/solutions/startups/","startups",{"title":382,"items":383},"Industries",[384,389,394,399,404,409],{"text":385,"config":386},"Financial Services",{"href":387,"dataGaLocation":232,"dataGaName":388},"/solutions/finance/","financial services",{"text":390,"config":391},"Public Sector",{"href":392,"dataGaLocation":232,"dataGaName":393},"/solutions/public-sector/","public sector",{"text":395,"config":396},"Telecommunications",{"href":397,"dataGaLocation":232,"dataGaName":398},"/solutions/telecommunications/","telecommunications",{"text":400,"config":401},"Automotive",{"href":402,"dataGaLocation":232,"dataGaName":403},"/solutions/automotive/","automotive",{"text":405,"config":406},"Education",{"href":407,"dataGaLocation":232,"dataGaName":408},"/solutions/education/","education",{"text":410,"config":411},"Aerospace",{"href":412,"dataGaLocation":232,"dataGaName":413},"/solutions/aerospace/","aerospace",{"config":415,"title":116,"text":416,"link":417},{"background":326,"textColor":327},"Learn how to harden your software factory and let AI agents earn autonomy, without trading away security.",{"text":418,"config":419},"Explore the standard",{"href":420,"dataGaName":421,"dataGaLocation":232},"/gitlab-security-standard/","gitlab security standard",{"text":423,"config":424},"Pricing",{"href":425,"dataGaName":426,"dataGaLocation":232,"dataNavLevelOne":426},"/pricing/","pricing",{"text":428,"config":429,"menu":431},"Resources",{"dataNavLevelOne":430},"resources",{"type":254,"link":432,"columns":436,"feature":493},{"text":433,"config":434},"View all resources",{"href":435,"dataGaName":430,"dataGaLocation":232},"/resources/",[437,465],{"title":438,"items":439},"Discover",[440,445,450,455,460],{"text":441,"config":442},"Docs",{"href":443,"dataGaName":444,"dataGaLocation":232},"https://docs.gitlab.com/","docs",{"text":446,"config":447},"University",{"href":448,"dataGaName":449,"dataGaLocation":232},"https://university.gitlab.com/","university",{"text":451,"config":452},"Demo Series",{"href":453,"dataGaName":454,"dataGaLocation":232},"/gitlab-technical-demo-series/","demo series",{"text":456,"config":457},"Demo Hub",{"href":458,"dataGaName":459,"dataGaLocation":232},"/demo-hub/","demo hub",{"text":461,"config":462},"Services",{"href":463,"dataGaName":464,"dataGaLocation":232},"/services/","services",{"title":466,"items":467},"Connect",[468,473,478,483,488],{"text":469,"config":470},"Blog",{"href":471,"dataGaName":472,"dataGaLocation":232},"/blog/","blog",{"text":474,"config":475},"Community",{"href":476,"dataGaName":477,"dataGaLocation":232},"/community/","community",{"text":479,"config":480},"Customers",{"href":481,"dataGaName":482,"dataGaLocation":232},"/customers/","customers",{"text":484,"config":485},"Partners",{"href":486,"dataGaName":487,"dataGaLocation":232},"/partners/","partners",{"text":489,"config":490},"Events",{"href":491,"dataGaName":492,"dataGaLocation":232},"/events/","events",{"config":494,"title":495,"text":496,"link":497},{"background":326,"textColor":327},"What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":498,"config":499},"Read the latest",{"href":500,"dataGaName":501,"dataGaLocation":232},"/whats-new/","whats new",{"text":503,"config":504,"menu":506},"Company",{"dataNavLevelOne":505},"company",{"type":254,"columns":507},[508],{"items":509},[510,515,521,526,531,536,541,546,551],{"text":511,"config":512},"About",{"href":513,"dataGaName":514,"dataGaLocation":232},"/company/","about",{"text":516,"config":517,"footerGa":520},"Jobs",{"href":518,"dataGaName":519,"dataGaLocation":232},"/jobs/","jobs",{"dataGaName":519},{"text":522,"config":523},"Press",{"href":524,"dataGaName":525,"dataGaLocation":232},"/press/","press",{"text":527,"config":528},"Handbook",{"href":529,"dataGaName":530,"dataGaLocation":232},"https://handbook.gitlab.com/","handbook",{"text":532,"config":533},"Leadership",{"href":534,"dataGaName":535,"dataGaLocation":232},"/company/team/e-group/","leadership",{"text":537,"config":538},"Investor relations",{"href":539,"dataGaName":540,"dataGaLocation":232},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":542,"config":543},"Trust Center",{"href":544,"dataGaName":545,"dataGaLocation":232},"/security/","trust center",{"text":547,"config":548},"AI Transparency Center",{"href":549,"dataGaName":550,"dataGaLocation":232},"/ai-transparency-center/","ai transparency center",{"text":552,"config":553},"Newsletter",{"href":554,"dataGaName":555,"dataGaLocation":232},"/company/contact/#contact-forms","newsletter",{"text":557,"config":558,"menu":559},"Contact us",{"dataNavLevelOne":505},{"type":254,"columns":560},[561],{"items":562},[563,568,573],{"text":564,"config":565},"Talk to sales",{"href":566,"dataGaName":567,"dataGaLocation":232},"/sales/","talk to sales",{"text":569,"config":570},"Support portal",{"href":571,"dataGaName":572,"dataGaLocation":232},"https://support.gitlab.com/hc/en-us","support portal",{"text":574,"config":575},"Customer portal",{"href":576,"dataGaName":577,"dataGaLocation":232},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":579,"login":580,"suggestions":587},"Close",{"text":581,"link":582},"To search repositories and projects, login to",{"text":583,"config":584},"gitlab.com",{"href":246,"dataGaName":585,"dataGaLocation":586},"search login","search",{"text":588,"default":589},"Suggestions",[590,593,596,598,602,606],{"text":591,"config":592},"GitLab Duo Agent Platform",{"href":312,"dataGaName":591,"dataGaLocation":586},{"text":594,"config":595},"Code Suggestions (AI)",{"href":312,"dataGaName":594,"dataGaLocation":586},{"text":264,"config":597},{"href":266,"dataGaName":264,"dataGaLocation":586},{"text":599,"config":600},"GitLab on AWS",{"href":601,"dataGaName":599,"dataGaLocation":586},"/partners/technology-partners/aws/",{"text":603,"config":604},"GitLab on Google Cloud",{"href":605,"dataGaName":603,"dataGaLocation":586},"/partners/technology-partners/google-cloud-platform/",{"text":607,"config":608},"Why GitLab?",{"href":333,"dataGaName":607,"dataGaLocation":586},{"freeTrial":610,"mobileIcon":615,"desktopIcon":620,"secondaryButton":623},{"text":611,"config":612},"Start free trial",{"href":613,"dataGaName":237,"dataGaLocation":614},"https://gitlab.com/-/trials/new/","nav",{"altText":616,"config":617},"Gitlab Icon",{"src":618,"dataGaName":619,"dataGaLocation":614},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":616,"config":621},{"src":622,"dataGaName":619,"dataGaLocation":614},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":624,"config":625},"Get Started",{"href":626,"dataGaName":627,"dataGaLocation":614},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":629,"mobileIcon":633,"desktopIcon":635},{"text":630,"config":631},"Learn more about GitLab Duo",{"href":312,"dataGaName":632,"dataGaLocation":614},"gitlab duo",{"altText":616,"config":634},{"src":618,"dataGaName":619,"dataGaLocation":614},{"altText":616,"config":636},{"src":622,"dataGaName":619,"dataGaLocation":614},{"button":638,"mobileIcon":643,"desktopIcon":645},{"text":639,"config":640},"/switch",{"href":641,"dataGaName":642,"dataGaLocation":614},"#contact","switch",{"altText":616,"config":644},{"src":618,"dataGaName":619,"dataGaLocation":614},{"altText":616,"config":646},{"src":647,"dataGaName":619,"dataGaLocation":614},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":649,"mobileIcon":654,"desktopIcon":656},{"text":650,"config":651},"Back to pricing",{"href":425,"dataGaName":652,"dataGaLocation":614,"icon":653},"back to pricing","GoBack",{"altText":616,"config":655},{"src":618,"dataGaName":619,"dataGaLocation":614},{"altText":616,"config":657},{"src":622,"dataGaName":619,"dataGaLocation":614},{"title":659,"button":660,"config":666},"Ship at agent speed. Prove every step. Transcend is here.",{"text":661,"config":662},"Watch now",{"href":663,"dataGaName":664,"dataGaLocation":665},"/events/transcend/virtual/#watch-gitlab-transcend","transcend-october-2026-banner","global-banner",{"layout":667,"disabled":218},"release",{"data":669},{"text":670,"source":671,"edit":677,"contribute":682,"config":687,"items":692,"minimal":918},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":672,"config":673},"View page source",{"href":674,"dataGaName":675,"dataGaLocation":676},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":678,"config":679},"Edit this page",{"href":680,"dataGaName":681,"dataGaLocation":676},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":683,"config":684},"Please contribute",{"href":685,"dataGaName":686,"dataGaLocation":676},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":688,"facebook":689,"youtube":690,"linkedin":691},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[693,740,798,845,886],{"title":423,"links":694,"subMenu":709},[695,699,704],{"text":696,"config":697},"View plans",{"href":425,"dataGaName":698,"dataGaLocation":676},"view plans",{"text":700,"config":701},"Why Premium?",{"href":702,"dataGaName":703,"dataGaLocation":676},"/pricing/premium/","why premium",{"text":705,"config":706},"Why Ultimate?",{"href":707,"dataGaName":708,"dataGaLocation":676},"/pricing/ultimate/","why ultimate",[710],{"title":711,"links":712},"Contact Us",[713,716,718,720,725,730,735],{"text":714,"config":715},"Contact sales",{"href":566,"dataGaName":242,"dataGaLocation":676},{"text":569,"config":717},{"href":571,"dataGaName":572,"dataGaLocation":676},{"text":574,"config":719},{"href":576,"dataGaName":577,"dataGaLocation":676},{"text":721,"config":722},"Status",{"href":723,"dataGaName":724,"dataGaLocation":676},"https://status.gitlab.com/","status",{"text":726,"config":727},"Terms of use",{"href":728,"dataGaName":729,"dataGaLocation":676},"/terms/","terms of use",{"text":731,"config":732},"Privacy statement",{"href":733,"dataGaName":734,"dataGaLocation":676},"/privacy/","privacy statement",{"text":736,"config":737},"Cookie preferences",{"dataGaName":738,"dataGaLocation":676,"id":739,"isOneTrustButton":212},"cookie preferences","ot-sdk-btn",{"title":250,"links":741,"subMenu":755},[742,745,747,749,751,753],{"text":743,"config":744},"Explore the platform",{"href":258,"dataGaName":252,"dataGaLocation":676},{"text":310,"config":746},{"href":312,"dataGaName":313,"dataGaLocation":676},{"text":264,"config":748},{"href":266,"dataGaName":267,"dataGaLocation":676},{"text":315,"config":750},{"href":317,"dataGaName":318,"dataGaLocation":676},{"text":297,"config":752},{"href":299,"dataGaName":300,"dataGaLocation":676},{"text":328,"config":754},{"href":333,"dataGaName":334,"dataGaLocation":676},[756],{"title":757,"links":758},"Topics",[759,763,768,773,778,783,788,793],{"text":264,"config":760},{"href":761,"dataGaName":762,"dataGaLocation":676},"/topics/ci-cd/","cicd",{"text":764,"config":765},"GitOps",{"href":766,"dataGaName":767,"dataGaLocation":676},"/topics/gitops/","gitops",{"text":769,"config":770},"DevOps",{"href":771,"dataGaName":772,"dataGaLocation":676},"/topics/devops/","devops",{"text":774,"config":775},"Version Control",{"href":776,"dataGaName":777,"dataGaLocation":676},"/topics/version-control/","version control",{"text":779,"config":780},"DevSecOps",{"href":781,"dataGaName":782,"dataGaLocation":676},"/topics/devsecops/","devsecops",{"text":784,"config":785},"Cloud Native",{"href":786,"dataGaName":787,"dataGaLocation":676},"/topics/cloud-native/","cloud native",{"text":789,"config":790},"AI for Coding",{"href":791,"dataGaName":792,"dataGaLocation":676},"/topics/devops/ai-for-coding/","ai for coding",{"text":794,"config":795},"Agentic AI",{"href":796,"dataGaName":797,"dataGaLocation":676},"/topics/agentic-ai/","agentic ai",{"title":336,"links":799},[800,803,806,809,812,815,817,819,821,823,825,828,830,833,837,841],{"text":801,"config":802},"DevOps modernization",{"href":351,"dataGaName":352,"dataGaLocation":676},{"text":804,"config":805},"Security modernization",{"href":356,"dataGaName":357,"dataGaLocation":676},{"text":807,"config":808},"AI modernization",{"href":361,"dataGaName":362,"dataGaLocation":676},{"text":810,"config":811},"Financial services",{"href":387,"dataGaName":388,"dataGaLocation":676},{"text":813,"config":814},"Public sector",{"href":392,"dataGaName":393,"dataGaLocation":676},{"text":395,"config":816},{"href":397,"dataGaName":398,"dataGaLocation":676},{"text":400,"config":818},{"href":402,"dataGaName":403,"dataGaLocation":676},{"text":405,"config":820},{"href":407,"dataGaName":408,"dataGaLocation":676},{"text":410,"config":822},{"href":412,"dataGaName":413,"dataGaLocation":676},{"text":367,"config":824},{"href":369,"dataGaName":370,"dataGaLocation":676},{"text":826,"config":827},"Small business",{"href":374,"dataGaName":375,"dataGaLocation":676},{"text":377,"config":829},{"href":379,"dataGaName":380,"dataGaLocation":676},{"text":764,"config":831},{"href":832,"dataGaName":767,"dataGaLocation":676},"/solutions/gitops/",{"text":834,"config":835},"Software composition analysis",{"href":304,"dataGaName":836,"dataGaLocation":676},"software composition analysis",{"text":838,"config":839},"Value stream management",{"href":322,"dataGaName":840,"dataGaLocation":676},"value stream management",{"text":842,"config":843},"All solutions",{"href":343,"dataGaName":844,"dataGaLocation":676},"all solutions",{"title":428,"links":846},[847,852,857,859,861,863,865,867,869,871,873,875,877,879,882],{"text":848,"config":849},"Install",{"href":850,"dataGaName":851,"dataGaLocation":676},"/install/","install",{"text":853,"config":854},"Quick start guides",{"href":855,"dataGaName":856,"dataGaLocation":676},"/get-started/","quick setup checklists",{"text":441,"config":858},{"href":443,"dataGaName":444,"dataGaLocation":676},{"text":446,"config":860},{"href":448,"dataGaName":449,"dataGaLocation":676},{"text":451,"config":862},{"href":453,"dataGaName":454,"dataGaLocation":676},{"text":456,"config":864},{"href":458,"dataGaName":459,"dataGaLocation":676},{"text":461,"config":866},{"href":463,"dataGaName":464,"dataGaLocation":676},{"text":469,"config":868},{"href":471,"dataGaName":472,"dataGaLocation":676},{"text":474,"config":870},{"href":476,"dataGaName":477,"dataGaLocation":676},{"text":479,"config":872},{"href":481,"dataGaName":482,"dataGaLocation":676},{"text":484,"config":874},{"href":486,"dataGaName":487,"dataGaLocation":676},{"text":489,"config":876},{"href":491,"dataGaName":492,"dataGaLocation":676},{"text":552,"config":878},{"href":554,"dataGaName":555,"dataGaLocation":676},{"text":880,"config":881},"What's new",{"href":500,"dataGaName":501,"dataGaLocation":676},{"text":883,"config":884},"All resources",{"href":435,"dataGaName":885,"dataGaLocation":676},"all resources",{"title":503,"links":887},[888,890,892,894,896,898,900,902,904,908,913],{"text":511,"config":889},{"href":513,"dataGaName":505,"dataGaLocation":676},{"text":516,"config":891},{"href":518,"dataGaName":519,"dataGaLocation":676},{"text":522,"config":893},{"href":524,"dataGaName":525,"dataGaLocation":676},{"text":527,"config":895},{"href":529,"dataGaName":530,"dataGaLocation":676},{"text":532,"config":897},{"href":534,"dataGaName":535,"dataGaLocation":676},{"text":537,"config":899},{"href":539,"dataGaName":540,"dataGaLocation":676},{"text":542,"config":901},{"href":544,"dataGaName":545,"dataGaLocation":676},{"text":547,"config":903},{"href":549,"dataGaName":550,"dataGaLocation":676},{"text":905,"config":906},"Sustainability",{"href":907,"dataGaName":905,"dataGaLocation":676},"/sustainability/",{"text":909,"config":910},"Diversity, inclusion and belonging (DIB)",{"href":911,"dataGaName":912,"dataGaLocation":676},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":914,"config":915},"Modern Slavery Transparency Statement",{"href":916,"dataGaName":917,"dataGaLocation":676},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":919},[920,923,926],{"text":921,"config":922},"Terms",{"href":728,"dataGaName":729,"dataGaLocation":676},{"text":924,"config":925},"Cookies",{"dataGaName":738,"dataGaLocation":676,"id":739,"isOneTrustButton":212},{"text":927,"config":928},"Privacy",{"href":733,"dataGaName":734,"dataGaLocation":676},[930],{"id":931,"title":7,"body":211,"config":932,"content":934,"description":211,"extension":938,"meta":939,"navigation":212,"path":940,"seo":941,"stem":942,"__hash__":943},"blogAuthors/en-us/blog/authors/chris-widstrom.yml",{"template":933},"BlogAuthor",{"config":935,"name":7,"bio":937},{"headshot":936},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1789567036/sg1tlg9ctpwcmsbak2ij.jpg","Senior PM, SAST & SCA","yml",{},"/en-us/blog/authors/chris-widstrom",{},"en-us/blog/authors/chris-widstrom","aKDm1EPnJF7ZeX_kF88TW3So_WnmvuVjk7NgeZDNBfI",[945,952,960],{"title":946,"description":947,"heroImage":948,"category":207,"date":208,"authors":949,"slug":951,"externalUrl":211},"AI Governance: One view of agent activity","See AI agent activity in one place with the GitLab AI Governance Dashboard, across Duo Agent Platform and the externally connected agents your developers use.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773860699/gf9bdnis6ggrn4huvfrl.png",[950],"Alisa Ho","ai-governance-dashboard",{"title":953,"description":954,"heroImage":955,"category":207,"date":956,"authors":957,"slug":959,"externalUrl":211},"Building AI security in the open","GitLab has joined the Open Secure AI Alliance to help advance transparent, adaptable approaches to securing AI systems.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773866173/vte9qh8rriznvyclhkes.png","2026-10-19",[958],"Chaim Mazal","gitlab-joins-open-secure-ai-alliance",{"title":961,"description":962,"heroImage":963,"category":207,"date":964,"authors":965,"slug":967,"externalUrl":211},"GitLab Secrets Manager: Govern secrets like your code","Tighten credential security by scoping build-time secrets to the jobs that need them and serving runtime secrets from the same store. Generally available in GitLab 19.5.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1791993648/t2kod74bclspits5cc5o.png","2026-10-15",[966],"Mark Settle","secrets-manager-ga",{"header":969,"text":970,"button":974,"disclaimer":977},"Start your free\n\n30-day GitLab trial\n",[971,972,973],"GitLab Duo Agent Platform access","Try our most advanced features","Automate complex tasks with AI",{"text":234,"config":975},{"href":976,"dataGaName":237,"dataGaLocation":472},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/blog/","No credit card required.",{"header":979,"blurb":980,"button":981,"secondaryButton":986},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":982,"config":983},"Get your free trial",{"href":984,"dataGaName":237,"dataGaLocation":985},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":714,"config":987},{"href":566,"dataGaName":242,"dataGaLocation":985},1792559353364]