[{"data":1,"prerenderedAt":1001},["ShallowReactive",2],{"/blog/gitlab-duo-security-review-flow":3,"navigation-en-us":226,"banner-en-us":649,"footer-en-us":657,"blog-post-authors-en-us-Mark Settle":902,"blog-related-posts-en-us-gitlab-duo-security-review-flow":917,"blog-promotions-en-us":939,"next-steps-en-us":991},{"id":4,"title":5,"authors":6,"body":8,"category":206,"date":207,"description":208,"extension":209,"externalUrl":210,"featured":211,"heroImage":212,"meta":213,"navigation":214,"path":215,"seo":216,"slug":218,"stem":219,"tags":220,"template":224,"updatedDate":210,"__hash__":225},"blogPosts/en-us/blog/gitlab-duo-security-review-flow.md","GitLab Duo Security Review spots logic flaws scanners miss",[7],"Mark Settle",{"type":9,"value":10,"toc":198},"minimark",[11,15,18,23,26,40,46,52,55,59,62,65,70,79,83,87,95,98,101,135,147,150,154,157,166,186,189],[12,13,14],"p",{},"Static scanners excel at catching vulnerabilities that fit a known pattern, like unsanitized query inputs, hardcoded secrets, and unsafe deserialization. They struggle against flaws in your application’s logic, where there is no pattern to match — only valid code doing the wrong thing for your domain. Undetected, these flaws surface late and cost more to fix.",[12,16,17],{},"Security Review Flow, now in public beta, scrutinizes code changes the way a security engineer would. It traces intent rather than matching signatures to catch logic flaws before they hit production. It's a major step toward uncovering dangerous flaws that scanners usually miss.",[19,20,22],"h2",{"id":21},"where-pattern-based-scanners-go-blind","Where pattern-based scanners go blind",[12,24,25],{},"The most damaging application vulnerabilities often look correct line by line, but violate context the code doesn't contain, like your authorization model, data sensitivity rules, and intended workflows. Consider three of the most common vulnerability classes:",[12,27,28,32,33,39],{},[29,30,31],"strong",{},"Access and authorization:"," Whether a user may read or change a resource is defined by your authorization model, not any language construct. Broken object level authorization (accessing another user's data by changing an ID) has topped the ",[34,35,38],"a",{"href":36,"rel":37},"https://owasp.org/API-Security/editions/2023/en/0x11-t10/",[],"OWASP API Security Top 10"," since 2019.",[12,41,42,45],{},[29,43,44],{},"Data exposure:"," Serializing an object and returning it is ordinary, correct-looking code. Whether it leaks depends on which fields are sensitive and who receives them — facts about your domain, not your syntax.",[12,47,48,51],{},[29,49,50],{},"Control flow and workflow:"," Business-logic and race-condition flaws occur when valid operations run in the wrong order, repeat unexpectedly, or get manipulated. Examples include checkout reachable without payment, a state re-entered under a race, or a parameter tweaked to change a price.",[12,53,54],{},"Catching these flaws has previously required manual security review, which is expensive to scale across every merge request (MR), or penetration testing and bug bounties, which arrive too late. The result is a growing gap between the pace of development and how quickly security expertise can be applied.",[19,56,58],{"id":57},"bring-security-judgment-to-every-mr","Bring security judgment to every MR",[12,60,61],{},"Security Review Flow, a foundational flow on GitLab Duo Agent Platform, closes that gap by reasoning about what your code is meant to do. It detects exactly the classes of flaws described above: Broken object level authorization and function level authorization, missing authorization on state-changing operations, information disclosure, mass assignment, business logic errors, and race conditions in stateful workflows.",[12,63,64],{},"It complements traditional scanners and human analysis rather than replacing them, and it reviews code at the point of change, when a fix is cheapest. GitLab's own application security team has used Security Review Flow across internal MRs throughout its development.",[12,66,67],{},[29,68,69],{},"See Security Review Flow in action:",[71,72],"iframe",{"src":73,"frameBorder":74,"allow":75,"referrerPolicy":76,"style":77,"title":78},"https://player.vimeo.com/video/1209923383?badge=0&autopause=0&player_id=0&app_id=58479","0","autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share","strict-origin-when-cross-origin","position:absolute;top:0;left:0;width:100%;height:100%;","19.2 Security Review Flow",[80,81],"script",{"src":82},"https://player.vimeo.com/api/player.js",[19,84,86],{"id":85},"how-it-works","How it works",[12,88,89,90,94],{},"When your MR is ready, request a review from ",[91,92,93],"code",{},"Duo Security Review",", the same way you would from a person. It analyzes the diff in context: the original files, changed lines, MR discussion, and related code. Its reasoning is optimized for precision, and an independent validation pass examines each finding to filter out likely false positives.",[12,96,97],{},"Findings appear as diff threads on the relevant lines, along with a summary in an internal note. On public projects, they’re confined to the internal note, so security details aren’t exposed.",[12,99,100],{},"Each finding arrives with the context reviewers need:",[102,103,104,111,117,123,129],"ul",{},[105,106,107,110],"li",{},[29,108,109],{},"Vulnerability type",", with a CWE reference",[105,112,113,116],{},[29,114,115],{},"Severity",": critical, high, medium, or low",[105,118,119,122],{},[29,120,121],{},"Tier",": Tier 1 (Exploitable), Tier 2 (Logic Flaw), or Tier 3 (Design Issue)",[105,124,125,128],{},[29,126,127],{},"A plain-language explanation"," of the issue",[105,130,131,134],{},[29,132,133],{},"A suggested fix",", when one is available",[12,136,137,138,142,143,146],{},"Severity determines the reviewer state: A critical or high finding sets it to ",[139,140,141],"em",{},"Request changes",", while medium or low findings result in ",[139,144,145],{},"Comment",". The flow never approves, even when it finds nothing — a human always owns the final call.",[12,148,149],{},"From there, mention your organization’s Duo Security Review service account in a comment thread to ask a question, discuss remediation, or challenge a finding. Resolve each finding by applying the fix as a standard MR suggestion, dismissing it as a false positive, or accepting the risk. After committing your fixes, request a fresh review to check what changed.",[19,151,153],{"id":152},"run-your-first-security-review-flow","Run your first Security Review Flow",[12,155,156],{},"Security Review Flow is in public beta for GitLab Ultimate customers. It is available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated.",[12,158,159,160,165],{},"Learn how to get started in the ",[34,161,164],{"href":162,"rel":163},"https://docs.gitlab.com/ee/user/duo_agent_platform/flows/foundational_flows/security_review/",[],"Security Review Flow documentation",".",[12,167,168,169,174,175,180,181,165],{},"You can get access to Security Review Flow with a ",[34,170,173],{"href":171,"rel":172},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/gitlab-duo-agent-platform/",[],"free trial of GitLab Duo Agent Platform",". Already a GitLab Ultimate subscriber? ",[34,176,179],{"href":177,"rel":178},"https://docs.gitlab.com/user/duo_agent_platform/turn_on_off/",[],"Turn on Duo Agent Platform"," and use the ",[34,182,185],{"href":183,"rel":184},"https://docs.gitlab.com/subscriptions/gitlab_credits/#included-credits",[],"GitLab Credits included with your subscription",[12,187,188],{},"Cost varies with the complexity of the diff and the model you select, so try it on a few MRs before running it broadly. Pricing may be updated at general availability.",[12,190,191,192,197],{},"Share what you find in our ",[34,193,196],{"href":194,"rel":195},"https://gitlab.com/gitlab-org/gitlab/-/work_items/600304",[],"feature feedback issue",", so your input shapes what we build.",{"title":199,"searchDepth":200,"depth":200,"links":201},"",2,[202,203,204,205],{"id":21,"depth":200,"text":22},{"id":57,"depth":200,"text":58},{"id":85,"depth":200,"text":86},{"id":152,"depth":200,"text":153},"security","2026-07-16","Use AI-driven security reasoning to detect authorization gaps, business-logic errors, and race conditions while code is still under review.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1783980535/t3gez0gpayfndrhncunf.png",{},true,"/en-us/blog/gitlab-duo-security-review-flow",{"config":217,"title":5,"description":208},{"noIndex":211},"gitlab-duo-security-review-flow","en-us/blog/gitlab-duo-security-review-flow",[206,221,222,223],"AI","features","product","BlogPost","kEujJCOWxAhXSG5gVYPgQbTbxccmpnVtU5Z5l4U-ttU",{"logo":227,"freeTrial":232,"sales":237,"login":242,"items":247,"search":569,"minimal":600,"duo":619,"switchNav":628,"pricingDeployment":639},{"config":228},{"href":229,"dataGaName":230,"dataGaLocation":231},"/","gitlab logo","header",{"text":233,"config":234},"Get free trial",{"href":235,"dataGaName":236,"dataGaLocation":231},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":238,"config":239},"Request a demo",{"href":240,"dataGaName":241,"dataGaLocation":231},"/sales/?contact-topic=request-demo","sales",{"text":243,"config":244},"Sign in",{"href":245,"dataGaName":246,"dataGaLocation":231},"https://gitlab.com/users/sign_in/","sign in",[248,277,377,382,491,547],{"text":249,"config":250,"menu":252},"Platform",{"dataNavLevelOne":251},"platform",{"type":253,"columns":254},"cards",[255,261,269],{"title":249,"description":256,"link":257},"The intelligent orchestration platform for DevSecOps",{"text":258,"config":259},"Explore our Platform",{"href":260,"dataGaName":251,"dataGaLocation":231},"/platform/",{"title":262,"description":263,"link":264},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":265,"config":266},"Meet GitLab Duo",{"href":267,"dataGaName":268,"dataGaLocation":231},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":270,"description":271,"link":272},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":273,"config":274},"Learn more",{"href":275,"dataGaName":276,"dataGaLocation":231},"/why-gitlab/","why gitlab",{"text":278,"left":214,"config":279,"menu":281},"Product",{"dataNavLevelOne":280},"solutions",{"type":282,"link":283,"columns":287,"feature":356},"lists",{"text":284,"config":285},"View all Solutions",{"href":286,"dataGaName":280,"dataGaLocation":231},"/solutions/",[288,312,335],{"title":289,"description":290,"link":291,"items":296},"Automation","CI/CD and automation to accelerate deployment",{"config":292},{"icon":293,"href":294,"dataGaName":295,"dataGaLocation":231},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[297,301,304,308],{"text":298,"config":299},"CI/CD",{"href":300,"dataGaLocation":231,"dataGaName":298},"/solutions/continuous-integration/",{"text":262,"config":302},{"href":267,"dataGaLocation":231,"dataGaName":303},"gitlab duo agent platform - product menu",{"text":305,"config":306},"Source Code Management",{"href":307,"dataGaLocation":231,"dataGaName":305},"/solutions/source-code-management/",{"text":309,"config":310},"Automated Software Delivery",{"href":294,"dataGaLocation":231,"dataGaName":311},"Automated software delivery",{"title":313,"description":314,"link":315,"items":320},"Security","Deliver code faster without compromising security",{"config":316},{"href":317,"dataGaName":318,"dataGaLocation":231,"icon":319},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[321,325,330],{"text":322,"config":323},"Application Security Testing",{"href":317,"dataGaName":324,"dataGaLocation":231},"Application security testing",{"text":326,"config":327},"Software Supply Chain Security",{"href":328,"dataGaLocation":231,"dataGaName":329},"/solutions/supply-chain/","Software supply chain security",{"text":331,"config":332},"Software Compliance",{"href":333,"dataGaName":334,"dataGaLocation":231},"/solutions/software-compliance/","software compliance",{"title":336,"link":337,"items":342},"Measurement",{"config":338},{"icon":339,"href":340,"dataGaName":341,"dataGaLocation":231},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[343,347,351],{"text":344,"config":345},"Visibility & Measurement",{"href":340,"dataGaLocation":231,"dataGaName":346},"Visibility and Measurement",{"text":348,"config":349},"Value Stream Management",{"href":350,"dataGaLocation":231,"dataGaName":348},"/solutions/value-stream-management/",{"text":352,"config":353},"Analytics & Insights",{"href":354,"dataGaLocation":231,"dataGaName":355},"/solutions/analytics-and-insights/","Analytics and insights",{"title":357,"type":282,"items":358},"GitLab for",[359,365,371],{"text":360,"config":361},"Enterprise",{"icon":362,"href":363,"dataGaLocation":231,"dataGaName":364},"Building","/enterprise/","enterprise",{"text":366,"config":367},"Small Business",{"icon":368,"href":369,"dataGaLocation":231,"dataGaName":370},"Work","/small-business/","small business",{"text":372,"config":373},"Public Sector",{"icon":374,"href":375,"dataGaLocation":231,"dataGaName":376},"Organization","/solutions/public-sector/","public sector",{"text":378,"config":379},"Pricing",{"href":380,"dataGaName":381,"dataGaLocation":231,"dataNavLevelOne":381},"/pricing/","pricing",{"text":383,"config":384,"menu":386},"Resources",{"dataNavLevelOne":385},"resources",{"type":282,"link":387,"columns":391,"feature":480},{"text":388,"config":389},"View all resources",{"href":390,"dataGaName":385,"dataGaLocation":231},"/resources/",[392,425,447],{"title":393,"items":394},"Getting started",[395,400,405,410,415,420],{"text":396,"config":397},"Install",{"href":398,"dataGaName":399,"dataGaLocation":231},"/install/","install",{"text":401,"config":402},"Quick start guides",{"href":403,"dataGaName":404,"dataGaLocation":231},"/get-started/","quick setup checklists",{"text":406,"config":407},"Learn",{"href":408,"dataGaLocation":231,"dataGaName":409},"https://university.gitlab.com/","learn",{"text":411,"config":412},"Product documentation",{"href":413,"dataGaName":414,"dataGaLocation":231},"https://docs.gitlab.com/","product documentation",{"text":416,"config":417},"Best practice videos",{"href":418,"dataGaName":419,"dataGaLocation":231},"/getting-started-videos/","best practice videos",{"text":421,"config":422},"Integrations",{"href":423,"dataGaName":424,"dataGaLocation":231},"/integrations/","integrations",{"title":426,"items":427},"Discover",[428,433,438,442],{"text":429,"config":430},"Customer success stories",{"href":431,"dataGaName":432,"dataGaLocation":231},"/customers/","customer success stories",{"text":434,"config":435},"Blog",{"href":436,"dataGaName":437,"dataGaLocation":231},"/blog/","blog",{"text":439,"config":440},"The Source",{"href":441,"dataGaName":437,"dataGaLocation":231},"/the-source/",{"text":443,"config":444},"Remote",{"href":445,"dataGaName":446,"dataGaLocation":231},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":448,"items":449},"Connect",[450,455,460,465,470,475],{"text":451,"config":452},"GitLab Services",{"href":453,"dataGaName":454,"dataGaLocation":231},"/services/","services",{"text":456,"config":457},"Contribute",{"href":458,"dataGaName":459,"dataGaLocation":231},"https://contributors.gitlab.com","contribute",{"text":461,"config":462},"Community",{"href":463,"dataGaName":464,"dataGaLocation":231},"/community/","community",{"text":466,"config":467},"Forum",{"href":468,"dataGaName":469,"dataGaLocation":231},"https://forum.gitlab.com/","forum",{"text":471,"config":472},"Events",{"href":473,"dataGaName":474,"dataGaLocation":231},"/events/","events",{"text":476,"config":477},"Partners",{"href":478,"dataGaName":479,"dataGaLocation":231},"/partners/","partners",{"config":481,"title":484,"text":485,"link":486},{"background":482,"textColor":483},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":487,"config":488},"Read the latest",{"href":489,"dataGaName":490,"dataGaLocation":231},"/whats-new/","whats new",{"text":492,"config":493,"menu":495},"Company",{"dataNavLevelOne":494},"company",{"type":282,"columns":496},[497],{"items":498},[499,504,510,512,517,522,527,532,537,542],{"text":500,"config":501},"About",{"href":502,"dataGaName":503,"dataGaLocation":231},"/company/","about",{"text":505,"config":506,"footerGa":509},"Jobs",{"href":507,"dataGaName":508,"dataGaLocation":231},"/jobs/","jobs",{"dataGaName":508},{"text":471,"config":511},{"href":473,"dataGaName":474,"dataGaLocation":231},{"text":513,"config":514},"Leadership",{"href":515,"dataGaName":516,"dataGaLocation":231},"/company/team/e-group/","leadership",{"text":518,"config":519},"Handbook",{"href":520,"dataGaName":521,"dataGaLocation":231},"https://handbook.gitlab.com/","handbook",{"text":523,"config":524},"Investor relations",{"href":525,"dataGaName":526,"dataGaLocation":231},"https://ir.gitlab.com/","investor relations",{"text":528,"config":529},"Trust Center",{"href":530,"dataGaName":531,"dataGaLocation":231},"/security/","trust center",{"text":533,"config":534},"AI Transparency Center",{"href":535,"dataGaName":536,"dataGaLocation":231},"/ai-transparency-center/","ai transparency center",{"text":538,"config":539},"Newsletter",{"href":540,"dataGaName":541,"dataGaLocation":231},"/company/contact/#contact-forms","newsletter",{"text":543,"config":544},"Press",{"href":545,"dataGaName":546,"dataGaLocation":231},"/press/","press",{"text":548,"config":549,"menu":550},"Contact us",{"dataNavLevelOne":494},{"type":282,"columns":551},[552],{"items":553},[554,559,564],{"text":555,"config":556},"Talk to sales",{"href":557,"dataGaName":558,"dataGaLocation":231},"/sales/","talk to sales",{"text":560,"config":561},"Support portal",{"href":562,"dataGaName":563,"dataGaLocation":231},"https://support.gitlab.com","support portal",{"text":565,"config":566},"Customer portal",{"href":567,"dataGaName":568,"dataGaLocation":231},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":570,"login":571,"suggestions":578},"Close",{"text":572,"link":573},"To search repositories and projects, login to",{"text":574,"config":575},"gitlab.com",{"href":245,"dataGaName":576,"dataGaLocation":577},"search login","search",{"text":579,"default":580},"Suggestions",[581,583,587,589,593,597],{"text":262,"config":582},{"href":267,"dataGaName":262,"dataGaLocation":577},{"text":584,"config":585},"Code Suggestions (AI)",{"href":586,"dataGaName":584,"dataGaLocation":577},"/solutions/code-suggestions/",{"text":298,"config":588},{"href":300,"dataGaName":298,"dataGaLocation":577},{"text":590,"config":591},"GitLab on AWS",{"href":592,"dataGaName":590,"dataGaLocation":577},"/partners/technology-partners/aws/",{"text":594,"config":595},"GitLab on Google Cloud",{"href":596,"dataGaName":594,"dataGaLocation":577},"/partners/technology-partners/google-cloud-platform/",{"text":598,"config":599},"Why GitLab?",{"href":275,"dataGaName":598,"dataGaLocation":577},{"freeTrial":601,"mobileIcon":606,"desktopIcon":611,"secondaryButton":614},{"text":602,"config":603},"Start free trial",{"href":604,"dataGaName":236,"dataGaLocation":605},"https://gitlab.com/-/trials/new/","nav",{"altText":607,"config":608},"Gitlab Icon",{"src":609,"dataGaName":610,"dataGaLocation":605},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":607,"config":612},{"src":613,"dataGaName":610,"dataGaLocation":605},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":615,"config":616},"Get Started",{"href":617,"dataGaName":618,"dataGaLocation":605},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":620,"mobileIcon":624,"desktopIcon":626},{"text":621,"config":622},"Learn more about GitLab Duo",{"href":267,"dataGaName":623,"dataGaLocation":605},"gitlab duo",{"altText":607,"config":625},{"src":609,"dataGaName":610,"dataGaLocation":605},{"altText":607,"config":627},{"src":613,"dataGaName":610,"dataGaLocation":605},{"button":629,"mobileIcon":634,"desktopIcon":636},{"text":630,"config":631},"/switch",{"href":632,"dataGaName":633,"dataGaLocation":605},"#contact","switch",{"altText":607,"config":635},{"src":609,"dataGaName":610,"dataGaLocation":605},{"altText":607,"config":637},{"src":638,"dataGaName":610,"dataGaLocation":605},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":640,"mobileIcon":645,"desktopIcon":647},{"text":641,"config":642},"Back to pricing",{"href":380,"dataGaName":643,"dataGaLocation":605,"icon":644},"back to pricing","GoBack",{"altText":607,"config":646},{"src":609,"dataGaName":610,"dataGaLocation":605},{"altText":607,"config":648},{"src":613,"dataGaName":610,"dataGaLocation":605},{"title":650,"button":651,"config":655},"GitLab Orbit is here: The context layer for AI agents.",{"text":273,"config":652},{"href":653,"dataGaName":654,"dataGaLocation":231},"/gitlab-orbit/","orbit",{"layout":656,"disabled":211},"release",{"data":658},{"text":659,"source":660,"edit":666,"contribute":671,"config":676,"items":681,"minimal":891},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":661,"config":662},"View page source",{"href":663,"dataGaName":664,"dataGaLocation":665},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":667,"config":668},"Edit this page",{"href":669,"dataGaName":670,"dataGaLocation":665},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":672,"config":673},"Please contribute",{"href":674,"dataGaName":675,"dataGaLocation":665},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":677,"facebook":678,"youtube":679,"linkedin":680},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[682,729,783,827,859],{"title":378,"links":683,"subMenu":698},[684,688,693],{"text":685,"config":686},"View plans",{"href":380,"dataGaName":687,"dataGaLocation":665},"view plans",{"text":689,"config":690},"Why Premium?",{"href":691,"dataGaName":692,"dataGaLocation":665},"/pricing/premium/","why premium",{"text":694,"config":695},"Why Ultimate?",{"href":696,"dataGaName":697,"dataGaLocation":665},"/pricing/ultimate/","why ultimate",[699],{"title":700,"links":701},"Contact Us",[702,705,707,709,714,719,724],{"text":703,"config":704},"Contact sales",{"href":557,"dataGaName":241,"dataGaLocation":665},{"text":560,"config":706},{"href":562,"dataGaName":563,"dataGaLocation":665},{"text":565,"config":708},{"href":567,"dataGaName":568,"dataGaLocation":665},{"text":710,"config":711},"Status",{"href":712,"dataGaName":713,"dataGaLocation":665},"https://status.gitlab.com/","status",{"text":715,"config":716},"Terms of use",{"href":717,"dataGaName":718,"dataGaLocation":665},"/terms/","terms of use",{"text":720,"config":721},"Privacy statement",{"href":722,"dataGaName":723,"dataGaLocation":665},"/privacy/","privacy statement",{"text":725,"config":726},"Cookie preferences",{"dataGaName":727,"dataGaLocation":665,"id":728,"isOneTrustButton":214},"cookie preferences","ot-sdk-btn",{"title":278,"links":730,"subMenu":739},[731,735],{"text":732,"config":733},"DevSecOps platform",{"href":260,"dataGaName":734,"dataGaLocation":665},"devsecops platform",{"text":736,"config":737},"AI-Assisted Development",{"href":267,"dataGaName":738,"dataGaLocation":665},"ai-assisted development",[740],{"title":741,"links":742},"Topics",[743,748,753,758,763,768,773,778],{"text":744,"config":745},"CICD",{"href":746,"dataGaName":747,"dataGaLocation":665},"/topics/ci-cd/","cicd",{"text":749,"config":750},"GitOps",{"href":751,"dataGaName":752,"dataGaLocation":665},"/topics/gitops/","gitops",{"text":754,"config":755},"DevOps",{"href":756,"dataGaName":757,"dataGaLocation":665},"/topics/devops/","devops",{"text":759,"config":760},"Version Control",{"href":761,"dataGaName":762,"dataGaLocation":665},"/topics/version-control/","version control",{"text":764,"config":765},"DevSecOps",{"href":766,"dataGaName":767,"dataGaLocation":665},"/topics/devsecops/","devsecops",{"text":769,"config":770},"Cloud Native",{"href":771,"dataGaName":772,"dataGaLocation":665},"/topics/cloud-native/","cloud native",{"text":774,"config":775},"AI for Coding",{"href":776,"dataGaName":777,"dataGaLocation":665},"/topics/devops/ai-for-coding/","ai for coding",{"text":779,"config":780},"Agentic AI",{"href":781,"dataGaName":782,"dataGaLocation":665},"/topics/agentic-ai/","agentic ai",{"title":784,"links":785},"Solutions",[786,788,790,795,799,802,806,809,811,814,817,822],{"text":322,"config":787},{"href":317,"dataGaName":322,"dataGaLocation":665},{"text":311,"config":789},{"href":294,"dataGaName":295,"dataGaLocation":665},{"text":791,"config":792},"Agile development",{"href":793,"dataGaName":794,"dataGaLocation":665},"/solutions/agile-delivery/","agile delivery",{"text":796,"config":797},"SCM",{"href":307,"dataGaName":798,"dataGaLocation":665},"source code management",{"text":744,"config":800},{"href":300,"dataGaName":801,"dataGaLocation":665},"continuous integration & delivery",{"text":803,"config":804},"Value stream management",{"href":350,"dataGaName":805,"dataGaLocation":665},"value stream management",{"text":749,"config":807},{"href":808,"dataGaName":752,"dataGaLocation":665},"/solutions/gitops/",{"text":360,"config":810},{"href":363,"dataGaName":364,"dataGaLocation":665},{"text":812,"config":813},"Small business",{"href":369,"dataGaName":370,"dataGaLocation":665},{"text":815,"config":816},"Public sector",{"href":375,"dataGaName":376,"dataGaLocation":665},{"text":818,"config":819},"Education",{"href":820,"dataGaName":821,"dataGaLocation":665},"/solutions/education/","education",{"text":823,"config":824},"Financial services",{"href":825,"dataGaName":826,"dataGaLocation":665},"/solutions/finance/","financial services",{"title":383,"links":828},[829,831,833,835,838,840,843,845,847,849,851,853,855,857],{"text":396,"config":830},{"href":398,"dataGaName":399,"dataGaLocation":665},{"text":401,"config":832},{"href":403,"dataGaName":404,"dataGaLocation":665},{"text":406,"config":834},{"href":408,"dataGaName":409,"dataGaLocation":665},{"text":411,"config":836},{"href":413,"dataGaName":837,"dataGaLocation":665},"docs",{"text":434,"config":839},{"href":436,"dataGaName":437,"dataGaLocation":665},{"text":841,"config":842},"What's new",{"href":489,"dataGaName":490,"dataGaLocation":665},{"text":429,"config":844},{"href":431,"dataGaName":432,"dataGaLocation":665},{"text":443,"config":846},{"href":445,"dataGaName":446,"dataGaLocation":665},{"text":451,"config":848},{"href":453,"dataGaName":454,"dataGaLocation":665},{"text":456,"config":850},{"href":458,"dataGaName":459,"dataGaLocation":665},{"text":461,"config":852},{"href":463,"dataGaName":464,"dataGaLocation":665},{"text":466,"config":854},{"href":468,"dataGaName":469,"dataGaLocation":665},{"text":471,"config":856},{"href":473,"dataGaName":474,"dataGaLocation":665},{"text":476,"config":858},{"href":478,"dataGaName":479,"dataGaLocation":665},{"title":492,"links":860},[861,863,865,867,869,871,875,880,882,884,886],{"text":500,"config":862},{"href":502,"dataGaName":494,"dataGaLocation":665},{"text":505,"config":864},{"href":507,"dataGaName":508,"dataGaLocation":665},{"text":513,"config":866},{"href":515,"dataGaName":516,"dataGaLocation":665},{"text":518,"config":868},{"href":520,"dataGaName":521,"dataGaLocation":665},{"text":523,"config":870},{"href":525,"dataGaName":526,"dataGaLocation":665},{"text":872,"config":873},"Sustainability",{"href":874,"dataGaName":872,"dataGaLocation":665},"/sustainability/",{"text":876,"config":877},"Diversity, inclusion and belonging (DIB)",{"href":878,"dataGaName":879,"dataGaLocation":665},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":528,"config":881},{"href":530,"dataGaName":531,"dataGaLocation":665},{"text":538,"config":883},{"href":540,"dataGaName":541,"dataGaLocation":665},{"text":543,"config":885},{"href":545,"dataGaName":546,"dataGaLocation":665},{"text":887,"config":888},"Modern Slavery Transparency Statement",{"href":889,"dataGaName":890,"dataGaLocation":665},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":892},[893,896,899],{"text":894,"config":895},"Terms",{"href":717,"dataGaName":718,"dataGaLocation":665},{"text":897,"config":898},"Cookies",{"dataGaName":727,"dataGaLocation":665,"id":728,"isOneTrustButton":214},{"text":900,"config":901},"Privacy",{"href":722,"dataGaName":723,"dataGaLocation":665},[903],{"id":904,"title":7,"body":210,"config":905,"content":907,"description":210,"extension":911,"meta":912,"navigation":214,"path":913,"seo":914,"stem":915,"__hash__":916},"blogAuthors/en-us/blog/authors/mark-settle.yml",{"template":906},"BlogAuthor",{"name":7,"config":908},{"headshot":909,"ctfId":910},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1779215794/fw131xublkzdvjdadd4q.png","marksettle","yml",{},"/en-us/blog/authors/mark-settle",{},"en-us/blog/authors/mark-settle","aur3jcqDyhashUtyXhd1W7N3ZrN09waCQv135AABEt4",[918,923,931],{"title":919,"description":920,"heroImage":212,"category":206,"date":207,"authors":921,"slug":922,"externalUrl":210},"When a version bump breaks your build, GitLab fixes it","Automatically upgrade dependencies, adapt code for breaking changes, and route changes for approval — only GitLab does it natively, with full context.",[7],"dependency-scanning-auto-remediation",{"title":924,"description":925,"heroImage":926,"category":206,"date":927,"authors":928,"slug":930,"externalUrl":210},"One vulnerability view: From scanner coverage to AI governance","As AI writes more code, security must keep pace. GitLab is one platform for all scanner coverage, detection, and remediation, with AI governance over agents.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1781621337/mtjqzed2cqtef0frmor2.png","2026-06-18",[929],"Alisa Ho","one-vulnerability-view",{"title":932,"description":933,"heroImage":934,"category":206,"date":935,"authors":936,"slug":938,"externalUrl":210},"Full security scanner coverage of your codebase in minutes","Security configuration profiles lead to faster scanner rollouts. Learn how this new capability in GitLab 19.0 covers thousands of projects in minutes, no gaps.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1779189265/iqzyhhiwagxzwywvjzow.png","2026-05-26",[937],"Michael Omokoh","security-configuration-profiles",{"promotions":940},[941,955,966,977],{"id":942,"categories":943,"header":945,"text":946,"button":947,"image":952},"ai-modernization",[944],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":948,"config":949},"Get your AI maturity score",{"href":950,"dataGaName":951,"dataGaLocation":437},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":953},{"src":954},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":956,"categories":957,"header":958,"text":946,"button":959,"image":963},"devops-modernization",[223,767],"Are you just managing tools or shipping innovation?",{"text":960,"config":961},"Get your DevOps maturity score",{"href":962,"dataGaName":951,"dataGaLocation":437},"/assessments/devops-modernization-assessment/",{"config":964},{"src":965},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":967,"categories":968,"header":969,"text":946,"button":970,"image":974},"security-modernization",[206],"Are you trading speed for security?",{"text":971,"config":972},"Get your security maturity score",{"href":973,"dataGaName":951,"dataGaLocation":437},"/assessments/security-modernization-assessment/",{"config":975},{"src":976},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":978,"paths":979,"header":982,"text":983,"button":984,"image":989},"github-azure-migration",[980,981],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":985,"config":986},"See how GitLab compares to GitHub",{"href":987,"dataGaName":988,"dataGaLocation":437},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":990},{"src":965},{"header":992,"blurb":993,"button":994,"secondaryButton":999},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":995,"config":996},"Get your free trial",{"href":997,"dataGaName":236,"dataGaLocation":998},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":703,"config":1000},{"href":557,"dataGaName":241,"dataGaLocation":998},1784253792844]