[{"data":1,"prerenderedAt":982},["ShallowReactive",2],{"/de-de/blog/gitlab-business-logic-security-analyzer":3,"navigation-de-de":234,"banner-de-de":671,"footer-de-de":679,"blog-post-authors-de-de-Chris Widstrom":923,"blog-related-posts-de-de-gitlab-business-logic-security-analyzer":938,"blog-share-wrapper-de-de":962,"next-steps-de-de":972},{"id":4,"title":5,"authors":6,"body":8,"category":212,"date":213,"description":214,"extension":215,"externalUrl":216,"faq":216,"featured":217,"heroImage":218,"hidePromo":219,"meta":220,"navigation":217,"path":221,"seo":222,"slug":226,"stem":227,"tags":228,"template":232,"updatedDate":216,"__hash__":233},"blogPosts/de-de/blog/gitlab-business-logic-security-analyzer.md","Was SAST-Scanner übersehen: Schwachstellen in der Geschäftslogik",[7],"Chris Widstrom",{"type":9,"value":10,"toc":203},"minimark",[11,28,37,42,45,58,61,82,91,95,99,107,110,123,127,130,139,159,166,170,173,182,186,189],[12,13,14,15,21,22,27],"p",{},"Broken Object Level Authorization (fehlerhafte Berechtigungsprüfung auf Objektebene) steht in den ",[16,17,20],"a",{"href":18,"rel":19},"https://owasp.org/API-Security/editions/2023/en/0x11-t10/",[],"OWASP API Security Top 10"," an erster Stelle. Laut ",[16,23,26],{"href":24,"rel":25},"https://owasp.org/www-community/Source_Code_Analysis_Tools",[],"OWASP"," tun sich klassische Tools für Static Application Security Testing (SAST) schwer damit, Fehler in der Zugriffskontrolle zu finden. Bei einer fehlenden Berechtigungsprüfung fehlt schlicht Code, und ein Scanner, der nach Mustern sucht, findet nichts, was er abgleichen könnte. Die Lücke lässt sich nur finden, wenn bereits bekannt ist, was der Endpunkt durchsetzen soll.",[12,29,30,31,36],{},"Wir entwickeln den ",[16,32,35],{"href":33,"rel":34},"https://docs.gitlab.com/user/application_security/business_logic_scanning/",[],"Business Logic Security Analyzer"," in GitLab Duo Agent Platform, um Schwachstellen in der Geschäftslogik zu finden, die musterbasierte Scanner übersehen. Er ist jetzt im Early Access für Kund(inn)en mit GitLab Ultimate auf GitLab.com verfügbar.",[38,39,41],"h2",{"id":40},"gültiger-code-mit-falscher-logik","Gültiger Code mit falscher Logik",[12,43,44],{},"Jedes Team für Anwendungssicherheit kennt diese drei Funde:",[46,47,48,52,55],"ol",{},[49,50,51],"li",{},"Ein Endpunkt übernimmt eine Bestell-ID aus der Anfrage und gibt die Bestellung zurück, ohne zu prüfen, wem sie gehört.",[49,53,54],{},"Ein Rollenfeld in einem Benutzerprofil akzeptiert jedes JSON, das der Client sendet.",[49,56,57],{},"Eine Benutzer-ID ist eine fortlaufende Ganzzahl.",[12,59,60],{},"Jeder dieser Funde ist gültiger Code, der an den meisten Taint- und Musterregeln einer klassischen SAST-Engine vorbeikommt, weil keine Daten aus unsicherer Quelle eine gefährliche Senke erreichen und keine bekannte schädliche Signatur auftaucht. Miteinander verkettet verschaffen sie einem Angreifer die Bestellungen aller Kund(inn)en und eine Administratorrolle.",[12,62,63,64,69,70,75,76,81],{},"Bei den Kund(inn)en von GitLab ist die Größe der Codebasen um ",[16,65,68],{"href":66,"rel":67},"https://about.gitlab.com/gitlab-security-standard/",[],"bis zu 500 %"," gewachsen, seit Agenten Code schreiben. Die Zahl der CVE-Veröffentlichungen lag bis April 46 % über der Februar-Prognose des ",[16,71,74],{"href":72,"rel":73},"https://www.first.org/newsroom/releases/20260615",[],"Forum of Incident Response and Security Teams",". Dieselben KI-Modelle, die Code erzeugen, machen es auch günstiger, bestehende Schwachstellen zu entdecken und zu verketten. Die Berechtigungslogik bekommt diesen Druck am stärksten zu spüren: Eine Prüfung schreiben Entwickler(innen) und Agenten in ein oder zwei Zeilen, doch wenn eine fehlt, bleibt die Lücke oft unbemerkt. Omer Azaria, Vice President of Product Management bei GitLab, brachte es auf der ",[16,77,80],{"href":78,"rel":79},"https://about.gitlab.com/de-de/blog/transcend-india-announcements/",[],"GitLab Transcend"," auf den Punkt: \"Wir stecken in der Klemme: mehr Code, schnellere Angriffe, gleich große Teams.\"",[83,84],"iframe",{"src":85,"frameBorder":86,"allow":87,"referrerPolicy":88,"style":89,"title":90},"https://player.vimeo.com/video/1233523012?title=0&byline=0&portrait=0&badge=0&autopause=0&player_id=0&app_id=58479","0","autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share","strict-origin-when-cross-origin","position:absolute;top:0;left:0;width:100%;height:100%;","Transcend 3 Omer Azaria and Rajat Pandit_100626",[92,93],"script",{"src":94},"https://player.vimeo.com/api/player.js",[38,96,98],{"id":97},"warum-der-scan-beim-gesamten-repository-ansetzt","Warum der Scan beim gesamten Repository ansetzt",[12,100,101,106],{},[16,102,105],{"href":103,"rel":104},"https://about.gitlab.com/de-de/blog/gitlab-duo-security-review-flow/",[],"GitLab Duo Security Review"," sucht in Merge Requests nach Fehlern bei der Berechtigung, doch viele Fehler in der Geschäftslogik sind in einem Diff nicht sichtbar. Ob ein Endpunkt die Eigentümerschaft prüfen muss, hängt vom Datenmodell ab, von den Rollen, die die Anwendung definiert, und davon, wie andere Endpunkte mit denselben Datensätzen umgehen. Wer einen einzelnen Handler beurteilen will, muss die Anwendung um ihn herum lesen.",[12,108,109],{},"Deshalb scannt der Business Logic Security Analyzer das gesamte Repository, und deshalb ist GitLab die richtige Plattform dafür. Der Quellcode, die Pipelines, die ihn bauen, die zugehörigen Sicherheitsfunde und die Richtlinien, die über Freigaben entscheiden, liegen alle in einem System. Ein Agent, der hier scannt, sieht die vollständige Anwendung und schreibt seine Funde dorthin, wo das Security-Team ohnehin arbeitet.",[12,111,112,113,117,118,122],{},"Auf der Transcend haben wir den ",[16,114,116],{"href":66,"rel":115},[],"GitLab Security Standard"," vorgestellt: fünf Stufen, die jeder Agent durchlaufen muss, um mehr Autonomie zu erhalten. Er beruht auf der Prämisse, dass Code inzwischen im Überfluss vorhanden ist und Vertrauen zur Mangelware wird. Die Stufe ",[119,120,121],"em",{},"Verify"," verlangt, dass jede Änderung, ob von einer Person oder einem Agenten geschrieben, Kontrollen durchläuft, auf die die Autor(inn)en keinen Einfluss haben. Der Business Logic Security Analyzer läuft außerhalb des Einflussbereichs der Autor(inn)en, und seine Funde bleiben in demselben Bericht und denselben Dashboards erhalten, über die auch der Rest der Codebasis gesteuert wird.",[38,124,126],{"id":125},"so-arbeitet-der-analyzer","So arbeitet der Analyzer",[12,128,129],{},"Der Business Logic Security Analyzer ist ein Foundational Flow in GitLab Duo Agent Platform, der auf Fehler in der Geschäftslogik zielt, zunächst auf Broken Object Level Authorization, fehlende oder fehlerhafte Berechtigungsprüfungen und Mass Assignment. Security-Fachleute können einen Scan des gesamten Repositorys ausführen und jeden Merge Request automatisch scannen lassen, sobald seine Pipeline erfolgreich durchgelaufen ist.",[12,131,132,133,138],{},"Um einen dieser Fehler zu erkennen, braucht es ein Modell dessen, was die Anwendung tun soll. Musterbasierte Scanner haben keines. Ein Agent, der das Repository liest, kann dagegen eines aufbauen. Der Analyzer ermittelt zunächst die Einstiegspunkte der Anwendung und bildet ab, wer was tun darf: welche Datensätze zu welchem Benutzerkonto gehören und welche Aktionen administrativ sind. Anschließend liest er jeden betroffenen Handler und prüft, ob dieser die Regel durchsetzt, bevor er auf den Datensatz zugreift. Die Funde erscheinen im ",[16,134,137],{"href":135,"rel":136},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"Vulnerability Report"," und im Sicherheits-Widget des Merge Requests als vollwertige SAST-Ergebnisse und unterstützen so Sichtung, Behebung und Audit.",[12,140,141,142,146,147,150,151,154,155,158],{},"In der Demo-Anwendung unten übernimmt ",[143,144,145],"code",{},"refund_order"," eine ",[143,148,149],{},"order_id"," aus der Anfrage und setzt ",[143,152,153],{},"refunded=1",", ohne zu prüfen, ob die aufrufende Person die Bestellung besitzt oder Administratorrechte hat. Taint-Regeln schlagen nicht an, weil die Abfrage parametrisiert ist. Der Analyzer meldet den Fund als CWE-639, Schweregrad Critical, in ",[143,156,157],{},"app/orders.py:17",", und seine Erklärung benennt die fehlende Prüfung der Eigentümerschaft.",[12,160,161],{},[162,163],"img",{"alt":164,"src":165},"Screenshot der Funde aus einem Scan einer Demo-Anwendung mit dem Business Logic Security Analyzer im Vulnerability Report von GitLab.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1792521341/w2sdpy8hv2ucqxfejmn6.png",[38,167,169],{"id":168},"die-modelle-hinter-dem-analyzer","Die Modelle hinter dem Analyzer",[12,171,172],{},"Der Business Logic Security Analyzer ist die erste Funktion von GitLab, die Claude Mythos 5.1 von Anthropic unterstützt, und steht Kund(inn)en in freigegebenen Umgebungen im Early Access zur Verfügung. Das Modell sieht nur die Prompts von GitLab und das Repository der Kund(inn)en. Dort liegt der Kontext, den der Analyzer braucht: das Datenmodell, die Rollen und die Regeln, die jeder Endpunkt durchsetzt. Rajat Pandit, Head of Applied AI bei Anthropic India, sagte auf der Transcend: \"Wenn Verteidiger über mehr Kontext verfügen als Angreifer, verschieben fortschrittliche Modelle das Kräfteverhältnis zu ihren Gunsten.\"",[12,174,175,176,181],{},"Neben Mythos unterstützt der Analyzer Claude Opus 5.5, Sonnet 5.5, Sonnet 5 und Sonnet 4.6 von Anthropic. Weitere Modelle sind für künftige Releases geplant. Alle laufen als von GitLab verwaltete Modelle über das AI Gateway von GitLab, unter ",[16,177,180],{"href":178,"rel":179},"https://docs.gitlab.com/user/gitlab_duo/data_usage/",[],"denselben Bedingungen für den Umgang mit Daten"," wie der Rest von GitLab Duo Agent Platform.",[38,183,185],{"id":184},"early-access-anfragen","Early Access anfragen",[12,187,188],{},"Der Business Logic Security Analyzer ist im Early Access für eine kleine Gruppe von Kund(inn)en mit GitLab Ultimate auf GitLab.com verfügbar. Die Teilnehmenden setzen den Analyzer auf ihre Codebasen an, um echte Funde aufzudecken, die ihre Security-Teams noch nicht kannten. Gemeinsam mit jedem Team finden wir heraus, wo der Analyzer richtig liegt, wo er falsch liegt und wo er nichts meldet. Jeder Scan verbraucht GitLab Credits, und die Kosten richten sich nach der Größe der Angriffsfläche der Anwendung.",[12,190,191,192,197,198,202],{},"Wer teilnehmen möchte, wendet sich an das eigene Account-Team oder, ohne bestehenden GitLab-Vertrag, an unser ",[16,193,196],{"href":194,"rel":195},"https://about.gitlab.com/de-de/sales/",[],"Sales-Team",". Sobald die Gruppe freigeschaltet ist, lässt sich ein Scan des gesamten Repositorys aus GitLab Duo Chat oder über die API starten. Um die Merge Requests eines Projekts zu scannen, wird das Scan-Profil Business Logic an das Projekt angehängt. Voraussetzungen und Einrichtung beschreibt die ",[16,199,201],{"href":33,"rel":200},[],"Dokumentation zum Business Logic Security Analyzer",".",{"title":204,"searchDepth":205,"depth":205,"links":206},"",2,[207,208,209,210,211],{"id":40,"depth":205,"text":41},{"id":97,"depth":205,"text":98},{"id":125,"depth":205,"text":126},{"id":168,"depth":205,"text":169},{"id":184,"depth":205,"text":185},"security","2026-10-20","Jetzt im Early Access: Business Logic Security Analyzer liest das Repository, leitet ab, was jeder Endpunkt durchsetzen sollte, und markiert die Lücken.","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png",false,{},"/de-de/blog/gitlab-business-logic-security-analyzer",{"config":223,"title":224,"description":225},{"noIndex":219},"Business Logic Security Analyzer jetzt im Early Access","Fehlende Berechtigungsprüfungen und Mass Assignment finden, die musterbasierte SAST-Scanner übersehen, mit dem Business Logic Security Analyzer von GitLab.","gitlab-business-logic-security-analyzer","de-de/blog/gitlab-business-logic-security-analyzer",[229,230,231],"AI","features","product","BlogPost","Ej2x8tINcelbRgOvvJlpoNYSShHaYaX5EVU3L8s5Hik",{"logo":235,"freeTrial":240,"sales":245,"login":250,"items":255,"search":586,"minimal":622,"duo":641,"switchNav":650,"pricingDeployment":661},{"config":236},{"href":237,"dataGaName":238,"dataGaLocation":239},"/de-de/","gitlab logo","header",{"text":241,"config":242},"Kostenlose Testversion anfordern",{"href":243,"dataGaName":244,"dataGaLocation":239},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de&glm_content=default-saas-trial/","free trial",{"text":246,"config":247},"Demo anfordern",{"href":248,"dataGaName":249,"dataGaLocation":239},"/de-de/request-a-demo/","sales",{"text":251,"config":252},"Anmelden",{"href":253,"dataGaName":254,"dataGaLocation":239},"https://gitlab.com/users/sign_in/","sign in",[256,342,430,435,510,564],{"text":257,"left":217,"config":258,"menu":260},"Plattform",{"dataNavLevelOne":259},"platform",{"type":261,"link":262,"columns":266,"feature":331},"lists",{"text":263,"config":264},"Die Plattform erkunden",{"href":265,"dataGaName":259,"dataGaLocation":239},"/de-de/platform/",[267,290,313],{"title":268,"items":269},"Ausführung und Workflows",[270,275,280,285],{"text":271,"config":272},"CI/CD",{"href":273,"dataGaLocation":239,"dataGaName":274},"/de-de/solutions/continuous-integration/","ci/cd",{"text":276,"config":277},"Quellcodeverwaltung",{"href":278,"dataGaLocation":239,"dataGaName":279},"/de-de/solutions/source-code-management/","source code management",{"text":281,"config":282},"Agile Delivery",{"href":283,"dataGaLocation":239,"dataGaName":284},"/de-de/solutions/agile-delivery/","agile delivery",{"text":286,"config":287},"Artefaktverwaltung",{"href":288,"dataGaLocation":239,"dataGaName":289},"/de-de/artifact-central/","artifact management",{"title":291,"items":292},"Sicherheit und Governance",[293,298,303,308],{"text":294,"config":295},"Anwendungssicherheitstests",{"href":296,"dataGaLocation":239,"dataGaName":297},"/de-de/solutions/application-security-testing/","application security testing",{"text":299,"config":300},"Governance und Compliance",{"href":301,"dataGaLocation":239,"dataGaName":302},"/de-de/solutions/software-compliance/","governance and compliance",{"text":304,"config":305},"Secrets-Management",{"href":306,"dataGaLocation":239,"dataGaName":307},"/de-de/gitlab-secrets-manager/","secrets management",{"text":309,"config":310},"Lieferkettensicherheit",{"href":311,"dataGaLocation":239,"dataGaName":312},"/de-de/solutions/supply-chain/","supply chain security",{"title":314,"items":315},"Kontext und KI",[316,321,326],{"text":317,"config":318},"Duo Agent Platform",{"href":319,"dataGaLocation":239,"dataGaName":320},"/de-de/gitlab-duo-agent-platform/","duo agent platform",{"text":322,"config":323},"Orbit",{"href":324,"dataGaLocation":239,"dataGaName":325},"/de-de/gitlab-orbit/","orbit",{"text":327,"config":328},"Sichtbarkeit und Messung",{"href":329,"dataGaLocation":239,"dataGaName":330},"/de-de/solutions/visibility-measurement/","visibility and measurement",{"config":332,"title":335,"text":336,"link":337},{"background":333,"textColor":334},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","GitLab Orbit ist allgemein verfügbar","Höhere Agentengenauigkeit, geringere Token-Kosten",{"text":338,"config":339},"Ankündigung lesen",{"href":340,"dataGaName":341,"dataGaLocation":239},"/blog/gitlab-orbit-ga/","orbit ga announcement",{"text":343,"left":217,"config":344,"menu":346},"Lösungen",{"dataNavLevelOne":345},"solutions",{"type":261,"link":347,"columns":351,"feature":421},{"text":348,"config":349},"Alle Lösungen anzeigen",{"href":350,"dataGaName":345,"dataGaLocation":239},"/de-de/solutions/",[352,370,388],{"title":353,"items":354},"Ergebnisse",[355,360,365],{"text":356,"config":357},"DevOps-Modernisierung",{"href":358,"dataGaLocation":239,"dataGaName":359},"/de-de/assessments/devops-modernization-assessment/","devops modernization",{"text":361,"config":362},"Sicherheitsmodernisierung",{"href":363,"dataGaLocation":239,"dataGaName":364},"/de-de/assessments/security-modernization-assessment/","security modernization",{"text":366,"config":367},"KI-Modernisierung",{"href":368,"dataGaLocation":239,"dataGaName":369},"/de-de/assessments/ai-modernization-assessment/","ai modernization",{"title":371,"items":372},"Nach Größe",[373,378,383],{"text":374,"config":375},"Große Unternehmen",{"href":376,"dataGaLocation":239,"dataGaName":377},"/de-de/enterprise/","enterprise",{"text":379,"config":380},"Kleine Unternehmen",{"href":381,"dataGaLocation":239,"dataGaName":382},"/de-de/small-business/","small business",{"text":384,"config":385},"Start-ups",{"href":386,"dataGaLocation":239,"dataGaName":387},"/de-de/solutions/startups/","startups",{"title":389,"items":390},"Branchen",[391,396,401,406,411,416],{"text":392,"config":393},"Finanzdienstleistungen",{"href":394,"dataGaLocation":239,"dataGaName":395},"/de-de/solutions/finance/","financial services",{"text":397,"config":398},"Öffentlicher Sektor",{"href":399,"dataGaLocation":239,"dataGaName":400},"/de-de/solutions/public-sector/","public sector",{"text":402,"config":403},"Telekommunikation",{"href":404,"dataGaLocation":239,"dataGaName":405},"/de-de/solutions/telecommunications/","telecommunications",{"text":407,"config":408},"Automobilindustrie",{"href":409,"dataGaLocation":239,"dataGaName":410},"/de-de/solutions/automotive/","automotive",{"text":412,"config":413},"Bildungswesen",{"href":414,"dataGaLocation":239,"dataGaName":415},"/de-de/solutions/education/","education",{"text":417,"config":418},"Luft- und Raumfahrt",{"href":419,"dataGaLocation":239,"dataGaName":420},"/de-de/solutions/aerospace/","aerospace",{"config":422,"title":423,"text":424,"link":425},{"background":333,"textColor":334},"GitLab-Sicherheitsstandard","Mehr dazu, wie du deine Software Factory stärkst und KI-Agenten Autonomie gewinnen lässt, ohne an Sicherheit einzubüßen.",{"text":426,"config":427},"Standard entdecken",{"href":428,"dataGaName":429,"dataGaLocation":239},"/de-de/gitlab-security-standard/","gitlab security standard",{"text":431,"config":432},"Preise",{"href":433,"dataGaName":434,"dataGaLocation":239,"dataNavLevelOne":434},"/de-de/pricing/","pricing",{"text":436,"config":437,"menu":439},"Ressourcen",{"dataNavLevelOne":438},"resources",{"type":261,"link":440,"columns":444,"feature":501},{"text":441,"config":442},"Alle Ressourcen anzeigen",{"href":443,"dataGaName":438,"dataGaLocation":239},"/de-de/resources/",[445,473],{"title":446,"items":447},"Entdecken",[448,453,458,463,468],{"text":449,"config":450},"Dokumentation",{"href":451,"dataGaName":452,"dataGaLocation":239},"https://docs.gitlab.com/","docs",{"text":454,"config":455},"GitLab University",{"href":456,"dataGaName":457,"dataGaLocation":239},"https://university.gitlab.com/","university",{"text":459,"config":460},"Demo-Reihe",{"href":461,"dataGaName":462,"dataGaLocation":239},"/de-de/gitlab-technical-demo-series/","demo series",{"text":464,"config":465},"Demo-Hub",{"href":466,"dataGaName":467,"dataGaLocation":239},"/de-de/demo-hub/","demo hub",{"text":469,"config":470},"Dienste",{"href":471,"dataGaName":472,"dataGaLocation":239},"/de-de/services/","services",{"title":474,"items":475},"Vernetzen",[476,481,486,491,496],{"text":477,"config":478},"Blog",{"href":479,"dataGaName":480,"dataGaLocation":239},"/de-de/blog/","blog",{"text":482,"config":483},"Community",{"href":484,"dataGaName":485,"dataGaLocation":239},"/community/","community",{"text":487,"config":488},"Kunden",{"href":489,"dataGaName":490,"dataGaLocation":239},"/de-de/customers/","customers",{"text":492,"config":493},"Partner",{"href":494,"dataGaName":495,"dataGaLocation":239},"/de-de/partners/","partners",{"text":497,"config":498},"Veranstaltungen",{"href":499,"dataGaName":500,"dataGaLocation":239},"/events/","events",{"config":502,"title":503,"text":504,"link":505},{"background":333,"textColor":334},"Neues bei GitLab","Über die neuesten Funktionen und Verbesserungen auf dem Laufenden bleiben.",{"text":506,"config":507},"Aktuelle Nachrichten",{"href":508,"dataGaName":509,"dataGaLocation":239},"/de-de/whats-new/","whats new",{"text":511,"config":512,"menu":514},"Unternehmen",{"dataNavLevelOne":513},"company",{"type":261,"columns":515},[516],{"items":517},[518,523,529,534,539,544,549,554,559],{"text":519,"config":520},"Über",{"href":521,"dataGaName":522,"dataGaLocation":239},"/de-de/company/","about",{"text":524,"config":525,"footerGa":528},"Karriere",{"href":526,"dataGaName":527,"dataGaLocation":239},"/jobs/","jobs",{"dataGaName":527},{"text":530,"config":531},"Presse",{"href":532,"dataGaName":533,"dataGaLocation":239},"/press/","press",{"text":535,"config":536},"Handbuch",{"href":537,"dataGaName":538,"dataGaLocation":239},"https://handbook.gitlab.com/","handbook",{"text":540,"config":541},"Geschäftsführung",{"href":542,"dataGaName":543,"dataGaLocation":239},"/company/team/e-group/","leadership",{"text":545,"config":546},"Investor Relations",{"href":547,"dataGaName":548,"dataGaLocation":239},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":550,"config":551},"Trust Center",{"href":552,"dataGaName":553,"dataGaLocation":239},"/de-de/security/","trust center",{"text":555,"config":556},"AI Transparency Center",{"href":557,"dataGaName":558,"dataGaLocation":239},"/de-de/ai-transparency-center/","ai transparency center",{"text":560,"config":561},"Newsletter",{"href":562,"dataGaName":563,"dataGaLocation":239},"/company/contact/#contact-forms","newsletter",{"text":565,"config":566,"menu":567},"Kontakt",{"dataNavLevelOne":513},{"type":261,"columns":568},[569],{"items":570},[571,576,581],{"text":572,"config":573},"Vertrieb kontaktieren",{"href":574,"dataGaName":575,"dataGaLocation":239},"/de-de/sales/","talk to sales",{"text":577,"config":578},"Support-Portal",{"href":579,"dataGaName":580,"dataGaLocation":239},"https://support.gitlab.com/hc/en-us","support portal",{"text":582,"config":583},"Kundenportal",{"href":584,"dataGaName":585,"dataGaLocation":239},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":587,"login":588,"suggestions":595},"Schließen",{"text":589,"link":590},"Um Repositorys und Projekte zu durchsuchen, melde dich an bei",{"text":591,"config":592},"gitlab.com",{"href":253,"dataGaName":593,"dataGaLocation":594},"search login","search",{"text":596,"default":597},"Vorschläge",[598,601,605,607,612,617],{"text":599,"config":600},"GitLab Duo Agent Platform",{"href":319,"dataGaName":599,"dataGaLocation":594},{"text":602,"config":603},"Codevorschläge (KI)",{"href":319,"dataGaName":604,"dataGaLocation":594},"Code Suggestions (AI)",{"text":271,"config":606},{"href":273,"dataGaName":271,"dataGaLocation":594},{"text":608,"config":609},"GitLab auf AWS",{"href":610,"dataGaName":611,"dataGaLocation":594},"/de-de/partners/technology-partners/aws/","GitLab on AWS",{"text":613,"config":614},"GitLab auf Google Cloud",{"href":615,"dataGaName":616,"dataGaLocation":594},"/de-de/partners/technology-partners/google-cloud-platform/","GitLab on Google Cloud",{"text":618,"config":619},"Warum GitLab?",{"href":620,"dataGaName":621,"dataGaLocation":594},"/de-de/why-gitlab/","Why GitLab?",{"freeTrial":623,"mobileIcon":628,"desktopIcon":633,"secondaryButton":636},{"text":624,"config":625},"Kostenlos testen",{"href":626,"dataGaName":244,"dataGaLocation":627},"https://gitlab.com/-/trials/new/","nav",{"altText":629,"config":630},"GitLab-Symbol",{"src":631,"dataGaName":632,"dataGaLocation":627},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":629,"config":634},{"src":635,"dataGaName":632,"dataGaLocation":627},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":637,"config":638},"Erste Schritte",{"href":639,"dataGaName":640,"dataGaLocation":627},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de/get-started/","get started",{"freeTrial":642,"mobileIcon":646,"desktopIcon":648},{"text":643,"config":644},"Mehr über GitLab Duo erfahren",{"href":319,"dataGaName":645,"dataGaLocation":627},"gitlab duo",{"altText":629,"config":647},{"src":631,"dataGaName":632,"dataGaLocation":627},{"altText":629,"config":649},{"src":635,"dataGaName":632,"dataGaLocation":627},{"button":651,"mobileIcon":656,"desktopIcon":658},{"text":652,"config":653},"/Option",{"href":654,"dataGaName":655,"dataGaLocation":627},"#contact","switch",{"altText":629,"config":657},{"src":631,"dataGaName":632,"dataGaLocation":627},{"altText":629,"config":659},{"src":660,"dataGaName":632,"dataGaLocation":627},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":662,"mobileIcon":667,"desktopIcon":669},{"text":663,"config":664},"Zurück zur Preisübersicht",{"href":433,"dataGaName":665,"dataGaLocation":627,"icon":666},"back to pricing","GoBack",{"altText":629,"config":668},{"src":631,"dataGaName":632,"dataGaLocation":627},{"altText":629,"config":670},{"src":635,"dataGaName":632,"dataGaLocation":627},{"title":672,"button":673,"config":677},"GitLab Orbit ist allgemein verfügbar. Steigere die Genauigkeit deiner Agenten und senke die Token-Kosten",{"text":338,"config":674},{"href":340,"dataGaName":675,"dataGaLocation":676},"orbit-ga-banner","global-banner",{"layout":678,"disabled":219},"release",{"data":680},{"text":681,"config":682,"items":687,"minimal":912},"Git ist eine Marke von Software Freedom Conservancy und unsere Verwendung von „GitLab“ erfolgt unter Lizenz.",{"twitter":683,"facebook":684,"youtube":685,"linkedin":686},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[688,734,794,837,879],{"title":431,"links":689,"subMenu":705},[690,695,700],{"text":691,"config":692},"Tarife anzeigen",{"href":433,"dataGaName":693,"dataGaLocation":694},"view plans","footer",{"text":696,"config":697},"Vorteile von Premium",{"href":698,"dataGaName":699,"dataGaLocation":694},"/de-de/pricing/premium/","why premium",{"text":701,"config":702},"Vorteile von Ultimate",{"href":703,"dataGaName":704,"dataGaLocation":694},"/de-de/pricing/ultimate/","why ultimate",[706],{"title":565,"links":707},[708,710,712,714,719,724,729],{"text":572,"config":709},{"href":574,"dataGaName":249,"dataGaLocation":694},{"text":577,"config":711},{"href":579,"dataGaName":580,"dataGaLocation":694},{"text":582,"config":713},{"href":584,"dataGaName":585,"dataGaLocation":694},{"text":715,"config":716},"Status",{"href":717,"dataGaName":718,"dataGaLocation":694},"https://status.gitlab.com/","status",{"text":720,"config":721},"Nutzungsbedingungen",{"href":722,"dataGaName":723,"dataGaLocation":694},"/terms/","terms of use",{"text":725,"config":726},"Datenschutzerklärung",{"href":727,"dataGaName":728,"dataGaLocation":694},"/de-de/privacy/","privacy statement",{"text":730,"config":731},"Cookie-Einstellungen",{"dataGaName":732,"dataGaLocation":694,"id":733,"isOneTrustButton":217},"cookie preferences","ot-sdk-btn",{"title":257,"links":735,"subMenu":751},[736,739,741,743,745,747],{"text":737,"config":738},"Plattform entdecken",{"href":265,"dataGaName":259,"dataGaLocation":694},{"text":317,"config":740},{"href":319,"dataGaName":320,"dataGaLocation":694},{"text":271,"config":742},{"href":273,"dataGaName":274,"dataGaLocation":694},{"text":322,"config":744},{"href":324,"dataGaName":325,"dataGaLocation":694},{"text":304,"config":746},{"href":306,"dataGaName":307,"dataGaLocation":694},{"text":748,"config":749},"Warum GitLab",{"href":620,"dataGaName":750,"dataGaLocation":694},"why gitlab",[752],{"title":753,"links":754},"Themen",[755,759,764,769,774,779,784,789],{"text":271,"config":756},{"href":757,"dataGaName":758,"dataGaLocation":694},"/de-de/topics/ci-cd/","cicd",{"text":760,"config":761},"GitOps",{"href":762,"dataGaName":763,"dataGaLocation":694},"/de-de/topics/gitops/","gitops",{"text":765,"config":766},"DevOps",{"href":767,"dataGaName":768,"dataGaLocation":694},"/de-de/topics/devops/","devops",{"text":770,"config":771},"Versionskontrolle",{"href":772,"dataGaName":773,"dataGaLocation":694},"/de-de/topics/version-control/","version control",{"text":775,"config":776},"DevSecOps",{"href":777,"dataGaName":778,"dataGaLocation":694},"/de-de/topics/devsecops/","devsecops",{"text":780,"config":781},"Cloud-nativ",{"href":782,"dataGaName":783,"dataGaLocation":694},"/de-de/topics/cloud-native/","cloud native",{"text":785,"config":786},"KI für das Programmieren",{"href":787,"dataGaName":788,"dataGaLocation":694},"/de-de/topics/devops/ai-for-coding/","ai for coding",{"text":790,"config":791},"Agentische KI",{"href":792,"dataGaName":793,"dataGaLocation":694},"/de-de/topics/agentic-ai/","agentic ai",{"title":343,"links":795},[796,798,800,802,804,806,808,810,812,814,817,820,822,825,829,833],{"text":356,"config":797},{"href":358,"dataGaName":359,"dataGaLocation":694},{"text":361,"config":799},{"href":363,"dataGaName":364,"dataGaLocation":694},{"text":366,"config":801},{"href":368,"dataGaName":369,"dataGaLocation":694},{"text":392,"config":803},{"href":394,"dataGaName":395,"dataGaLocation":694},{"text":397,"config":805},{"href":399,"dataGaName":400,"dataGaLocation":694},{"text":402,"config":807},{"href":404,"dataGaName":405,"dataGaLocation":694},{"text":407,"config":809},{"href":409,"dataGaName":410,"dataGaLocation":694},{"text":412,"config":811},{"href":414,"dataGaName":415,"dataGaLocation":694},{"text":417,"config":813},{"href":419,"dataGaName":420,"dataGaLocation":694},{"text":815,"config":816},"Enterprise",{"href":376,"dataGaName":377,"dataGaLocation":694},{"text":818,"config":819},"Kleinunternehmen",{"href":381,"dataGaName":382,"dataGaLocation":694},{"text":384,"config":821},{"href":386,"dataGaName":387,"dataGaLocation":694},{"text":760,"config":823},{"href":824,"dataGaName":763,"dataGaLocation":694},"/de-de/solutions/gitops/",{"text":826,"config":827},"Analyse der Softwarezusammensetzung (SCA)",{"href":311,"dataGaName":828,"dataGaLocation":694},"software composition analysis",{"text":830,"config":831},"Wertstrommanagement",{"href":329,"dataGaName":832,"dataGaLocation":694},"value stream management",{"text":834,"config":835},"Alle Lösungen",{"href":350,"dataGaName":836,"dataGaLocation":694},"all solutions",{"title":436,"links":838},[839,844,849,851,853,855,857,859,861,863,866,868,870,872,875],{"text":840,"config":841},"Installieren",{"href":842,"dataGaName":843,"dataGaLocation":694},"/de-de/install/","install",{"text":845,"config":846},"Kurzanleitungen",{"href":847,"dataGaName":848,"dataGaLocation":694},"/de-de/get-started/","quick setup checklists",{"text":449,"config":850},{"href":451,"dataGaName":452,"dataGaLocation":694},{"text":454,"config":852},{"href":456,"dataGaName":457,"dataGaLocation":694},{"text":459,"config":854},{"href":461,"dataGaName":462,"dataGaLocation":694},{"text":464,"config":856},{"href":466,"dataGaName":467,"dataGaLocation":694},{"text":469,"config":858},{"href":471,"dataGaName":472,"dataGaLocation":694},{"text":477,"config":860},{"href":479,"dataGaName":480,"dataGaLocation":694},{"text":482,"config":862},{"href":484,"dataGaName":485,"dataGaLocation":694},{"text":864,"config":865},"Kund(inn)en",{"href":489,"dataGaName":490,"dataGaLocation":694},{"text":492,"config":867},{"href":494,"dataGaName":495,"dataGaLocation":694},{"text":497,"config":869},{"href":499,"dataGaName":500,"dataGaLocation":694},{"text":560,"config":871},{"href":562,"dataGaName":563,"dataGaLocation":694},{"text":873,"config":874},"Neuerungen",{"href":508,"dataGaName":509,"dataGaLocation":694},{"text":876,"config":877},"Alle Ressourcen",{"href":443,"dataGaName":878,"dataGaLocation":694},"all resources",{"title":511,"links":880},[881,883,885,887,889,891,893,895,897,902,907],{"text":519,"config":882},{"href":521,"dataGaName":513,"dataGaLocation":694},{"text":524,"config":884},{"href":526,"dataGaName":527,"dataGaLocation":694},{"text":530,"config":886},{"href":532,"dataGaName":533,"dataGaLocation":694},{"text":535,"config":888},{"href":537,"dataGaName":538,"dataGaLocation":694},{"text":540,"config":890},{"href":542,"dataGaName":543,"dataGaLocation":694},{"text":545,"config":892},{"href":547,"dataGaName":548,"dataGaLocation":694},{"text":550,"config":894},{"href":552,"dataGaName":553,"dataGaLocation":694},{"text":555,"config":896},{"href":557,"dataGaName":558,"dataGaLocation":694},{"text":898,"config":899},"Nachhaltigkeit",{"href":900,"dataGaName":901,"dataGaLocation":694},"/sustainability/","Sustainability",{"text":903,"config":904},"Vielfalt, Inklusion und Zugehörigkeit",{"href":905,"dataGaName":906,"dataGaLocation":694},"/de-de/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":908,"config":909},"Transparenzerklärung zu moderner Sklaverei",{"href":910,"dataGaName":911,"dataGaLocation":694},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":913},[914,917,920],{"text":915,"config":916},"Terms",{"href":722,"dataGaName":723,"dataGaLocation":694},{"text":918,"config":919},"Cookies",{"dataGaName":732,"dataGaLocation":694,"id":733,"isOneTrustButton":217},{"text":921,"config":922},"Datenschutz",{"href":727,"dataGaName":728,"dataGaLocation":694},[924],{"id":925,"title":7,"body":216,"config":926,"content":928,"description":216,"extension":932,"meta":933,"navigation":217,"path":934,"seo":935,"stem":936,"__hash__":937},"blogAuthors/en-us/blog/authors/chris-widstrom.yml",{"template":927},"BlogAuthor",{"config":929,"name":7,"bio":931},{"headshot":930},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1789567036/sg1tlg9ctpwcmsbak2ij.jpg","Senior PM, SAST & SCA","yml",{},"/en-us/blog/authors/chris-widstrom",{},"en-us/blog/authors/chris-widstrom","aKDm1EPnJF7ZeX_kF88TW3So_WnmvuVjk7NgeZDNBfI",[939,947,955],{"title":940,"description":941,"heroImage":942,"category":212,"date":943,"authors":944,"slug":946,"externalUrl":216},"GitLab Orbit: Die Reichweite von Schwachstellen ohne manuelle Suche ermitteln","Schwachstellen werden inzwischen maschinenschnell ausgenutzt. GitLab Orbit zeigt jedes Projekt, jede Zuständigkeit und jede Pipeline, die eine kritische CVE betrifft, damit die Behebung Schritt hält.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1780996524/sd1vpl8empy26wizarqj.png","2026-10-29",[945],"Rebecca Carter","find-vulnerability-blast-radius-with-gitlab-orbit",{"title":948,"description":949,"heroImage":950,"category":212,"date":951,"authors":952,"slug":954,"externalUrl":216},"Schwachstellen maschinenschnell beheben, anstatt sie nur zu finden","Frontier-KI verändert, wie schnell sich Schwachstellen entdecken und ausnutzen lassen. Die nächste Herausforderung ist, dasselbe Tempo auch bei Behebung und Prävention zu erreichen, innerhalb der Software Factory.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png","2026-10-28",[953],"Bill Staples","security-at-machine-speed",{"title":956,"description":957,"heroImage":958,"category":212,"date":213,"authors":959,"slug":961,"externalUrl":216},"AI Governance: Agentenaktivität auf einen Blick","Mit dem AI Governance Dashboard von GitLab ist die Aktivität von KI-Agenten an einem Ort sichtbar, über Duo Agent Platform und extern angebundene Agenten hinweg.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773860699/gf9bdnis6ggrn4huvfrl.png",[960],"Alisa Ho","ai-governance-dashboard",{"header":963,"text":964,"button":968,"disclaimer":971},"Kostenlose 30-tägige\n\nGitLab-Testversion starten\n",[965,966,967],"GitLab Duo Agent Platform nutzen","Unsere fortschrittlichsten Funktionen ausprobieren","Komplexe Aufgaben mit KI automatisieren",{"text":624,"config":969},{"href":970,"dataGaName":244,"dataGaLocation":480},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/de-de/blog/","Keine Kreditkarte erforderlich.",{"header":973,"blurb":974,"button":975,"secondaryButton":980},"Beginne noch heute, schneller zu entwickeln","Entdecke, was dein Team mit der intelligenten Orchestrierungsplattform für DevSecOps erreichen kann.\n",{"text":976,"config":977},"Kostenlosen Test starten",{"href":978,"dataGaName":244,"dataGaLocation":979},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/de-de/","feature",{"text":572,"config":981},{"href":574,"dataGaName":249,"dataGaLocation":979},1793404612541]