AI-Assisted Features in DevSecOps

8/6/2026

This post introduces the integration of Privatemode AI with GitLab Duo Self-Hosted, enabling the use of confidential computing for AI coding agents. This allows organizations with strict data privacy and regulatory requirements to leverage AI features without sending source code or prompts outside of an encrypted boundary. The integration works by using a self-hosted AI Gateway that forwards requests to a Privatemode proxy, which then uses remote attestation to verify a hardware-based trusted execution environment (TEE) before establishing an encrypted channel for inference. This approach addresses the challenges of using AI in regulated industries by providing cryptographic guarantees that data remains encrypted during processing, even from the service operator or cloud provider.

7/16/2026

This post announces the general availability of GitLab Duo CLI, which brings GitLab Duo Agentic Chat into the terminal. It highlights how this extends AI capabilities beyond code editing to address operational tasks like pipeline failures, test breaks, and vulnerability identification directly from the command line. It details interactive and headless modes, authentication via GitLab CLI or personal access tokens, and the ability to share sessions across the terminal, UI, and editor extensions. It also mentions features like `/doctor` and `/mcp` for setup diagnostics and configuration checks.

7/16/2026

Introduces Security Review Flow, a new capability within the GitLab Duo Agent Platform, which acts as an AI-powered security engineer to review code changes. It focuses on identifying logic flaws, such as broken object-level authorization, data exposure, and control flow errors, which are typically missed by signature-based scanners. The flow analyzes diffs in context, provides detailed findings with explanations and suggested fixes, and complements traditional security tools and manual reviews.

7/16/2026

This post announces the general availability of Custom Flows and the integration of Foundational Flows within GitLab Duo Agentic Chat. Custom Flows allow users to define multi-step AI-powered workflows triggered by native GitLab events (mentions, assignments, pipelines, merge request lifecycle, work item changes, etc.) and run them in CI/CD pipelines. Foundational Flows can now be initiated from Agentic Chat, where user requests matching specialist work (e.g., implement a change, review a merge request, fix a failed pipeline) are recommended, approved, and executed. Enhancements to the Code Review Flow include exclusion rules for bot-authored or out-of-scope merge requests and custom review instructions to shape review criteria. The post also mentions a future Flow Creation Agent for plain-language flow descriptions.

7/16/2026

Introduces Dependency Scanning Auto-Remediation, a new capability that leverages AI (GitLab Duo Agent Platform) to automatically update vulnerable dependencies and fix any build-breaking changes introduced by these updates. This feature aims to reduce the dependency backlog, minimize developer effort in resolving breaking changes, and maintain an audit trail for all automated fixes. It supports multiple package managers and plans to expand to Rust and Go.

7/8/2026

This post details the successful use of AI agents, specifically within the GitLab Duo Agent Platform, to migrate a legacy rate-limiting system to a unified implementation in `labkit-ruby`. It highlights the structured workflow ('the pod, the loop, and the observability') that enabled this migration, including AI drafting specs, implementing bounded changes, writing tests, and pre-reviewing merge requests, with human oversight for scope, architecture, rollout, and final review. The post also discusses lessons learned regarding observability, the need for human judgment in defining 'done' and managing infrastructure bottlenecks, and the shift in the bottleneck from code generation to review capacity and operator attention.

6/30/2026

This post announces the integration of Anthropic's Claude Sonnet 5 model into the GitLab Duo Agent Platform. This integration enhances the platform's capabilities by providing a more reliable and efficient AI for agent-assisted software development tasks. Key improvements include higher quality code generation, better resolution of issues, and more consistent completion of multi-step tasks, which translates to reduced costs and increased productivity for users running GitLab Duo agents in production. The post also highlights the model's performance on benchmarks and its availability across all GitLab tiers and deployment models.

6/25/2026

This post details the integration of GitLab Orbit with Google Antigravity, enabling Antigravity agents to query GitLab's software lifecycle context graph. This integration allows agents to access structured data on projects, pipelines, merge requests, vulnerabilities, and source code, facilitating advanced use cases like blast radius analysis, onboarding and codebase exploration, and dependency mapping with image generation. The integration leverages the Model Context Protocol (MCP) and provides typed results for structured queries, improving agent accuracy and efficiency.

6/18/2026

Introduced event-driven triggers for GitLab Duo Flows, enabling automated execution based on real GitLab events like merge request conflicts, draft-to-ready transitions, approvals, and work item creation. Added pipeline event filters for specific states (failure, success, cancellation). Implemented governance controls: 'Disable custom agents and flows' and 'Restrict the AI catalog to your group hierarchy'. Enhanced flow configuration validation to catch errors before saving. Launched a public beta for an AI model allowlist and default model configuration.

6/18/2026

This post introduces AI audit event streaming (beta) for tracking AI agent actions and agent tool approval guardrails (beta) for controlling agent capabilities, enhancing governance and security. It also details the enforcement of third-party security scanners (SARIF output) at scale across all GitLab projects, integrating their findings into a unified vulnerability view and enabling automated remediation of detected vulnerabilities through the GitLab Duo Agent Platform. Additionally, secret detection now scans every commit on a new branch, and Secret False Positive Detection is now generally available with confidence scores and explanations.

6/17/2026

This post announces GitLab's recognition as a Leader in the Gartner Magic Quadrant for DevSecOps Platforms for the fourth year. It highlights the company's evolution into a 'control layer' for the agentic era, balancing speed with control. New innovations include next-gen source code management for machine scale, GitLab Orbit (a context graph), agents for security and governance, agentic triggers for task coordination, and GitLab Flex agreements for flexible spending. The post also emphasizes enterprise-grade uptime with strengthened SLAs and the platform's consistent delivery of new capabilities.

6/10/2026

This post announces and details several new AI-assisted capabilities and infrastructure enhancements: Next-generation Source Code Management (SCM) rebuilt for agent-scale concurrency, GitLab Orbit (a context graph for the full software lifecycle), Agents for security and governance, GitLab Duo Agent Platform (an orchestration system for agents), and GitLab Flex (a new buying model). It highlights the technical challenges of agentic coding on existing infrastructure and presents these new features as solutions to improve speed, control, and efficiency in the software development lifecycle.

6/10/2026

Introduces GitLab Orbit, a live, queryable graph of code, merge requests, pipelines, deployments, vulnerabilities, and ownership. Orbit aims to improve AI agent performance by providing first-party GitLab data instead of stitched-together tool calls, leading to faster execution, fewer tokens used, and reduced hallucinations. It also enables engineers to answer cross-system questions through a Data Explorer, facilitating incident response, migration planning, and vulnerability blast radius mapping. Orbit works by ingesting SDLC data into ClickHouse and serving it via a Cypher-like DSL, MCP, REST, and the GitLab CLI. It scales to tens of thousands of projects and hundreds of millions of nodes/edges. Authorization mirrors GitLab permissions.

6/9/2026

This post announces the integration of Claude Fable 5, a Mythos-class model from Anthropic, with the GitLab Duo Agent Platform. Key technical advancements highlighted include: - **Enhanced Goal-Directed Workflows:** Claude Fable 5 can sustain multi-step, goal-directed work with measurably fewer iterations, improving efficiency for tasks like multi-file refactors, incident investigation, and infrastructure-as-code definitions. - **Improved First-Shot Correctness:** The model demonstrates higher accuracy on complex, well-specified problems, reducing the need for back-and-forth interactions. - **Advanced Image and Screenshot Interpretation:** Claude Fable 5 interprets dense technical images and detailed screenshots with significantly higher accuracy and fewer tokens. - **Long-Horizon Autonomy:** The model sustains productive output over extended periods, completing multi-day runs and self-correcting through verification loops. It also dispatches and sustains parallel sub-agents more reliably. - **Reduced Human Oversight Cost:** The operational implication is a reduction in human oversight cost per agent run, allowing teams to tackle harder problems with greater confidence. - **Increased Bug-Finding Recall:** Claude Fable 5 shows noticeably higher bug-finding recall, improving outage triage, root cause analysis, and repository history investigation. - **Deeper Code Reasoning:** The model produces more actionable code review comments by reasoning through code paths with greater depth and identifying edge cases more consistently. - **Availability:** Claude Fable 5 is available across all tiers and deployment models through GitLab's AI Gateway, with specific availability details for GitLab.com and self-managed instances.

5/28/2026

This post details how integrating external coding agents with GitLab's platform context (issues, pipelines, security policies) improves the quality and security of AI-generated code. It explains how agents can leverage the Model Context Protocol (MCP) server and operate within merge requests to address review feedback, leading to fewer rework cycles and faster delivery. The post highlights the importance of `AGENTS.md` for custom instructions and discusses how structured context delivery, rather than just LLM context window size, is key to efficient AI-assisted development.

5/28/2026

Introduces Claude Opus 4.8 as a new model option within the GitLab Duo Agent Platform, enhancing agentic capabilities for complex, multi-step work. Highlights improved long-horizon agentic execution with more precise interpretation and fewer interventions. Adds support for mid-conversation system prompts, allowing dynamic updates to system instructions without invalidating the prompt cache, which is beneficial for scenarios with changing context like file modifications or updated user context.

5/26/2026

Introduced security configuration profiles as a centralized UI-based mechanism to manage and apply security scanner configurations (SAST, dependency scanning, secret detection) across multiple projects. Default profiles are provided with pre-configured scan triggers (merge request pipelines, branch pipelines for default branch, and push protection for secret detection). This aims to automate and standardize security coverage, addressing challenges of manual configuration at scale and AI-driven code velocity.

5/21/2026

This post expands the capabilities of the GitLab Duo Agent Platform Self-Hosted by enabling the use of more open-source AI models for customers operating under data residency, air-gapped network, or strict compliance regulations. It details the deployment options, including on-premises hardware running vLLM and GPU-enabled virtual machines, and lists newly supported models: Mistral Devstral 2 123B, GLM-5.1, Kimi-K2.6, and MiniMax-M2.7. This addresses the trade-off between model capability and deployment constraints, allowing teams to match the right model to their specific workflow and infrastructure, even in isolated environments.

5/18/2026

This post introduces the GitLab Duo Agent Platform and GitLab Duo CLI as extensions of GitLab's AI-assisted features, specifically addressing the governance and security challenges of AI agents in automated workflows and CI/CD pipelines. It highlights the platform's ability to enforce enterprise-level controls, provide auditable records of agent actions, implement prompt injection detection, and manage composite identity scopes. The post contrasts this with individual developer workstation AI tools and emphasizes the importance of security models that hold even when no human is watching.

5/18/2026

This post details the integration of Codex, an AI coding agent, with the GitLab Duo Agent Platform to automate bug fixing and enhance the software development lifecycle. It outlines three use cases: fixing a Rust WebSocket bug locally, enriching context with GitLab MCP for issue-aligned fixes, and using Codex as an external agent to address review feedback. The post highlights how GitLab's CI/CD, Duo Code Review, and MCP server provide the necessary context and automation to move from AI-generated code to shipped software.

5/13/2026

Introduced vulnerability management policies that allow for automated severity overrides based on defined rules (CVE ID, CWE ID, file path, directory). Supports 'Set Severity', 'Increase Severity', and 'Decrease Severity' operations. Provides use cases for downgrading low-risk CVEs in internal services, upgrading injection vulnerabilities in production code, normalizing severity across scanners, aligning severity with exploitation intelligence, and applying org-wide risk models at the group level. Details on policy creation, validation, and quick reference for parameters are included.

5/13/2026

This post details how GitLab Ultimate hardens the pipeline perimeter for AI-assisted coding by integrating application security into the platform. It introduces three dimensions: See (Group Security Dashboard, Credentials Inventory, Token Lifetime Enforcement, Audit Event Streaming, Group SBOM), Enforce (Scan Execution Policies, Pipeline Execution Policies, MR Approval Policies, Secret Push Protection), and Fix (MR security widget, Advanced SAST, AI-generated false positive detection, Security Analyst Agent, Agentic Vulnerability Resolution). These capabilities aim to ensure security keeps pace with AI-driven development by making security a core property of the platform, not a separate portal.

5/11/2026

GitLab is undergoing a significant transformation to lead in the agentic era of software development. This involves a generational rebuild of its underlying infrastructure to handle machine-scale work, reengineering Git for machine scale, and moving from a monolith to modern, API-first, composable services. Agent-specific APIs are being built to allow agents to act as first-class users. The platform is also reimagining CI/CD as an orchestration service that coordinates agents across the full lifecycle, validating work, enforcing guardrails, and driving change to production at machine rate. A key focus is on building a connected data model that accumulates context over years of team work, enabling agents to deliver better results with fewer tokens. Governance, including identity, audit, and policy, is being built into the core platform services to enable enterprises to move fast while maintaining control. GitLab is building one platform that operates across human-owned, agent-assisted, and agent-autonomous work, delivering it cloud and model neutral. The business model is evolving to include consumption pricing for agent work, with plans to introduce more flexibility to mix subscription and consumption models. The company is also adopting new operating principles: Speed with Quality, Ownership Mindset, and Customer Outcomes, built on a culture of excellence.

5/7/2026

This post introduces the GitLab Duo Agent Platform, a new capability that allows users to create custom AI agents to automate complex and repetitive engineering tasks, specifically focusing on onboarding new microservices into existing GitOps deployment workflows. It details the process of generating system prompts using GitLab Duo, creating and managing custom agents, and using these agents to automate the creation of manifests, update delivery pipelines, and configure image automation for new microservices. The post provides a concrete use case with TanukiBank, demonstrating how a custom agent can onboard a new microservice in minutes, significantly reducing manual effort and ensuring enterprise control through versioned and auditable artifacts within GitLab.

5/6/2026

This post details the integration of Claude Code with GitLab's CI/CD, security scanning, and code review workflows. It introduces three scenarios: fixing a C++ bug with Claude Code and then using GitLab CI/CD and Duo Code Review; adding GitLab MCP context to Claude Code for richer issue understanding; and using a Claude-powered external agent in Duo Agent Platform to address code review feedback directly in merge requests. It highlights the use of the Model Context Protocol (MCP) for seamless context transfer and automated merge request creation.

5/5/2026

This post introduces eight capability patterns for agentic AI that reshape team collaboration: providing status updates, routing work between humans, facilitating team communication, role-specific agents in chat, conversational context, role-based access control (RBAC) for agents, governed environments for agents, and collaborative agent building. It highlights how these patterns help teams move faster, work smarter, and stay in control. It also notes that a unified experience integrating environment grouping, catalog sharing, and managed promotion pipelines is a rare capability. The post emphasizes GitLab's structural advantage in integrating agents into its existing DevSecOps lifecycle via the GitLab Duo Agent Platform.

4/28/2026

This post details the integration of Anthropic's Claude models into the GitLab Duo Agent Platform, enhancing AI-assisted capabilities for enterprise development. It emphasizes the governance and auditability of AI interactions within the existing SDLC workflows, ensuring AI suggestions and actions are subject to the same controls as human contributions. The integration also expands enterprise deployment flexibility by leveraging existing cloud provider relationships (Google Cloud Vertex AI, Amazon Bedrock) and introduces GitLab to the Claude Marketplace. The core technical contribution is the architectural decision to embed AI within the existing governance framework, enabling agentic workflows with full visibility and control.

4/22/2026

This post details the results of the GitLab AI Hackathon 2026, highlighting community-built AI agents and flows on the GitLab Duo Agent Platform. It showcases winning projects like LORE (Living Organizational Record Engine) for knowledge management, Gitdefender for automated security issue detection and fixing, Aegis for AI-powered explanations, GraphDev for code evolution mapping, DocSync for automated documentation updates, Time-Traveler for safe database migrations, RedAgent for verifying AI security findings, and GreenPipe for CI/CD carbon footprint reporting. The hackathon attracted nearly 7,000 developers who built over 600 agents and flows, demonstrating significant community engagement and innovation in applying AI to software development, security, compliance, and operations.

4/21/2026

This post introduces the integration of GitLab Duo Agent Platform with Amazon Bedrock, providing a trusted AI foundation for platform orchestration. It details how GitLab acts as an orchestration layer for agentic AI across the software lifecycle, with Bedrock serving as the secure, compliant foundation model layer. The post outlines three deployment options: integrated with self-hosted models on Amazon Bedrock for GitLab Self-Managed, integrated with GitLab-operated models on Amazon Bedrock for GitLab Self-Managed, and integrated with GitLab-operated models on Amazon Bedrock for GitLab.com instances. It emphasizes how this integration helps avoid fragmented AI tooling, fuzzy data paths, and underutilized Bedrock investments by consolidating DevSecOps orchestration and AI model governance within existing AWS environments.

4/20/2026

This post details the evolution of AI-assisted features in DevSecOps by introducing AI-driven security vulnerability detection and remediation within the CI/CD pipeline. It describes how AI models can identify zero-day vulnerabilities, assess their reachability and exploitability, and automate remediation suggestions. The post emphasizes the importance of embedding these capabilities directly into the pipeline as the enforcement point for security policies, ensuring that fixes are proposed, reviewed, and merged through the same auditable process as human-authored code. It highlights the need for security to run at the speed of AI coding and outlines what a 'ready pipeline' looks like in this new paradigm, including automated triage, policy enforcement at the point of change, and AI-assisted remediation.

4/16/2026

This post introduces Agentic SAST Vulnerability Resolution, a new capability within the GitLab Duo Agent Platform, which automatically generates ready-to-merge code fixes for SAST vulnerabilities. It analyzes vulnerabilities, generates fixes, and validates them through automated testing. The post also details enhancements in GitLab 18.11, including faster SAST scanning with incremental scanning for Advanced SAST, improved vulnerability scoring using CVSS 4.0, policy-based severity overrides, risk-based enforcement for merge approvals (KEV/EPSS), and a Top CWEs security dashboard chart. Additionally, it introduces the Security Manager role and SAST configuration profiles to enhance security controls and reduce operational overhead.

4/16/2026

Introduces two new foundational AI agents for the Duo Agent Platform: CI Expert Agent (beta) which automatically generates `.gitlab-ci.yml` configurations based on repository analysis, and Data Analyst Agent (GA) which allows users to query development lifecycle data (MRs, issues, pipelines, jobs) using natural language within Agentic Chat. These agents leverage internal GitLab context for more relevant insights than external tools.

4/16/2026

This post announces the integration of Claude Opus 4.7 into the GitLab Duo Agent Platform. This new model offers improved reasoning capabilities for complex, long-running tasks, better instruction following for precise execution of multi-step workflows, and enhanced output verification. These improvements are expected to make agents more efficient and reliable across CI/CD pipelines, code review, vulnerability remediation, and other agent-powered workflows.

4/14/2026

This post details the integration of GitLab Duo Agent Platform with Google Cloud's Vertex AI. It describes how Vertex AI powers the model tier for agent calls within GitLab's intelligent orchestration layer, enabling agentic AI across the entire software development lifecycle. Key technical aspects include the use of GitLab's AI Gateway for mediating access, the model-flexible architecture of Duo Agent Platform, and the benefits of Vertex AI's managed environment for foundation models and infrastructure. It also highlights the role of Vertex AI Model Garden for model selection and the BYOM (Bring Your Own Model) option for self-hosted Duo Agent Platform.

4/13/2026

This post details GitLab's recognition as a Leader in the 2026 Omdia Universe for AI-assisted Software Development, IDE-based Tools. It highlights Omdia's expanded evaluation criteria to include full software lifecycle capability (beyond just coding) and the weighting of agentic AI as a current evaluation dimension. GitLab achieved best-in-class scores in Solution Breadth (100%), Strategy and Innovation (88%), and Core Features (82%), with top-tier ratings for Extended Features and Vendor Execution. The post emphasizes GitLab's comprehensive SDLC coverage, end-to-end orchestration, privacy-first design, multi-model support, and enterprise readiness as key differentiators.

4/7/2026

Introduces GitLab Duo CLI, bringing agentic AI powered by the Duo Agent Platform to the terminal. Highlights its dual operating modes: interactive chat with human-in-the-loop approval and headless mode for automated workflows in runners and scripts. Details the security model with default human-in-the-loop, prompt injection detection, composite identity for auditable actions, and custom instruction files for least privilege AI.

3/19/2026

This post introduces and details three new AI-powered security capabilities: SAST false positive detection (now generally available), Agentic SAST vulnerability resolution (beta), and Secret false positive detection (beta). SAST false positive detection uses an LLM to assess the likelihood of a SAST finding being a false positive, providing a confidence score and explanation. Agentic SAST vulnerability resolution automatically creates merge requests with proposed fixes for verified SAST vulnerabilities. Secret false positive detection flags dummy and test secrets. These features leverage the GitLab Duo Agent Platform and aim to reduce manual triage effort and accelerate vulnerability remediation.

3/19/2026

Introduces GitLab Credits as a purchasable, usage-based option for Free tier teams to access agentic AI capabilities, including Planner Agent, Developer Flow, Code Review Flow, and Fix CI/CD Pipeline Flow. Establishes a flat rate of 0.25 GitLab Credits per automated code review. Details how these credits can be managed via a dashboard and purchased through group billing settings. Highlights the economic benefits and workflow improvements of using agentic AI for planning, code generation, automated code review, and pipeline diagnosis.

3/10/2026

This post details the application of the GitLab Duo Agent Platform for automating detection gap analysis within GitLab's Signals Engineering team. It introduces two AI agents: the pre-built Security Analyst Agent and a custom-built Detection Engineering Assistant. The post explains the 'detection gap problem,' the capabilities of the GitLab Duo Agent Platform, and provides guidance on how to configure and use custom agents by crafting detailed system prompts that encode domain knowledge, tech stack context, and desired output formats. It highlights the benefits of this automation in improving the consistency and thoroughness of security incident reviews and the creation of actionable detection engineering tasks, while emphasizing that it acts as a force multiplier for skilled engineers.

3/5/2026

This post introduces and details the integration of the GitLab Duo Agent Platform with the Model Context Protocol (MCP), specifically demonstrating its connection to Jira. It outlines the architecture where the Duo Agent Platform acts as an MCP client, configuring OAuth applications in Jira, and enabling MCP in GitLab. The post provides practical use cases for planning assistance, issue triage from code, and cross-system incident investigation, highlighting how natural language queries can interact with Jira data and trigger actions within the IDE.

2/27/2026

This post introduces the concept of governing risk in the context of AI-assisted development. It highlights that while AI can detect vulnerabilities, human oversight and governance are crucial for enterprise security. The post emphasizes GitLab's role as an orchestration layer that provides enforcement, visibility, and auditability for AI-generated code. It contrasts LLMs' isolated code analysis with platforms that understand context, and argues for continuous assurance through embedded controls in development workflows. The core contribution is the framing of AI security not just as detection, but as a governance challenge that GitLab is positioned to solve.

2/26/2026

Introduces the GitLab Duo Agent Platform, enabling the creation of external agents that integrate with external AI models (e.g., Anthropic's Claude, OpenAI's Codex). These agents can autonomously complete complex, multi-step tasks within the GitLab environment, including generating full-stack applications from issue descriptions, performing comprehensive code reviews with detailed analysis and recommendations, and creating CI/CD pipelines to build container images and deploy to GitLab's container registry. The platform aims to address the problem of isolated AI tools by bringing intelligent automation directly into the development workflow.

2/24/2026

This post introduces the GitLab Duo Agent Platform as a key component of 'Intelligent Orchestration' within the DevSecOps lifecycle. It details how AI agents will work alongside developers to automate tasks like coding, reviews, testing, and CI/CD fixes. The platform leverages GitLab's unified data model and provides context-aware autonomous actions, multi-step reasoning, and flow automation. It also highlights the partnership with TCS to industrialize DevSecOps adoption at scale and productize the developer experience through platform engineering, with GitLab acting as the IDP control plane.

2/19/2026

Introduces the Self-Hosted GitLab Duo Agent Platform for Online Cloud Licenses, enabling usage-based billing with GitLab Credits for transparent metering and chargeback. This allows organizations to run AI-powered flows using their own self-hosted or third-party models via the GitLab AI Gateway, ensuring data residency, control, and governance. It addresses deployment blockers for regulated industries by providing a governed control plane for agentic AI.

2/17/2026

This post introduces the availability of Claude Opus 4.6 within the GitLab Duo Agent Platform. It highlights the model's advanced agentic capabilities, its 1 million token context window for processing large codebases and documentation, and its integration with GitLab's DevSecOps data. The post details how Claude Opus 4.6 can be used for agentic development and agentic chat, and explains its credit usage multipliers. It also notes that while available in the Duo Agent Platform, it is not yet available for GitLab Duo Classic features or supported IDEs, with those integrations coming soon.

1/15/2026

Introduced GitLab Duo Agent Platform, a new capability for agentic AI automation across the software development lifecycle. This includes Duo Agentic Chat for context-aware assistance and multi-step reasoning, foundational agents (Planner, Security Analyst), custom agents via AI Catalog, and external agent integrations. Also introduced Flows for automating complex tasks (e.g., Issue to MR, CI/CD migration) and the MCP Client for connecting to external tools like Jira and Slack. The platform offers flexible model selection and deployment options.

1/15/2026

Introduced GitLab Credits as a new virtual currency for usage-based pricing, specifically for GitLab Duo Agent Platform. This model replaces seat-based pricing for AI, allowing pooled credits across an organization for agentic AI usage. It supports foundational agents, external agents, custom flows, and agentic chat. Usage is drawn down from these credits, with consumption rates varying by LLM. The post details cost governance features including sizing calculators, usage visibility dashboards, usage controls, and automated notifications. Existing Premium and Ultimate customers receive promotional included credits. It also outlines the competitive advantages of this model over traditional seat-based pricing.

1/14/2026

This post introduces GitLab Duo Agentic Chat as the primary interface for interacting with AI agents, detailing its capabilities such as code operations, project insights, actionable tasks, context awareness, extensibility, and multi-agent support. It outlines access methods across Web UI, IDEs (VS Code, JetBrains, Visual Studio), and CLI. The post details model and agent selection, highlighting specialized agents like Planner, Security Analyst, Data Analyst, and CI Expert, and provides common use cases with example prompts for issue management, vulnerability analysis, code understanding, onboarding, debugging, code review, feature implementation, and refactoring. Troubleshooting tips for common issues are also included.

1/14/2026

This post details the introduction and functionality of the AI management capabilities within GitLab, providing a central hub for managing AI workflows. It covers the UI sections for Agents, Flows, Triggers, Sessions, and MCP Servers, explaining how to view, create, and manage these components. Specific emphasis is placed on setting up event-driven triggers based on GitLab SDLC events (mentions, assignments) and monitoring agent/flow execution through detailed session logs.

1/14/2026

This post introduces the GitLab Duo Agent Platform, detailing its architecture and capabilities. It categorizes agents into Foundational (GitLab Duo Chat, Planner, Security Analyst, Data Analyst, CI Expert), Custom (user-defined for team-specific workflows), and External (integrating with third-party AI providers like Claude, Codex, Amazon Q, Gemini). It explains how to create and configure custom agents using system prompts and discusses best practices for their development and deployment. The post also outlines the use cases and setup for external agents, emphasizing their role in event-triggered automation and leveraging specialized AI models for tasks like code review and security analysis.

1/14/2026

This post introduces the concept of 'flows' within the GitLab Duo Agent Platform, which are orchestrations of multiple agents to solve complex problems autonomously. It details the characteristics of flows (multi-agent, built-in, event-driven, asynchronous, complete workflows) and differentiates them from interactive agents. The post outlines two types of flows: foundational flows (maintained by GitLab for common tasks like code review and vulnerability resolution) and custom flows (user-defined for specific team needs like compliance checking or dependency management). It explains how to trigger custom flows via mentions, assignments, reviewer assignments, or pipeline events, and how to create them using YAML configuration defining components, prompts, routers, and toolsets. An example YAML for a feature implementation flow is provided.

1/6/2026

Introduces the GitLab Duo Security Analyst Agent, an AI-powered tool that automates vulnerability analysis and triaging. The agent evaluates exploitability, reachability, and prioritizes vulnerabilities based on risk, providing actionable remediation recommendations. It is accessible via the AI Catalog and requires a GitLab Ultimate subscription with the Duo Agent Platform enabled. The post details how to enable integrated security scanners (SAST, Dependency Scanning, Container Scanning, etc.) and how to use the Security Analyst Agent to analyze findings within the Vulnerability Report.

1/5/2026

This post details research findings on building trust in AI agents, identifying four key pillars: safeguarding actions (confirmation dialogs, rollback, secure boundaries), providing transparency (progress updates, action explanations, clear error handling), remembering context (preference retention, context awareness, adaptive learning), and anticipating needs (pattern recognition, intelligent agent selection, environment analysis). It also provides practical implementation advice such as starting with low-risk environments, designing for continuous orchestration with intervention, maintaining audit trails, and personalizing experiences. The core message is that trust in AI agents builds incrementally through micro-inflection points, not breakthrough moments, and this trust is crucial for enterprise-scale adoption of agentic tools in DevSecOps.

12/18/2025

Introduced Custom Flows for automating multistep workflows using YAML-defined sequences that orchestrate agents. Added a SAST False Positive Detection Flow that uses AI to identify potential false positives. Implemented Custom Agent Versioning to allow teams to pin specific versions of AI Catalog agents and flows. Enabled administrators to turn Foundational Agents on or off at the instance or group level. Launched the Data Analyst Agent for natural language exploration of GitLab data using GLQL. Added Dynamic Input Selection to GitLab Pipelines for UI-driven pipeline triggering with dynamic, cascading dropdown fields. Introduced CI/CD Catalog Publication Guardrails for administrators to control which projects can publish components. Added Warn Mode for MR Approval Policies, allowing violations to be surfaced without blocking merges, and displaying policy violations in the Vulnerability Report with a visual badge.

12/10/2025

This post details how Artois University is leveraging GitLab Ultimate and GitLab Duo's AI capabilities to accelerate open-source contributions. Specifically, it highlights two Master's students who used GitLab Duo's AI chat and code suggestions to make direct contributions to the GitLab product by adding the ORCID identifier into user profiles. This demonstrates the impact of AI features in helping students with less codebase knowledge deliver meaningful contributions.

12/2/2025

This post introduces the integration of GitLab with CodeSonar for automated compliance in embedded systems. It details how CodeSonar, a static analysis tool, can be integrated into GitLab CI/CD pipelines to scan C/C++ code for vulnerabilities and compliance with standards like MISRA C/C++ and ISO 26262. The integration surfaces SAST findings in merge requests and leverages GitLab Duo AI for vulnerability explanation and remediation recommendations. The workflow demonstrates continuous verification from commit to merge, with automated policy enforcement and evidence collection for audit trails.

11/20/2025

This post introduces several enhancements to GitLab's AI capabilities, primarily within the GitLab Duo Agent Platform. Key updates include making the GitLab Duo Planner and Security Analyst agents available by default and at the group level, supporting milestone and iteration workflows for the Planner, and providing automated vulnerability review and remediation suggestions for the Security Analyst. It also adds support for the gpt-oss-120b open-source model for self-managed customers, allowing for auditable and transparent AI deployments. Cloud-connected self-managed instances now feature end-user model selection in the UI. The Web IDE gains support for air-gapped environments by allowing configuration of extension host domains. The modern interface becomes the default for self-managed instances. Security features are enhanced with custom business context labels for projects and groups to enable risk-based filtering of vulnerabilities.

11/17/2025

This post details a new engineer's experience using GitLab Duo during their onboarding process. It highlights specific use cases for AI assistance in exploring documentation across multiple sources (handbook, internal handbook, GitLab Docs), identifying edge cases and dependencies for issues, and refining solutions based on GitLab best practices. It also describes using Duo for pre-submission code review of merge requests to catch mistakes and understand reviewer feedback, and for debugging failing pipeline jobs by analyzing logs and applying changes. The post emphasizes how these AI capabilities align with GitLab's CREDIT values and the importance of cautious AI usage.

10/31/2025

This post announces the deprecation of Claude Sonnet 3.7 support in GitLab Duo features, scheduled for GitLab 18.8 (January 15, 2026). It recommends immediate migration to Claude 4.0+ models to ensure continued service and access to the latest AI capabilities. The timeline and additional resources for Anthropic's model deprecations and GitLab Duo model selection are provided.

10/22/2025

This post introduces the capability of modernizing Java applications using GitLab Duo with Amazon Q. It details a workflow where users create an issue to describe the modernization goal (e.g., Java 8 to Java 17), then use a `/q transform` command to trigger an automated analysis of the codebase. Amazon Q analyzes the code, identifies deprecated features, and generates a merge request with all necessary updates, including source code and build configuration files (`pom.xml`). The generated merge request allows for review and verification of changes, ensuring functionality is preserved while leveraging modern Java features.

10/21/2025

This post details performance enhancements to Advanced SAST, including multi-core scanning (up to 50% reduction in scan time), diff-based scanning (under 10 minutes for large repos previously over 20 minutes), and algorithmic optimizations (up to 71% reduction on large open-source codebases). It also introduces custom detection rules for SAST, allowing users to define organization-specific pattern-based rules.

10/21/2025

Introduces a modernized UI with a panel-based layout for persistent GitLab Duo Chat and improved navigation. Enhances the GitLab Duo Agent Platform with the Security Analyst Agent for automated vulnerability triage and the GitLab Duo Planner for backlog management (read-only). Integrates popular external AI tools (Claude, OpenAI Codex, Gemini CLI, Amazon Q Developer, OpenCode) into the AI Catalog as native GitLab agents, with Duo Enterprise subscriptions including Claude and Codex. Moves the Self-hosted GitLab Duo Agent Platform to beta for on-premises AI execution. Adds Static Reachability Analysis for Java to identify exploitable vulnerabilities, complementing existing support for Python, JS, and TS. Introduces Secret Validity Checks to distinguish active from expired secrets in the Vulnerability Report. Enables Custom Rules for Advanced SAST using TOML files for tailored detection logic. Adds Advanced SAST support for C and C++ languages, requiring compilation database generation.

10/20/2025

This post introduces the availability of Claude Haiku 4.5 within the GitLab Duo Agent Platform Agentic Chat. It highlights the model's speed and coding performance, and its role in multi-agent orchestration for efficient agentic workflows. It also details where users can access this model and its key capabilities.

9/26/2025

This post introduces and elaborates on agentic AI, defining it as AI that can take independent action and execute multi-step plans. It highlights various GitLab blog posts and resources related to agentic AI, including the GitLab Duo Agent Platform, GitLab Duo with Amazon Q, and best practices for implementing AI agents. Specific technical advancements mentioned include custom agents, knowledge graph context, pipeline auto-fixing, AI-powered test generation, code review acceleration, and automated implementation of code review feedback.

9/26/2025

This post introduces and details the integration of the Model Context Protocol (MCP) into the GitLab Duo Agent Platform. It explains MCP as an open standard for connecting AI with data and tools, enabling secure two-way communication. GitLab now supports MCP as both a client (allowing Duo features to access external services) and a server (allowing external AI tools to access GitLab data). The post outlines the setup and configuration for MCP clients, including enabling feature previews and defining MCP servers in `mcp.json`. It provides example prompts and a demo project to illustrate how AI can access GitLab data like issues, merge requests, and Slack discussions to assist developers. The MCP server capabilities within GitLab are also detailed, including support for issues, merge requests, pipelines, work item notes, and search functionalities, with authentication handled via OAuth 2.0.

9/23/2025

Introduced the GitLab Duo AI Catalog for creating and sharing custom agents. Enhanced Agentic Chat with custom agent interaction, user model selection, improved formatting, and session management. Launched the GitLab Knowledge Graph (Beta) for codebase navigation and understanding. Introduced the Fix Failed Pipelines Flow for automated, business-aware pipeline maintenance. Made GitLab Duo Model Selection generally available and added GPT OSS and GPT-5 support for self-hosted deployments. Introduced GitLab Duo Context Exclusion for granular data protection. Added new tools to the GitLab MCP server.

9/17/2025

This post announces GitLab's recognition as a Leader in the 2025 Gartner Magic Quadrant for AI Code Assistants, highlighting the evolution of GitLab Duo from generative AI code assistance to a comprehensive AI strategy with the GitLab Duo Agent Platform. It details the platform's capabilities, including specialized agents, a Knowledge Graph, human + agent collaboration, and interoperability with external tools. The post emphasizes the secure-by-design approach, flexibility, and benefits for developers, engineering leaders, and IT organizations, positioning GitLab as a leader in AI-native development.

9/3/2025

Introduces the 'Issue to MR' flow within the GitLab Duo Agent Platform, which automates the process of converting a well-scoped issue into a draft merge request. This flow analyzes issue descriptions, creates a development plan, proposes code implementations, and links the MR to the issue. It details the prerequisites, steps for using the flow, and highlights benefits such as reduced development overhead, automated file location, and streamlined review processes. The post also elaborates on the broader benefits of the GitLab Duo Agent Platform, including its agentic orchestration capabilities, unified data model, built-in security, interoperability, and scalability.

9/2/2025

This post announces GitLab's achievement of ISO/IEC 42001 certification for AI governance. This certification applies to GitLab Duo, GitLab Duo Agent Platform, Code Suggestions, Vulnerability Explanation, and Test Generation. The certification demonstrates a commitment to responsible AI management, ethical implementation, and risk mitigation, aligning with global standards and evolving regulations.

8/21/2025

This post details the expansion of GitLab's AI orchestration capabilities in version 18.3. Key contributions include the introduction of a Knowledge Graph for real-time code indexing and faster, more contextual code searches. A new orchestration layer is added to the control plane, enabling agents to subscribe to SDLC events, a multi-agent flow engine, and exposing GitLab tools via MCP and standard protocols. The user experience is enhanced with native agents and agent flows across the SDLC, supporting async tasks, @ mentions, and custom agents. Two new automated development flows are introduced: 'Issue to MR Flow' for generating code from issues and 'Convert CI File Flow' for migrating CI/CD configurations (initially supporting Jenkins). Integrations with third-party AI models (Claude Code, Codex, Amazon Q, Google Gemini, opencode) are enabled via @ mentions in issues/MRs, requiring BYOK. The MCP server is introduced for universal AI integration with tools like Cursor. Agentic Chat support is extended to Visual Studio IDE. Expanded AI model support includes OpenAI GPT models and Anthropic's Claude 4 for self-hosted deployments.

8/12/2025

This post introduces and details the implementation of custom rules for GitLab Duo Agentic Chat. It explains how to create these rules in `.gitlab/duo/chat-rules.md` to enforce specific development standards, including version control (e.g., Java 8, Python 3, multi-platform C++), style guides (e.g., C goto anti-patterns, VueJS patterns, Ansible linter compliance), and DevSecOps automation (CI/CD security scanning, documentation standards). It provides practical examples, guidelines for rule development, and links to demonstration projects and merge requests, enabling users to personalize AI assistant behavior.

8/7/2025

This post introduces the implementation of GitLab Duo Self-Hosted models, enabling organizations to deploy AI capabilities within their own infrastructure. It details the architecture involving a Self-Managed GitLab instance, an AI Gateway, and an LLM backend (specifically AWS Bedrock). The guide provides step-by-step instructions for installation, configuration of the AI Gateway and GitLab instance, model access and configuration within AWS Bedrock, and assignment of models to specific GitLab Duo features. It also covers verification steps through health checks, feature testing, and log review, and discusses model selection and alternative deployment options.

8/5/2025

This post details the outcomes of the 'AI in Action Hackathon', highlighting three winning projects: Pipeline Doctor (AI for CI/CD root cause analysis), Agentic CICD (AI agents for automated DevSecOps), and Agent Anansi (an AI companion for GitLab workflows). It emphasizes the collaborative effort between GitLab, Google Cloud, and MongoDB, and reiterates the capabilities of the GitLab Duo Agent Platform, including its public beta status and integration with IDEs. The post also encourages community contributions and highlights the ongoing development towards GitLab becoming a premier agent orchestration platform.

7/31/2025

This post details GitLab's proactive approach to securing its AI-powered features, specifically the GitLab Duo Agent Platform, by collaborating with external security researchers. It highlights the identification and mitigation of prompt injection attacks, emphasizing transparent collaboration, rapid response to disclosures, and the importance of external research in addressing evolving AI security challenges. The post also mentions the upcoming public beta of the GitLab Duo Agent Platform and GitLab's commitment to ethical AI development.

7/24/2025

This post details how AI is changing the software supply chain security landscape by introducing new attack vectors and amplifying existing ones. It highlights AI-powered attacks that are more sophisticated and scalable, and the new risks introduced by the AI development supply chain, including model supply chain attacks, insecure AI-generated code, compromised AI toolchains, automated reconnaissance, and shadow AI. The post also discusses why organizations struggle with supply chain security due to misconceptions, skills shortages, misaligned incentives, and tool complexity, and outlines the true price of supply chain insecurity in terms of time, reputation, regulatory compliance, and operational disruption. It critiques current approaches that focus on massive scanning over effective protection and highlight collaboration breakdowns, proposing a path forward through integrated DevSecOps platforms and developer-native solutions.

7/21/2025

Introduces Security Inventory for centralized, portfolio-wide risk and scan coverage visibility, and Dependency Path visualization to illustrate the route of open-source vulnerabilities through the dependency chain. These features aim to improve software supply chain security by providing actionable insights for both security and development teams within the GitLab platform.

7/17/2025

This post announces the public beta of the GitLab Duo Agent Platform, a next-generation DevSecOps orchestration platform. It introduces specialized AI agents (e.g., Software Developer Agent, Security Analyst Agent) and agent 'Flows' for automating complex tasks. The platform leverages GitLab's knowledge graph for context-aware AI and aims to unlock asynchronous collaboration between developers and AI agents across the SDLC, starting with IDE integrations.

7/10/2025

This post introduces three best practices for building software in the era of LLMs: 'Never trust, always verify' (treating AI-generated code with scrutiny, similar to junior developer code, and using tools like GitLab Duo Code Review to enhance human judgment), 'Prompt for secure patterns' (emphasizing the importance of detailed, security-aware prompts, referencing OWASP best practices, and training developers in prompt engineering), and 'Scan everything, no exceptions' (advocating for continuous, integrated automated scanning like SAST, SCA, and Secret Detection to mitigate risks from increased code volume and AI generation). It positions GitLab's platform and AI features as integral to embedding security within the development workflow to balance speed and security.

7/7/2025

This post details the introduction and practical application of the GitLab Duo Agent Platform for generating comprehensive documentation of gRPC communication flows within a Golang project. It highlights the agent's ability to intelligently gather context, analyze code (specifically `internal/services/runner/runner.go`), identify relevant files, and understand codebase structure. The post emphasizes the collaborative refinement process where the agent asks clarifying questions about desired detail levels (e.g., including error handling). It showcases the execution of various action types (RunCommand, RunGitCommand, RunReadFile, RunWriteFile, RunEditFile, RunHTTPRequest, ListDirectory, FindFiles, Grep, NewCheckpoint, RunMCPTool) and the generation of a detailed Mermaid sequence diagram illustrating the bidirectional communication, payload structures, integration points, and lifecycle management between the Duo Workflow Executor and the Duo Workflow Service.

6/30/2025

This post details the development and application of an automated detection system for software supply chain attacks. The system combines automated typosquatting detection, semantic code analysis, and AI-assisted initial screening to proactively identify malicious dependencies. It was used to detect a typosquatting attack on a MongoDB Go module, including the technical details of the multi-layered malicious payload and the rapid redeployment of a second malicious module. The post also outlines GitLab's approach to proactive dependency monitoring and provides recommendations for staying ahead of supply chain threats, including indicators of compromise.

6/25/2025

Introduces GitLab Duo Model Selection, a new capability enabling organizations to select and configure specific LLMs for use with GitLab Duo features. This feature allows for organization-level configuration and per-feature model control, enhancing governance and compliance for enterprise users.

6/24/2025

Introduces the GitLab Duo Agent Platform, an extension of Duo Workflow, enabling parallel collaboration with multiple specialized AI agents across the software development lifecycle. This platform allows agents to perform tasks like research, bug fixing, code review, and vulnerability investigation, leveraging full project context (issues, MRs, CI job logs, etc.). It supports interoperability with various developer tools and language models, including self-hosted options. A key feature is the agent approval workflow, which provides human oversight before agents make changes. The platform is designed for community customization and contribution, with beta testing ongoing and general availability anticipated.

6/2/2025

This post details the integration of GitLab Duo, an AI-powered development assistant, across the DevSecOps lifecycle. It highlights specific AI tasks such as automatic task description generation, issue summarization, code review, optimization suggestions, test generation, security vulnerability detection, and CI pipeline troubleshooting. A key technical aspect discussed is the secure deployment of LLMs through GitLab Duo Self-Hosted, enabling organizations to maintain data privacy and compliance within their own infrastructure.

5/29/2025

Introduces GitLab Duo Agentic Chat, an evolution of AI-native development assistance. Agentic Chat transforms chat from conversational AI to an action-taking experience that breaks down complex problems into discrete tasks. It can autonomously determine information needs, execute operations to gather data from multiple sources, formulate comprehensive responses, and create/modify files, all while keeping the human developer in the loop. It is built on the Duo Workflow architecture, comprising agents and tools for specific tasks. Use cases include project onboarding, understanding tasks, implementing solutions, and verifying merge requests. It is currently experimental in VS Code for users with Duo Core, Duo Pro, or Duo Enterprise add-ons.

5/29/2025

This post introduces the fundamental concepts of Large Language Models (LLMs), explaining their training processes (supervised and unsupervised learning), neural network architectures (transformers), and predictive text generation capabilities. It then details their applications within a DevSecOps context, covering code generation, documentation, incident management, CI/CD pipelines, and security/compliance. The benefits of LLMs such as increased productivity, improved code quality and security, and accelerated development lifecycles are also discussed.

5/22/2025

This post details the technical process of using GitLab Duo Workflow to refactor a JavaScript file (`workflow.js`) to TypeScript (`workflow.ts`). It outlines the AI's analysis of the codebase, identification of typing needs (store state, workflow objects, pagination, checkpoints, GraphQL responses), and the creation of a multi-step plan. The execution involved creating interfaces, adding type annotations to store state, getters, and actions, and updating imports. The post highlights Duo Workflow's task-oriented programming, contextual codebase understanding, and step-by-step execution with visibility as key advancements.

5/6/2025

Introduces GitLab Duo Workflow, an agentic AI solution for VS Code that automates complex development tasks by understanding project structure and making coordinated changes across the codebase. Demonstrates its capability in implementing new lint rules and updating multiple files to comply, transforming a multi-hour manual process into minutes. Highlights benefits like consistency, time savings, reduced context switching, and human-in-the-loop review. Outlines future applications in feature implementation, bug fixing, refactoring, and documentation generation.

4/17/2025

This post announces the general availability of GitLab Duo with Amazon Q, which embeds Amazon Q's agents directly into GitLab's DevSecOps platform for AWS customers. It details how this integration provides AI-powered capabilities across the software development lifecycle, including code completion, explanation, generation, chat, and vulnerability analysis and resolution. The post outlines benefits such as a unified developer experience, end-to-end SDLC coverage, and enterprise-grade security guardrails, and lists five initial use cases: feature development acceleration, legacy application modernization, quality assurance enhancement, code review optimization, and vulnerability remediation.

4/3/2025

This post details the technical implementation and benefits of the HackerOne-GitLab integration. It explains how vulnerabilities found on HackerOne are automatically converted into GitLab issues, with bi-directional syncing of comments, state changes, and other relevant data. It also outlines the configuration steps, including OAuth 2.0 setup and field mapping. Additionally, it highlights GitLab's native security scanning capabilities (SAST, DAST, etc.) and how they integrate into the CI/CD pipeline to further secure applications.

4/1/2025

This post details the technical implementation of custom PII detection rulesets for GitLab Secret Detection. It outlines the steps to configure `.gitlab-ci.yml` to include the Secret Detection template, create a custom TOML file (`rules/pii-data-extension.toml`) with regex patterns for PII (e.g., passport numbers, phone numbers, email addresses) and an allowlist, and extend the default configuration using `.gitlab/secret-detection-ruleset.toml`. It also demonstrates how to test these rules with a sample merge request and highlights the use of GitLab Duo Chat for generating regex patterns, providing specific prompts and expected outputs. Best practices for PII detection and integration with other GitLab security features like Secret Push Protection and Merge Request Approval Policies are also discussed.

3/12/2025

This post introduces the integration of CVSS, KEV, and EPSS frameworks into GitLab's vulnerability management capabilities. It details how these frameworks can be combined to effectively prioritize security risks across dependency and container image vulnerabilities. The post explains each framework's purpose and how to leverage them within GitLab's UI, including adding security scanners to pipelines, viewing vulnerability insights, and changing vulnerability statuses. It also highlights the use of GitLab Duo's AI capabilities for vulnerability explanation and auto-resolution.

3/4/2025

Introduces the GitLab AI Security Framework, designed to help security leaders address challenges in AI adoption, including responsibility and control uncertainty, risk assessment evolution, data protection complexities, and compliance navigation. The framework details GitLab's privacy-first implementation of AI for GitLab Duo and how AI vendors are validated. It also includes a responsibility matrix and highlights how GitLab capabilities like prompt guardrails can mitigate AI-specific security risks.

2/27/2025

This post announces the general availability of GitLab Duo Self-Hosted for Code Suggestions and Chat, an optional capability for self-managed customers with a GitLab Duo Enterprise subscription. It details the supported LLMs (Mistral, Anthropic Claude 3.5 Sonnet, OpenAI GPT) and deployment options (on-premises with vLLM, AWS Bedrock, Azure OpenAI). The post emphasizes the ability to maintain control over sensitive data and intellectual property by deploying within customer-controlled environments, including air-gapped scenarios. It highlights the AI abstraction layer that simplifies LLM integration and the benefits for regulated industries.

2/17/2025

This post announces the sunsetting of the certificate-based Kubernetes integration on GitLab.com in May 2026, extending the timeline from a previous announcement. It details the recommended alternative, the GitLab Agent for Kubernetes, highlighting its enhanced security, reliability, and advanced features. The post provides a comprehensive guide for users to assess their impact, migrate their CI/CD integrations, Auto DevOps configurations, and GitLab-managed clusters to the agent-based approach. It also explains how to manage cloud provider clusters directly after the deprecation and offers a phased migration strategy.

1/30/2025

This post details GitLab's implementation of prompt guardrails for AI features. It explains the concept of prompt guardrails as structured safeguards combining instructions, filters, and context boundaries. GitLab uses tags like `<selected_code>` and `<log>` to define context boundaries, and tools like Gitleaks to scan inputs for secrets before transmission to the AI. The post also discusses different approaches to prompt guardrails, including system-level filters, model instruction tuning, and sidecar/gateway solutions, and explains GitLab's hybrid approach. Lessons learned emphasize balancing restrictiveness with usability, continuous updates, and transparent communication about risk reduction rather than absolute security guarantees.

1/29/2025

This post introduces and details the implementation of GitLab's Operational Container Scanning feature. It explains how to configure and deploy this capability, which allows for container vulnerability scans against running containers in a Kubernetes environment. The post covers prerequisites, deploying a sample application, connecting a Kubernetes cluster via the GitLab Agent for Kubernetes, and configuring scan cadence and target namespaces through the `config.yaml` file. It also describes how scan results are reported back to the GitLab UI for auditing and tracking vulnerabilities.

1/27/2025

This post introduces three new AI-powered features: GitLab Duo Vulnerability Resolution, which automates the creation of merge requests to fix detected vulnerabilities; Model Registry, a centralized hub for data science and development teams to collaborate on AI models, integrating with MLflow; and Secret Push Protection, which proactively detects and blocks sensitive information (secrets) from being pushed to source code repositories. It also mentions a partnership with AWS for GitLab Duo with Amazon Q.

1/7/2025

Introduced Static Reachability Analysis to identify exploitable vulnerabilities in open source components, a Known Exploited Vulnerabilities (KEV) Indicator to highlight actively exploited vulnerabilities, and the Exploit Prediction Scoring System (EPSS) to predict the likelihood of exploitation. These enhancements aim to reduce triage times and accelerate remediation cycles for AppSec teams. Future work includes integrating Rezilion's technology for automated fix merge requests, enriching package metadata with OpenSSF scorecard ratings, and improving license detection.

12/3/2024

This post details how the GitLab Security division is using GitLab Duo to enhance security reporting. It outlines specific GitLab Duo features like Root Cause Analysis, Vulnerability Explanation, Vulnerability Resolution, Code Explanation, Test Generation, Refactor Code, and Fix Code. Practical use cases are demonstrated with prompts and outputs for generating incident reports and performing root cause analysis. The post also touches on on-demand updates for executive leadership and provides guidance on getting started with GitLab Duo for security.

12/3/2024

This post introduces and details GitLab Duo's Root Cause Analysis (RCA) feature for CI/CD pipeline failures. It explains the common causes of pipeline failures, the challenges of manual troubleshooting, and how RCA leverages generative AI to analyze logs and stack traces, identify the root cause, suggest fixes, and provide code suggestions. It also highlights the privacy-first approach and the ability to ask follow-up questions within the IDE.

10/28/2024

This post details the introduction of secret push protection, AI-powered Quick Chat for contextual security insights within the editor, and static reachability analysis for Python/Java to reduce security noise. It also highlights advancements in Advanced SAST with cross-file/function scanning and taint analysis.

7/15/2024

This post details the practical application of GitLab Duo Vulnerability Explanation and Vulnerability Resolution. It demonstrates how AI can be used to analyze and explain vulnerabilities, provide suggested fixes, generate alternative solutions, assist in adding tests for vulnerabilities, and refactor code. It also shows how AI can generate merge requests with proposed fixes for vulnerabilities like OS Command Injection, weak hash functions (MD5), and timing attacks against file operations. The post highlights the integration of these AI features within the GitLab UI and IDE, and their role in the broader DevSecOps lifecycle.

6/24/2024

Introduces Secret Push Protection as a generally available feature for GitLab Ultimate and GitLab Dedicated customers. This feature blocks commits containing high-confidence secrets before they are pushed to GitLab, complementing existing Pipeline Secret Detection. It details the risks of leaked secrets, how the feature works by checking commit content, and recommends a layered approach. Configuration steps for enabling the feature per project are provided, along with options to skip push protection and add exclusions. Audit events for various actions related to Secret Push Protection and exclusions are also introduced.

6/5/2024

GitLab 17 introduces enhanced SAST analyzer coverage for more languages, improved API Security Testing, advanced vulnerability tracking for Secret Detection, and Dependency Scanning support for Android. The acquisition of Oxeye is highlighted for improving SAST accuracy. GitLab Duo's AI capabilities are expanded to assist with memory-safe code conversions, code explanation/suggestions, and vulnerability resolution, with new AI Impact Analytics to measure ROI. Enhanced governance controls and permissions customizations for custom roles are introduced to reinforce the principle of least privilege.

5/21/2024

This post details a 7-step process for enhancing application security without slowing developer velocity. It outlines how to assess the current state of development, enable security scans (starting with secrets detection and dependency scanning), evaluate scan results for false positives and noise, adjust scan analyzers and rules (e.g., customizing SAST and secret detection rulesets), prioritize initial vulnerabilities for remediation, enable scans in development pipelines (running scans in parallel with CI jobs and using scheduled scans for slower ones like DAST), and provide developer visibility through the merge request widget and security training integrations. The process emphasizes an iterative approach, starting with pilot teams and expanding gradually, while fostering collaboration between development, security, and operations.

5/20/2024

This post details the extensive internal dogfooding of GitLab Duo's AI features across various roles within GitLab, showcasing real-world use cases for Code Suggestions and Chat. It highlights how these features are used to streamline code reviews, summarize merge requests and comment threads, create documentation and release notes, optimize documentation navigation, draft and refine OKRs, improve hiring communication, summarize incidents, generate boilerplate CI/CD files, generate Python scripts, create test source code, streamline research, and understand external codebases. The post emphasizes the benefits of automation, reduced documentation time, higher quality code, and streamlined administrative tasks, reinforcing the ongoing evolution and integration of AI within the DevSecOps platform.

5/1/2024

This post details the migration of GitHub Advanced Security features to GitLab Ultimate, focusing on SAST and Secret Scanning. It provides a feature-by-feature comparison and migration steps, including adding SAST and Secret Detection templates to `.gitlab-ci.yml` and customizing SAST scanners and rulesets. It highlights GitLab Ultimate's broader security capabilities beyond GitHub Advanced Security.

4/4/2024

This post discusses how AI-powered features in GitLab Duo extend beyond code creation to impact the entire SDLC, including vulnerability remediation and root cause analysis for CI/CD pipeline failures. It also highlights the availability of single-tenancy solutions like GitLab Dedicated for regulated industries and the importance of a platform approach to DevSecOps.

3/19/2024

This post introduces and details the 'user_access' feature of the GitLab agent for Kubernetes. It explains how the agent can impersonate GitLab users and map their group and project roles to Kubernetes RBAC, enabling simplified and secure access management for Kubernetes clusters. The post provides example configurations for both development and production environments, demonstrating how to restrict access based on user roles within GitLab groups.

1/29/2024

This post announces GitLab Duo Pro, an add-on package for Ultimate and Premium customers that bundles Code Suggestions, GitLab Duo Chat (Beta), and organizational controls. It highlights enhancements to Code Suggestions, including Code Generation and Repository X-ray, and emphasizes the role of GitLab Duo Chat as a foundational technology for accessing broader AI features like vulnerability explanations and merge request summaries. The post reiterates GitLab's commitment to data privacy, stating that customer code is not used for training.

1/17/2024

This post announces GitLab Duo Pro, an add-on package for Ultimate and Premium customers that bundles GitLab Duo Code Suggestions and introduces GitLab Duo Chat (in Beta). It also highlights organizational controls for managing AI usage and emphasizes a privacy-first approach where customer code is not used for AI training. The post details the features of Code Suggestions (code completion and generation) and Chat (explaining code, generating tests, writing code interactively). It also provides pricing information and availability across different deployment types.

11/14/2023

This post introduces and details the configuration of GitLab's browser-based DAST analyzer, which is designed for scanning JavaScript-heavy applications like single-page web applications. It covers general considerations such as using test environments, managing job timeouts, and specific configuration options for websites requiring authentication. This includes setting environment variables for website URLs, authentication credentials, login page URLs, and field selectors for username, password, and submit buttons. It also highlights troubleshooting tools like the authentication report and analyzer logs.

11/9/2023

This post details how AI-powered GitLab Duo Code Suggestions can be leveraged for a guided experience in learning the Python programming language with a practical hands-on example, including setting up the development environment, writing basic Python code, and exploring file I/O, flow control, functions, and dependency management.

11/9/2023

Introduces GitLab Duo Chat, a new AI-assisted capability available in Beta. Chat integrates into the Web IDE and VS Code extension, offering code explanations, test generation, and code creation. It also assists with issue and epic management by summarizing issues, turning comments into descriptions, and distilling information from epics. Chat is powered by Anthropic Claude-2 and Vertex AI Codey LLMs, with a commitment to not using proprietary code or inputs for training data. It will be included in the Ultimate tier starting with GitLab 16.6.

8/10/2023

This post details how to leverage GitLab Duo Code Suggestions for learning the Rust programming language. It covers setting up the development environment (VS Code, Rust toolchain), using Cargo for project structure, configuring a CI/CD pipeline for Rust projects, and provides examples of learning Rust concepts like variables, flow control, functions, and testing with AI assistance. It also highlights the use of GitLab Remote Development workspaces as an alternative to local environments.

7/27/2023

This post details the integration of GitLab Flow with GitLab Duo's AI capabilities. It specifically highlights how AI features like Issue description generation, Discussion summary, Merge request summary, Code Merge request template population, Code explanation, Suggested reviewers, Code review summary, Test generation, and Chat can be applied to enhance the planning and merge request stages of GitLab Flow. The post explains the technical benefits of each AI feature in improving developer efficiency, code quality, and workflow automation.

7/25/2023

This post announces the beta availability of GitLab plugins for JetBrains IDEs and Neovim, extending GitLab Duo Code Suggestions to these development environments. It details how to install and configure these plugins, provides visual examples of the code suggestion functionality, and directs users to feedback issues for reporting bugs and suggestions. It also mentions ongoing work on a GitLab Language Server for Code Suggestions to standardize IDE extensions and enable wider adoption.

7/20/2023

This post introduces and details several AI-assisted features within GitLab Duo, focusing on enhancing developer productivity and code review processes. It explains the underlying technology of generative AI and LLMs, and then elaborates on specific capabilities: Code Suggestions, Code Explanations, AI-generated tests for code changes, Vulnerability Explanations, and Value Stream Forecasting. For code reviews, it covers Merge Request Change Summaries (using `/summarize_diff`), Issue Comment Summaries, Suggested Reviewers, and Merge Request Review Summaries. It also mentions upcoming experiments like GitLab Duo Chat and AI-generated merge request descriptions.

6/30/2023

This post announces GitLab 16, highlighting the introduction of GitLab Duo, a suite of enterprise-grade AI capabilities for DevSecOps workflows. It details specific AI features like Code Suggestions, Explain this Code, Explain this Vulnerability, and Summarize Issue Comments. The post also emphasizes the partnership with Google Cloud for private and secure AI, and the enhancements in Value Stream Analytics and Product Analytics for observability and feedback.

6/29/2023

This post announces the beta release of the GitLab for Visual Studio extension, which integrates GitLab Duo code suggestions. It details the setup and usage of the extension, and mentions ongoing development for JetBrains IDEs, Neovim, and a GitLab Language Server to standardize and accelerate IDE extension development. The post reiterates the broader goal of infusing AI/ML capabilities across the DevSecOps lifecycle.

6/29/2023

This post details the integration of SecureFlag's vulnerability remediation training into GitLab's DevSecOps platform. When GitLab security scanners detect vulnerabilities, SecureFlag provides a link to a knowledge base article with code examples and hands-on labs for developers to practice remediation skills in a live environment. This integration aims to streamline the vulnerability remediation process, decrease security retests, and improve overall project security by enabling a proactive, developer-led security approach.

6/26/2023

This post introduces and provides a quickstart guide for GitLab Remote Development workspaces, a new beta feature in GitLab 16.0. It details the prerequisites (BYOK8s cluster, GitLab agent for Kubernetes), the use of DevFiles for environment configuration, and the step-by-step process for creating and using a workspace. It covers working within the integrated Web IDE (VS Code), installing dependencies, starting applications, making code changes, and committing them back to the repository. The post also links to further documentation and a demo.

6/22/2023

This post introduces GitLab Duo, a suite of AI capabilities integrated into the DevSecOps Platform. It details specific features like Code Suggestions, Explain this Code, Explain this Vulnerability, generation of epic/issue/task descriptions, summarization of issue comments, and a chat interface for AI interactions. It emphasizes the customer-centric and privacy-first approach, stating that customer IP is secured and data is not used for training without consent. The post also highlights the goal of achieving 10x workflow efficiency and mentions upcoming capabilities.

6/15/2023

This post announces the availability of GitLab Code Suggestions (Beta) for self-managed instances, starting with GitLab 16.1. It details how self-managed users can authenticate their IDE to GitLab.com infrastructure to receive code suggestions. The post also explains the data usage and privacy aspects, emphasizing that customer code is not persisted or used for training. It outlines the process for enabling the feature on self-managed instances and mentions the required IDE extensions.

6/1/2023

This post details the experimental extension of GitLab Code Suggestions to Visual Studio, JetBrains IDEs, and Neovim. It describes the development of specific extensions and a language server to enable code suggestions in these environments, highlighting the rapid prototyping efforts by engineers Michael Eddington, Dinesh Bolkensteyn, Julian Thome, and Michael Henriksen. It also mentions ongoing iteration and plans to expand support to other IDEs and editors.

5/25/2023

This post details the specific use cases and benefits of GitLab's Code Suggestions feature, including importing packages, completing functions, filling boilerplate code, building data frames, and generating unit tests. It highlights the expansion of language support to 13 languages and the availability of Code Suggestions for free on GitLab.com during beta. It also emphasizes the importance of analyzing AI-generated code with code quality and security scanning tools.

5/16/2023

Introduces Code Suggestions as a beta feature available to all GitLab.com users for free. Extends language support to 13 languages. Emphasizes privacy by ensuring customer code is not used for training. Details IDE support (VS Code, WebIDE, JetBrains, Visual Studio) and plans for self-managed instances. Highlights beta status, potential limitations, and feedback mechanisms.

5/11/2023

This post introduces the Machine Learning Model Experiments feature in GitLab, which integrates with MLFlow to allow users to track ML model versions and their metadata directly within GitLab. This feature acts as an MLFlow backend, simplifying the process for data scientists by requiring minimal changes to their existing MLFlow client code. Key functionalities include logging experiments and runs (called 'candidates' in GitLab) without requiring users to set up or manage their own MLFlow servers. Access control is managed through GitLab projects, and users can manage and explore logged experiments directly in the GitLab UI. Data scientists can also download experiment data as CSV files. This feature is available to all GitLab users and is part of GitLab's broader effort to manage the entire ML model lifecycle.

5/9/2023

This post details the implementation of Web API Fuzz Testing within GitLab, focusing on the technical challenges and solutions encountered. Key contributions include: auto-generating OpenAPI specifications from Grape annotations by adapting the `grape-swagger` gem to handle edge cases like file parameters (WorkhorseFile) and wildcard segments; performance tuning strategies for large APIs, including using multi-CPU runners, excluding slow operations, splitting tests into multiple jobs, and dynamically generating child pipelines; and the process of triaging fuzzing findings, leveraging Postman collections and the GitLab Development Kit for debugging.

5/4/2023

Introduced an experimental chatbot feature that answers how-to questions about the GitLab product. The chatbot overlays the GitLab UI, providing immediate answers and links to documentation, aiming to reduce context switching and improve user efficiency.

5/3/2023

This post details the introduction and live demo of several AI-assisted features within GitLab's DevSecOps platform, including Code Suggestions, Suggested Reviewers, Summarize MR Changes, Summarize My MR Review, Explain This Vulnerability, Generate Tests in MRs, Explain This Code, Issue Comment Summaries, GitLab Chat, and Value Stream Forecasting. It also highlights the partnership with Google Cloud for generative AI capabilities and emphasizes a customer-centric, privacy-first approach.

5/2/2023

Introduced an experimental AI-assisted vulnerability recommendation feature that uses large language models to explain vulnerabilities in context, demonstrate exploitation, and provide example fixes. This feature leverages Google AI and is initially focused on SAST vulnerabilities. It was developed by the Vulnerability Research team and built by engineering.

4/24/2023

This post introduces a series tracking GitLab's integration of AI/ML into its DevSecOps platform. It highlights specific experiments and features including AI-assisted code suggestions, SQL generation, code explanation, summarization of issue comments and merge request changes, test generation for code changes, vulnerability explanation, a chatbot for documentation, MLFlow integration, and expanded Code Suggestions to more IDEs and self-managed instances. It also mentions GitLab Duo as the suite of AI capabilities and the availability of GPU-enabled runners for ModelOps and HPC workloads.

4/13/2023

This post details an experiment in using generative AI LLMs to summarize issue comments within GitLab. It describes the technical approach involving prompt engineering to guide LLM output and the engineering challenge of chunking long comment threads for accurate summarization. The post also mentions future iterations to optimize prompts and extend this functionality to epics and merge requests.

4/6/2023

This post details an experiment with an 'Explain this Code' feature, a rapid prototype developed by engineers. It leverages AI models to provide natural language explanations of source code directly within GitLab's repository source code file viewer. The feature allows users to highlight code selections and receive explanations, aiming to help developers quickly understand new projects, unfamiliar languages, or complex historical code. The post also mentions potential extensions to merge requests and snippets, and reiterates the ongoing effort to infuse AI/ML capabilities across the software development lifecycle.

3/30/2023

This post details an experiment within GitLab's Product Analytics group where AI-generated SQL queries are created from natural language parsing. This aims to simplify the process of populating Product Analytics dashboards with interactive graphs and charts, making data analysis more accessible and efficient for users without deep SQL expertise.

3/23/2023

This post introduces AI-assisted code suggestions as a new capability within GitLab's DevSecOps platform. It details how ML techniques are used to assess code and provide recommendations for syntax, organization, and effectiveness. The post highlights benefits such as decreased errors, increased accuracy, a rise in productivity, improved collaboration, and faster rollout and iteration. It also outlines GitLab's competitive advantages in this area and lists critical jobs the feature aims to address, including code optimization, automatic bug detection and patching, smart debugging, continuous integration and deployment facilitation, predictive maintenance, programming in natural language, test case generation and automation, and smart code completion. The feature is currently in closed beta for select Ultimate customers.

3/16/2023

This post introduces the concept of AI/ML revolutionizing DevSecOps platforms, highlighting potential benefits like faster deployments, improved security, enhanced quality assurance, intelligent monitoring, and predictive analytics. It details current AI/ML features in GitLab, including Suggested Reviewers (which suggests reviewers for merge requests) and GitLab Code Suggestions (which provides code suggestions in IDEs). It also emphasizes GitLab's commitment to protecting customer source code and outlines future plans for AI capabilities such as Workflow Automation, Intelligent Code Security, and enhanced MLOps/DataOps features like notebook support, GPU runners, and a Model Registry.

12/15/2022

This post details an experiment by the Developer Relations team using ChatGPT to assist with two specific development tasks within GitLab: refactoring duplicate Vue components into a shared component and refactoring widget state tests using `it.each`. The experiment highlights the capabilities and limitations of current AI tools in assisting with code generation and refactoring, including the need for manual review and testing of AI-generated code.

12/7/2022

This post details the adoption of the open-source `glab` project to form the foundation of GitLab's native CLI experience. It describes how `glab` integrates GitLab functionality into the terminal, allowing developers to perform tasks such as reviewing issues, creating branches and merge requests, checking pipeline status, and approving/merging work without leaving the command line. The post also highlights the integration with 1Password Shell Plugins for secure authentication and discusses the transition process of migrating the project to GitLab's infrastructure, including adapting GitHub Actions to GitLab CI and converting documentation back to Markdown. It also mentions the security review conducted by the application security team and the update of distribution methods to point to the new repository. The post emphasizes community contributions and provides installation instructions for macOS, Windows, and Linux.

11/16/2022

This post draws parallels between the evolution of DevOps and the current challenges in adopting AI/ML. It highlights the need for a similar integrated approach to overcome silos, improve repeatability, and foster collaboration in AI/ML projects. It introduces the concepts of DataOps (for data acquisition and transformation) and MLOps (for experimentation, training, and deployment of models) as foundational stages for leveraging AI/ML for business use cases. The post advocates for learning from the DevOps journey to build intentional processes and tools that enable efficient data handling and model deployment, ultimately driving business value.

9/15/2022

This post highlights the increasing adoption of AI/ML in DevOps practices, citing survey data showing significant growth in AI/ML usage for code review, software testing, and ModelOps. It discusses the benefits of AI in automating tedious tasks within DevOps, particularly in software testing and code review, and acknowledges the learning curve associated with AI/ML adoption.

6/2/2022

This post details the integration of UnReview's machine learning capabilities into GitLab's code review process, focusing on the development of 'Suggested Reviewers'. It highlights the technical challenges and learnings in building an MLOps pipeline within GitLab CI, introducing Python to the tech stack, and addressing biases in recommendation algorithms. The post also outlines future directions for AI-powered features, including Intelligent Code Security.

6/1/2022

This post details the technical implementation of a real-time hashtag tracker using Python, the Tweepy library, and the Twitter API. It explains API authentication using OAuth1UserHandler, handling of extended tweets via `status.extended_tweet["full_text"]`, and the use of environmental variables with `.env` and `python-dotenv` for secure credential management. The code demonstrates creating a custom stream class (`LogTweets`) inheriting from `tweepy.Stream` and implementing the `on_status` method to process incoming tweets. It also covers filtering tweets by hashtags using `stream.filter(track=hashtags)`.

5/9/2022

This post details how GitLab integrates Application Security Testing (AST) into the CI pipeline, providing developers with immediate feedback on vulnerabilities upon committing code. It highlights partnerships with Kontra and Secure Code Warrior for vulnerability education and explains how granular compliance pipeline policies can be enforced.

3/31/2022

Introduces the integration of Kontra Application Security's interactive training modules within GitLab's Merge Request and pipeline experiences. This allows developers to access security training directly when vulnerabilities are reported by automated security scans, providing context and actionable steps for remediation. The training content is dynamically linked based on vulnerability identifiers (CVE, CWE) and the programming language/framework detected. This feature is available for GitLab Ultimate customers.

3/24/2022

This post details the integration of GitLab's vulnerability scanner results with Secure Code Warrior. When GitLab scanners detect security issues, the vulnerability details are augmented with links to Secure Code Warrior's platform. This provides developers with contextual, bite-sized coding challenges and remediation guidance for specific vulnerabilities, aiming to improve secure coding practices and accelerate vulnerability resolution.

3/2/2022

This post introduces the integration of Tabnine's AI-powered code completion technology with GitLab repositories. It outlines the process for Tabnine for Teams users to connect to their GitLab repositories to build, validate, and upload a private team model. This enables personalized code suggestions based on the team's codified best practices, aiming to improve developer productivity, accelerate feature release cadence, and reduce technical debt.

2/14/2022

This post provides a general overview of how machine learning can assist in various aspects of the DevOps lifecycle, including test data analysis, help-desk alert management, security monitoring, requirement gathering, developer assistance, automated testing, complexity reduction, provisioning, and quality improvement. It highlights the growing importance of AI/ML skills for developers and the existence of ML-powered code completion tools. While it mentions GitLab's survey and ModelOps plans, the core content is a broad exploration of ML in DevOps rather than a specific technical implementation within GitLab.

1/21/2022

This post introduces the ModelOps stage within GitLab, which aims to bring data science capabilities into the DevOps platform. It outlines three primary groups within ModelOps: DataOps (data processing, cleaning, and preparation), MLOps (building, training, and deploying AI/ML models), and AI Assisted (enriching existing GitLab features with ML for automation). The post details the user personas and challenges associated with each group and emphasizes the goal of enabling collaboration between data science and DevOps teams to build and deploy data-rich modern applications.

11/8/2021

This post details a workflow for integrating external ML experiment tracking tools (Comet) with GitLab CI/CD. It demonstrates how to set up separate GitLab projects for ML model training and application code, and how to use CI/CD pipelines to automate model training, evaluation, publishing of metrics to merge requests, and registering approved models to Comet's Model Registry. It also outlines the pipeline configuration for these steps, including the use of Python images, artifact storage, and manual deployment triggers.

9/8/2021

This post details the development of a framework for writing and continuously testing vulnerability detection rules for SAST, specifically for migrating from existing SAST tools to Semgrep. The framework addresses rule management by using a central Git repository for rules and test cases, rule testing through automated gap analysis comparing original analyzers with Semgrep rule-sets, and analyzer replacement by ensuring parity between the old and new tools. This enables a more efficient and maintainable SAST process.

8/19/2021

This post introduces Spamcheck, a new anti-spam engine for GitLab. It details the development process, including the creation of a spam testbed for passive data extraction and analysis, prototyping with a tech stack involving gRPC, Protobuf, and GoLang, and an iterative deployment strategy to production. The engine was initially deployed in monitoring mode and progressively expanded to all public projects on GitLab.com. The post highlights data-driven improvements, including performance comparisons with Akismet, and mentions ongoing work to reduce false positives by improving ML models and automating training processes.

10/28/2020

This post discusses the future of AI in software development, highlighting its gradual integration into code as a complementary tool rather than a replacement for human developers. It references industry trends, developer interest in AI/ML skills, and expert opinions on AI's role in testing, code suggestion, and potentially code generation. The post also touches upon the need for precise artifacts and patterns as AI capabilities advance.

10/22/2020

This post details the acquisition of Fuzzit by GitLab and its integration into GitLab's DevSecOps platform. Fuzzit, a fuzzing-as-a-service product, brings continuous coverage-guided fuzzing capabilities to GitLab, aiming to improve software security by lowering the barrier to entry for developers. The post highlights the technological fit and the vision of advancing fuzzing adoption within GitLab's single DevSecOps application.

12/18/2019

This post announces an integration between GitLab and Dotscience to create a complete DevOps & MLOps platform. It highlights the ability to use GitLab's merge request workflow for AI/ML projects involving Jupyter Notebooks, data, parameters, and metrics. It also mentions customizing Docker images for ML model deployment by implementing the Docker build step within a GitLab repo and custom Dockerfile/build pipeline.

8/12/2019

This post explains the concepts of Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) and how they fit into developer workflows. It details how GitLab integrates SAST to automatically generate summaries of fixes and unresolved vulnerabilities after code commits and before merging, and how DAST runs live attacks on review apps during QA. The post emphasizes the importance of using both SAST and DAST together for comprehensive security testing.

7/19/2019

The License Compliance feature within the Secure stage will now default to using Python 3 for license scanning, aligning with the end-of-life for Python 2. Users on self-managed instances still using Python 2 can set the `LM_PYTHON_VERSION` CI variable to '2' to maintain compatibility. GitLab.com users will see this change automatically. This change is a proactive measure due to Python 2.7 reaching its end of life in January 2020.

6/20/2019

This post announces the integration of security features (SAST, DAST, dependency scanning, container scanning) into the CI/CD pipeline, along with Auto Remediation, Security Dashboards, and Security Approvals. It also highlights the expansion of operations capabilities with Feature Flags, Operations Dashboard, and Incident Management. The release of GitLab 12.0 includes Visual Review Tools, project dependency list, and Merge Trains, all contributing to a single application for the DevSecOps lifecycle.

4/30/2019

This post details the integration of the Gemnasium team into GitLab's Secure Team following an acquisition. It highlights the team's contribution to developing dependency scanning capabilities and their involvement in the auto-remediation feature, which leverages GitLab's CI/CD pipelines to automate vulnerability fixes. The post also touches on the team's transition from a standalone product to an integrated part of GitLab's broader security offerings.

4/30/2019

This post introduces the concept of embedding security into the development workflow to accelerate software delivery. It highlights how Static Application Security Testing (SAST) within GitLab allows developers to review and address vulnerabilities directly in their working environment, reducing friction between development and security teams. The post emphasizes the benefits of this approach, such as faster release times and improved collaboration, by framing security as a critical workflow component rather than a roadblock.

4/12/2019

This post details GitLab's inclusion as a challenger in Forrester's Software Composition Analysis report, highlighting its integrated approach to application security testing and software composition analysis, with a focus on remediation, policy management, and reporting. It also mentions updates since the evaluation, including improvements to the security dashboard, additional languages for SAST scanning, and secrets detection, and the ability to automatically create merge requests for vulnerability remediation.

4/10/2019

This post details the application of GitLab's existing SAST, DAST, and Container Scanning features for identifying vulnerabilities in source code, running web applications, and Docker images, respectively. It also introduces the upcoming Secret Detection feature for identifying sensitive information leaks. The post outlines future plans for Interactive Application Security Testing (IAST) and fuzzing capabilities, emphasizing their role in enhancing application security and risk assessment, particularly for healthcare applications subject to HIPAA.

9/14/2018

This post introduces the Security Dashboard, a new feature shipped in version 11.1, designed to help security professionals view vulnerabilities across a project. It highlights the integration of SAST, DAST, container scanning, dependency scanning, and license management as built-in security products within GitLab, aiming to enable proactive security and reduce context-switching for developers.