How GitLab handles security bugs (and why it matters)

This post details GitLab's unique approach to handling security bugs, emphasizing transparency and public disclosure. It explains the role of CVEs, the CVSS scoring system, and GitLab's internal CVSS calculator. The post highlights why GitLab has many CVEs due to its commitment to transparency and open-core model, contrasting it with other SaaS platforms. It details the process of assigning CVEs to all vulnerabilities, publicly disclosing them after patches, and the use of automated bots to ensure public disclosure. The post also touches on the importance of supply chain transparency and encourages asking vendors about their security fix and disclosure processes. It mentions the combined patch and security releases delivered twice a month and the HackerOne bug bounty program.