How GitLab uses Third Party Security Rating to Build Customer Confidence
Dec 18, 2020Meghan Maneval

Summary
This post details how GitLab partnered with BitSight to improve its third-party security rating. It describes the challenges of inaccurate ratings due to segmented environments and dynamic infrastructure, and the steps taken to address these issues, including validating the digital footprint, creating environment tags, and implementing a process for identifying, managing, and remediating findings. The post also outlines the criteria used to select a suitable third-party rating platform.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting