Last year we signed the Secure by Design pledge - here's our progress

This post details GitLab's progress on the CISA Secure by Design Pledge over the past year. Key updates include: a phased rollout of MFA by Default, reducing default passwords by using randomly generated ones and deleting password files post-restart for some install methods, improving SAST rule coverage to address broader vulnerability classes, detailing the maintenance policy and upgrade guidance for security patches, maintaining a bug bounty program and security.txt, publishing CVEs with CWE and CPE fields, and open-sourcing GUARD and TLDR threat detection frameworks. It also mentions the introduction of compromised password detection for GitLab.com native authentication.