How GitLab tracks vulnerabilities through refactors and reformatting ↗

Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.

Sandboxing AI Coding Agents

AI coding agents are useful, but unguarded ones cause real damage. agentbox is a Docker-based sandbox that constrains what they can reach.

Introducing GitLab Advanced Vulnerability Tracking ↗

Learn how this security feature improves the efficiency of vulnerability management by reducing futile auditing time (includes data from a new study).

Snake programmieren mit Lua und Löve ↗

SourceWarp: Make data-driven, agile DevSecOps decisions ↗

How the SourceWarp approach and tool help make informed, agile decisions for CI/CD tools and DevSecOps platforms at GitLab.

A Google Summer of Code project: creating a benchmarking framework for SAST ↗

Our 2022 Google Summer of Code project helped to create a benchmarking framework for SAST.

Lingo: A Go micro language framework for building Domain Specific Languages ↗

Design, build and integrate your own Domain Specific Language with Lingo.

A KISS (keep it short and simple) MagpieBridge server implementation to build custom IDE integrations based on LSP ↗

A KISS (keep it short and simple) MagpieBridge server implementation.

Introducing a community-driven advisory database for third-party software dependencies ↗

The advisory data can be readily adopted, adapted, and exchanged. Learn more here.

How to tailor SAST and Secret Detection to your application context with custom rulesets ↗

SemVer versioning: how we handled it with linear interval arithmetic ↗

SemVer versioning made it difficult to automate processing. We turned to linear interval arithmetic to come up with a unified, language-agnostic semantic versioning approach.

How to write and continuously test vulnerability detection rules for SAST ↗

Interns with the Google Summer of Code helped GitLab transition from our old SAST tools to Semgrep.

Custom REPL in Clojure

A read-eval-print loop (REPL) is an interactive environment that reacts to user-input. REPL-driven development is a very interactive programming style with a short feedback cycle enabling …