GitLab

Your refresher on how automation worked its way into AppSec.

Security scanners do their job well. The challenge is that not every finding they surface requires action. Test code, vendored dependencies, and known false positives create noise that slows triage and buries the vulnerabilities that actually matter. GitLab's auto-dismiss vulnerability policies let security teams codify those decisions once and apply them automatically, so the focus stays on what's real. Swipe through for 5 findings that are worth automating. Full tutorial in the comments.

AI-generated code just made governance more important. GitLab embeds policy enforcement, security scanning, and auditability directly into the workflows where software is built and shipped. Read more. Link in comments.

Every organization deploys differently. Your pipelines, your environments, your rules. Custom AI agents in GitLab Duo Agent Platform can learn exactly how your team works and automate the tedious parts of your deployment process, from understanding application components and dependencies to executing every step of your build and deploy workflows. Want to see it in action? Catch Cesar Saavedra at Google Cloud Next, booth #2423, April 22-24.

💡The hard truth: Automated checks can handle more work, but human judgment doesn't scale the same way. In fact, AI-generated code increases the burden of verifying plausible correctness. GitLab Field CTO Brian Wald, shares more on the hidden tax on every AI-generated merge request in TheNewStack. Link in comments ⬇️

For 12 days last month, four widely used open-source tools were compromised in supply chain attacks. The entry point every time was the build pipeline. The targets included an AI model gateway and an AI coding assistant whose source code was fully exposed through a single packaging mistake. GitLab Pipeline Execution Policies can enforce mandatory security checks across every pipeline in your organization. We've open-sourced three ready-to-deploy policies that address the exact patterns from March 2026. They cover artifact hygiene validation, dependency integrity checks, and tool verification. Read how centralized policy enforcement can stop supply chain attacks: https://lnkd.in/gbbuggNJ

Broken CI/CD pipeline blocking your deployment? GitLab Duo Agent Platform can debug and fix it for you. In this clip, watch Duo analyze failing pipeline logs, identify the root cause (missing Kubernetes namespace), and automatically open a merge request with the fix. This is what autonomous AI agents look like in the software development lifecycle. No context-switching. No manual log parsing. Just intelligent problem-solving that gets your team unblocked faster.

The April Monday Merge covers GitLab 18.10, expanded agentic AI access, our spot in the Claude Marketplace, and big moments from the community, including Canada Life's 48-hour AI sprint. Global Hackathon registration is open April 16-23. Watch Fatima's update and check out the latest edition of the newsletter. https://lnkd.in/ghQ2YfhD

The April Monday Merge is packed. GitLab 18.10 brings agentic AI deeper into the software lifecycle. GitLab Duo Agent Platform is now in the Claude Marketplace. Our global Hackathon runs April 16-23. And Canada Life reduced code review time by 40% and compliance violations by 80% in a 2-day AI sprint. Catch up on everything happening this month.

"We need to customize" is the most common reason teams choose to build their own AI platform. But customization and governance don't have to be in conflict.