GitLab Completes Integration of Fuzzing Solutions
November 23, 2020

GitLab completed integration of Peach Tech, a security software firm specializing in protocol fuzz testing and dynamic application security testing (DAST) API testing, and Fuzzit, a continuous fuzz testing solution providing coverage-guided testing.

Both acquired in June of this year, the full integration of Peach Tech and Fuzzit into GitLab provides users with capabilities such as continuous fuzzing, coverage guided fuzz testing, and web API fuzz testing, with results provided directly to the developer while they are still iterating on their code. Traditionally, fuzzing can be difficult and hard to get results from. By bringing Peach Tech and Fuzzit into GitLab, developers and security teams alike can easily integrate fuzz testing into their workflows to take advantage of its powerful benefits in a meaningful and actionable way.

“No longer can security be viewed as a separate step outside of DevOps processes,” said David DeSanto, Director, Product for the Secure and Protect stages at GitLab. “With the completed integration of these fuzzing technologies, GitLab is making it easier for development and security teams to incorporate both coverage-guided and API fuzz testing techniques much earlier in the software development lifecycle. Developers can employ DevSecOps best practices with ease as well as understand what security vulnerabilities are being created at code commit. This enables close collaboration with their security counterparts to reduce their organization’s overall security risk.”

“A common paint point for security teams is how to integrate automated security testing into the DevOps CI pipeline, ensuring that project teams follow a prescribed set of testing and that security policies are adhered to,” said Cindy Blake, GitLab. “GitLab’s Ultimate tier and Gold tier simplify this effort. Templates can be set up and applied to projects in a consistent manner with exceptions documented.”

With completed implementation of Peach Tech and Fuzzit technologies, GitLab Secure customers have an even more comprehensive and fully-integrated security solution, from Auto DevOps deployment of security testing to vulnerability management and remediation. Fuzzing and all other GitLab scans (DAST, SAST, Dependency scanning, Container scanning, Secrets Detection, and License Compliance) are available within the CI pipeline out-of-the-box, requiring no complicated APIs and no Plug-ins. This fully integrated approach allows GitLab to innovate further with the acquired fuzzing IP, with plans to add replay capabilities to DAST to easily recreate how the vulnerability occurs and to correlate fuzz test findings to improve the fidelity of GitLab’s already leading SAST capabilities.

Fuzz testing specific future plans include advanced configuration options for users who want to customize their fuzz tests and expanding fuzz testing to address additional use cases, beyond only web apps and APIs.

Share this

Industry News

September 27, 2022

DevOps Institute will host SKILup Festival in Singapore on November 15, 2022.

September 27, 2022

Delinea announced the latest release of DevOps Secrets Vault, its high-speed vault for DevOps and DevSecOps teams.

September 27, 2022

The Apptainer community announced version 1.1.0 of the popular container system for secure, high-performance computing (HPC). Improvements in the new version provide a smaller attack surface for production deployments while offering features that improve and simplify the user experience.

September 26, 2022

Secure Code Warrior unveiled Coding Labs, a new mechanism that allows developers to more easily move from learning to applying secure coding knowledge, leading to fewer vulnerabilities in code.

September 26, 2022

ActiveState announced the availability of the ActiveState Artifact Repository.

September 26, 2022

Split Software announced the availability of its Feature Data Platform in the Microsoft Azure Marketplace.

September 22, 2022

Katalon announced the launch of the Katalon Platform, a modern and comprehensive software quality management platform that enables teams of any size to easily and efficiently test, launch, and optimize apps, products, and software.

September 22, 2022

StackHawk announced its Deeper API Security Test Coverage release.

September 21, 2022

Platform9 announced the launch of its latest open source project, Arlon.

September 21, 2022

Redpanda Data announced Redpanda Console.

September 21, 2022

mabl announced its availability as a private listing on Google Cloud Marketplace.

September 21, 2022

Zesty announced a $75 million Series B funding round led by B Capital and Series A investor Sapphire Ventures.

September 20, 2022

Opsera, the Continuous Orchestration platform for DevOps, announced a free trial of its no-code Salesforce Release Management platform for fast and secure Salesforce releases.

September 20, 2022

Sysdig announced ToDo and Remediation Guru.

September 20, 2022

AutoRABIT announced CodeScan Shield.