GitLab Completes Integration of Fuzzing Solutions
November 23, 2020

GitLab completed integration of Peach Tech, a security software firm specializing in protocol fuzz testing and dynamic application security testing (DAST) API testing, and Fuzzit, a continuous fuzz testing solution providing coverage-guided testing.

Both acquired in June of this year, the full integration of Peach Tech and Fuzzit into GitLab provides users with capabilities such as continuous fuzzing, coverage guided fuzz testing, and web API fuzz testing, with results provided directly to the developer while they are still iterating on their code. Traditionally, fuzzing can be difficult and hard to get results from. By bringing Peach Tech and Fuzzit into GitLab, developers and security teams alike can easily integrate fuzz testing into their workflows to take advantage of its powerful benefits in a meaningful and actionable way.

“No longer can security be viewed as a separate step outside of DevOps processes,” said David DeSanto, Director, Product for the Secure and Protect stages at GitLab. “With the completed integration of these fuzzing technologies, GitLab is making it easier for development and security teams to incorporate both coverage-guided and API fuzz testing techniques much earlier in the software development lifecycle. Developers can employ DevSecOps best practices with ease as well as understand what security vulnerabilities are being created at code commit. This enables close collaboration with their security counterparts to reduce their organization’s overall security risk.”

“A common paint point for security teams is how to integrate automated security testing into the DevOps CI pipeline, ensuring that project teams follow a prescribed set of testing and that security policies are adhered to,” said Cindy Blake, GitLab. “GitLab’s Ultimate tier and Gold tier simplify this effort. Templates can be set up and applied to projects in a consistent manner with exceptions documented.”

With completed implementation of Peach Tech and Fuzzit technologies, GitLab Secure customers have an even more comprehensive and fully-integrated security solution, from Auto DevOps deployment of security testing to vulnerability management and remediation. Fuzzing and all other GitLab scans (DAST, SAST, Dependency scanning, Container scanning, Secrets Detection, and License Compliance) are available within the CI pipeline out-of-the-box, requiring no complicated APIs and no Plug-ins. This fully integrated approach allows GitLab to innovate further with the acquired fuzzing IP, with plans to add replay capabilities to DAST to easily recreate how the vulnerability occurs and to correlate fuzz test findings to improve the fidelity of GitLab’s already leading SAST capabilities.

Fuzz testing specific future plans include advanced configuration options for users who want to customize their fuzz tests and expanding fuzz testing to address additional use cases, beyond only web apps and APIs.

Share this

Industry News

January 25, 2021

Progress announced the new release of Progress Kendo UI, a complete collection of JavaScript UI components.

January 25, 2021

CloudNatix announced the close of a $4.5M Seed round financing led by DNX Ventures, with the participation from a new investor Cota Capital and existing investors: Incubate Fund, Vela Partners and 468 Capital.

January 25, 2021

Quali announced $54 million in new funding, co-led by Greenfield Partners and JVP.

January 21, 2021

Platform9 released Platform9 Release 5.0, with a number of new features to provide operational efficiencies for its freedom, growth, and enterprise managed Kubernetes products.

January 21, 2021

Infragistics announced the release of Infragistics Ultimate 20.2, a complete UX and UI solution for  design and development teams  which is fully compatible with .NET 5, Microsoft’s latest  release of .NET development platform.

January 21, 2021

Couchbase Cloud is now available on Microsoft Azure.

January 20, 2021

Hitachi Vantara announced the availability of Hitachi Kubernetes Service, enabling customers to consistently and securely deploy, manage, monitor, and govern Kubernetes clusters across major cloud providers and on premises.

January 20, 2021

Internal announced the launch of an enterprise-ready app development platform for internal tools.

January 20, 2021

StackPulse announced a $20 million Series A led by GGV Capital.

January 19, 2021

GitLab announced GitLab Ultimate for IBM Cloud Paks, which is designed to help streamline team collaboration and increase team productivity with a comprehensive, easy-to-use DevOps platform.

January 19, 2021

Fugue announced new capabilities for bringing public cloud container resources into compliance and ensuring the continuous security of container runtime configurations.

January 19, 2021

Rookout announced new functionality that empowers software developers to debug other people’s code.

January 14, 2021

Oracle is making its popular APEX low-code development platform available as a managed cloud service that developers can use to build data-driven enterprise applications quickly and easily.

January 14, 2021

Parasoft announced its C/C++test update to support IAR Systems' build tools for Linux for Arm.

January 14, 2021

Harness raised $115 million in financing, reaching a valuation of $1.7 billion in just three years after launching from stealth.