Automatic security check · Public OSINT only
Company website
gitlab.com security check
Public OSINT valuation for gitlab.com: grade C (62/100). Title signal “GitLab - Speed with control for agentic software engineering”. 1 security headers present, 7 commonly expected headers missing. This is a defensive surface review — not a penetration test.
62
/100
Grade C
- High concern
- Elevated risk
- Caution advised
- Trusted — verify
- Strong protections
Company website · Services · Social
Company website
Services & products
- GitLab Duo Agent Platform
- CI/CD
- Source Code Management
- Agile Delivery
- Application Security Testing
- Governance & Compliance
- Supply Chain Security
- Visibility & Measurement
- Explore the Platform
- Startups
- Financial Services
- Public Sector
- Telecommunications
- Automotive
- Education
- Aerospace
- View all Solutions
- Pricing
- Services
- What’s new in GitLab Stay updated with our latest features and improvements. Rea
- 03 Traceability you can audit Every agent action shows up in the audit trail. No
- Why Premium?
- Why Ultimate?
- GitOps
Social & LinkedIn
Links are extracted from public crawl HTML only. We never invent profiles or product pages.
How we scored gitlab.com
Positive signals
- TLS handshake OK (TLSv1.3).
- HTTP Strict Transport Security is present.
- DNS resolves publicly (A/AAAA).
- security.txt found (coordinated disclosure signal).
- robots.txt is publicly available.
- RDAP domain record available (gitlab.com).
Risk signals
- Content-Security-Policy not observed.
- X-Content-Type-Options missing.
Findings
- TLS handshake OK (TLSv1.3).
- HTTP Strict Transport Security is present.
- Content-Security-Policy not observed.
- X-Content-Type-Options missing.
- DNS resolves publicly (A/AAAA).
- security.txt found (coordinated disclosure signal).
- robots.txt is publicly available.
- RDAP domain record available (gitlab.com).
- Final HTTP status 200 at https://about.gitlab.com/.
Technical details
DNS
resolved- A
- 172.65.251.78
- AAAA
- 2606:4700:90:0:f22e:fbec:5bed:a9b9
- PTR
- —
- error
- —
TLS / certificate
ok- version
- TLSv1.3
- cipher
- TLS_AES_256_GCM_SHA384
- issuer
- Sectigo Limited
- notAfter
- May 12 23:59:59 2027 GMT
- SAN sample
- gitlab.com, auth.gitlab.com, customers.gitlab.com, email.customers.gitlab.com, gprd.gitlab.com, www.gitlab.com
- error
- —
HTTP & security headers
1 present- finalUrl
- https://about.gitlab.com/
- status
- 200
- server
- cloudflare
- x-powered-by
- —
- present
- strict-transport-security
- missing
- content-security-policy, x-content-type-options, x-frame-options, referrer-policy, permissions-policy, cross-origin-opener-policy, cross-origin-resource-policy
- cookie Secure
- False
- cookie HttpOnly
- False
Tech fingerprint (public)
passive- title
- GitLab - Speed with control for agentic software engineering
- generator
- —
- tech
- Vue, Google Analytics
- script hosts
- cdn.cookielaw.org, geolocation.onetrust.com, cdn.optimizely.com, cdn.bizible.com, munchkin.marketo.net, x
- description
- Teams and agents ship trusted software faster with GitLab, the intelligent orchestration platform with context and governance for the entire software lifecycle.
RDAP / registration
rdap- domain
- gitlab.com
- registrar
- Gandi SAS
- created
- 2004-01-15T19:47:28Z
- expires
- 2027-01-15T19:47:28Z
- nameservers
- diva.ns.cloudflare.com, jermaine.ns.cloudflare.com
- status
- client transfer prohibited
- error
- —
Public well-known
passive- /.well-known/security.txt
- HTTP 200 · found
- /robots.txt
- HTTP 200 · found
- /security.txt
- HTTP 200 · found