GitLab, the open source code collaboration software tool that allows developers to code, test and deploy together, has acquired Peach Tech, a security software firm specializing in protocol fuzz testing and dynamic application security testing (DAST) API testing, as well as Fuzzit, a continuous fuzz testing solution providing coverage-guided testing. Financial terms of the two acquisitions were not disclosed.
These acquisitions will add “fully mature” testing solutions including protocol fuzzing, API fuzzing, DAST API testing, and coverage-guided fuzz testing to GitLab’s offerings. It allows GitLab to expand its DevSecOps offering to include both coverage-guided and behavioral fuzz testing techniques.
Fuzz Testing, sometimes referred to as fuzzing, is the process of providing bad inputs to a program to find bugs, crashes, and faults that could be exploited. Successful automation of application security testing combined with a ‘shift left’ DevSecOps approach would empower development and security teams to test early and often, as well as collaborate in managing and lowering the organization’s overall security risk.
The addition of both coverage-guided and behavioral fuzz testing into the DevSecOps toolchain helps organizations find vulnerabilities and weaknesses traditional application security testing and quality assurance (QA) testing techniques often miss as these findings may not be directly tied to a known vulnerability (e.g. CVE IDs).
“We believe GitLab provides best-in-class tools for the complete DevOps lifecycle on a single platform,” said Sid Sijbrandij, CEO of GitLab. “Bringing the fuzzing technologies of Peach Tech and Fuzzit into GitLab’s security solutions will give our users an even more robust and thorough application security testing experience while enabling them to shift security left. This simultaneously simplifies their workflows and creates collaboration between development, security, and operations teams.”
DevOps Lifecycle
GitLab is a DevOps platform built from the ground up as a single application for all stages of the DevOps lifecycle enabling Product, Development, QA, Security, and Operations teams to work concurrently on the same project.
“Providing GitLab users with the best security testing tools is key to GitLab’s DevSecOps core mission,” said Michael Eddington, founder and CEO of Peach Tech. “The integration of Peach Tech’s technologies expands GitLab’s shift security left capabilities making the future of security and DevSecOps a reality today for all GitLab users.”
With the Peach Tech and Fuzzit technologies being incorporated into GitLab’s DevSecOps platform, GitLab would be able to further accelerate its application security testing roadmap to bring developers a native and seamless experience for discovering, fixing, and remediating security vulnerabilities and weaknesses.
“Fully integrating Fuzzit will make GitLab the first security solution that provides continuous coverage-guided fuzz testing natively within the CI/CD pipeline,” said Yevgeny Pats, founder and CEO of Fuzzit. “Fuzzit’s support for multiple coverage-guided fuzzers combined with its crash analysis and correlation technology will add an important capability to the DevSecOps for GitLab users.”
About GitLab’s founders
Sid Sibrandij, from the Netherlands, together with Ukrainian Dmitriy Zaporozhets, started building this open source platform in 2011, on which software programmers can simultaneously write, check and roll out codes. With success, as the company has been attracting millions of investments. It includes investments from film and venture capitalist Ashton Kutcher as well as tech giant Google. Last year, Gitlab was valued at $1.1 billion.
