Unclassified // For public releaseWordle · Official security dossier

Looking for more in-depth information on this company—or any company worldwide? Visit companyforensics.org.

Automatic security check · Public OSINT only

Company website

https://about.gitlab.com/

62%

Caution advised

Mixed public signals. Review missing headers, domain age, and independent reputation before trusting it. Passive OSINT only · inventKeys=false.

High concern
Elevated risk
Caution advised
Trusted — verify
Strong protections

gitlab.com security check

Name: gitlab.com security check — Caution advised | Wordle
Item: gitlab.com
Rating: 62
Author: Wordle

Public OSINT valuation for gitlab.com: grade C (62/100). Title signal “GitLab - Speed with control for agentic software engineering”. 1 security headers present, 7 commonly expected headers missing. This is a defensive surface review — not a penetration test.

/100

Grade C

Company website · Services · Social

Company website

https://about.gitlab.com/

Services & products

GitLab Duo Agent Platform https://about.gitlab.com/gitlab-duo-agent-platform/
CI/CD https://about.gitlab.com/solutions/continuous-integration/
Source Code Management https://about.gitlab.com/solutions/source-code-management/
Agile Delivery https://about.gitlab.com/solutions/agile-delivery/
Application Security Testing https://about.gitlab.com/solutions/application-security-testing/
Governance & Compliance https://about.gitlab.com/solutions/software-compliance/
Supply Chain Security https://about.gitlab.com/solutions/supply-chain/
Visibility & Measurement https://about.gitlab.com/solutions/visibility-measurement/
Explore the Platform https://about.gitlab.com/platform/
Startups https://about.gitlab.com/solutions/startups/
Financial Services https://about.gitlab.com/solutions/finance/
Public Sector https://about.gitlab.com/solutions/public-sector/
Telecommunications https://about.gitlab.com/solutions/telecommunications/
Automotive https://about.gitlab.com/solutions/automotive/
Education https://about.gitlab.com/solutions/education/
Aerospace https://about.gitlab.com/solutions/aerospace/
View all Solutions https://about.gitlab.com/solutions/
Pricing https://about.gitlab.com/pricing/
Services https://about.gitlab.com/services/
What’s new in GitLab Stay updated with our latest features and improvements. Rea https://about.gitlab.com/whats-new/
03 Traceability you can audit Every agent action shows up in the audit trail. No https://about.gitlab.com/solutions/compliance/
Why Premium? https://about.gitlab.com/pricing/premium/
Why Ultimate? https://about.gitlab.com/pricing/ultimate/
GitOps https://about.gitlab.com/solutions/gitops/

Social & LinkedIn

LinkedIn https://www.linkedin.com/company/gitlab-com
Facebook https://www.facebook.com/gitlab
X (Twitter) https://twitter.com/gitlab
YouTube https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg

Links are extracted from public crawl HTML only. We never invent profiles or product pages.

Research engines · Complete scan

This complete report delivers web-check-class passive modules to customers — DNS, TLS, headers, mail auth, archives, CT logs and more — researched in the spirit of Lissy93/web-check. Port scan, traceroute and Shodan stay off by policy. Run a live check on the security-check tool for the full interactive dashboard.

Connect this report to your website

Add a free badge that links visitors to this official Wordle security report. You get referral traffic and a backlink; customers can verify the dossier.

Open this public report

Badge HTML (copy into your footer or About page)

<!-- Wordle Official Security Report badge -->
<a href="https://wordle.review/gitlab.com/#security-report" title="Wordle Official Security Report for gitlab.com" rel="noopener"><img src="https://wordle.review/security-check/assets/official-security-report-seal-v20261102w.png" alt="Wordle Official Security Report · score 62/100" width="88" height="88" loading="lazy" /></a>

Trustpilot · Glassdoor

Trustpilot

—

Official Trustpilot signals only — never scraped. Shown when a public Business Unit profile exists (inventKeys=false).

Open Trustpilot for gitlab.com ↗

Glassdoor

—

No Glassdoor scrape. Search the official employer directory when no linked profile is present.

Search Glassdoor ↗

Hosting · IP · map

IP172.65.251.78
ASNAS13335
HostingCloudflare, Inc.
GeoSan Francisco, California, United States

Query
gitlab.comRequested hostname
IP
172.65.251.78San Francisco, California, United States
ASN
AS13335Cloudflare, Inc.
Trace
ICMP traceroute off by policyPassive IP path only · inventKeys=false

Sources: DNS · ipwho.is geolocation · OpenStreetMap embed. Soft-fail if geo blocked · inventKeys=false.

Domain registration · business age

RegistrarGandi SAS

Registered2004-01-15

Domain age22 years 9 mo

Registry / location.com registry (RDAP)

Public RDAP / WHOIS only. Soft-fail when WHOIS is blocked — we never invent registrar or age.

How we scored gitlab.com

Positive signals

TLS handshake OK (TLSv1.3).
HTTP Strict Transport Security is present.
DNS resolves publicly (A/AAAA).
security.txt found (coordinated disclosure signal).
robots.txt is publicly available.
RDAP domain record available (gitlab.com).

Risk signals

Content-Security-Policy not observed.
X-Content-Type-Options missing.

Findings

TLS handshake OK (TLSv1.3).
HTTP Strict Transport Security is present.
Content-Security-Policy not observed.
X-Content-Type-Options missing.
DNS resolves publicly (A/AAAA).
security.txt found (coordinated disclosure signal).
robots.txt is publicly available.
RDAP domain record available (gitlab.com).
Final HTTP status 200 at https://about.gitlab.com/.

Technical details

DNS

resolved

A: 172.65.251.78
AAAA: 2606:4700:90:0:f22e:fbec:5bed:a9b9
PTR: —
error: —

TLS / certificate

version: TLSv1.3
cipher: TLS_AES_256_GCM_SHA384
issuer: Sectigo Limited
notAfter: May 12 23:59:59 2027 GMT
SAN sample: gitlab.com, auth.gitlab.com, customers.gitlab.com, email.customers.gitlab.com, gprd.gitlab.com, www.gitlab.com
error: —

HTTP & security headers

1 present

finalUrl: https://about.gitlab.com/
status: 200
server: cloudflare
x-powered-by: —
present: strict-transport-security
missing: content-security-policy, x-content-type-options, x-frame-options, referrer-policy, permissions-policy, cross-origin-opener-policy, cross-origin-resource-policy
cookie Secure: False
cookie HttpOnly: False

Tech fingerprint (public)

passive

title: GitLab - Speed with control for agentic software engineering
generator: —
tech: Vue, Google Analytics
script hosts: cdn.cookielaw.org, geolocation.onetrust.com, cdn.optimizely.com, cdn.bizible.com, munchkin.marketo.net, x
description: Teams and agents ship trusted software faster with GitLab, the intelligent orchestration platform with context and governance for the entire software lifecycle.

Company presence (crawl links)

extracted

companyWebsite: https://about.gitlab.com/
serviceLinks: GitLab Duo Agent Platform: https://about.gitlab.com/gitlab-duo-agent-platform/, CI/CD: https://about.gitlab.com/solutions/continuous-integration/, Source Code Management: https://about.gitlab.com/solutions/source-code-management/, Agile Delivery: https://about.gitlab.com/solutions/agile-delivery/, Application Security Testing: https://about.gitlab.com/solutions/application-security-testing/, Governance & Compliance: https://about.gitlab.com/solutions/software-compliance/, Supply Chain Security: https://about.gitlab.com/solutions/supply-chain/, Visibility & Measurement: https://about.gitlab.com/solutions/visibility-measurement/, Explore the Platform: https://about.gitlab.com/platform/, Startups: https://about.gitlab.com/solutions/startups/, Financial Services: https://about.gitlab.com/solutions/finance/, Public Sector: https://about.gitlab.com/solutions/public-sector/
socialLinks: LinkedIn: https://www.linkedin.com/company/gitlab-com, Facebook: https://www.facebook.com/gitlab, X (Twitter): https://twitter.com/gitlab, YouTube: https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg

RDAP / registration

rdap

domain: gitlab.com
registrar: Gandi SAS
created: 2004-01-15T19:47:28Z
expires: 2027-01-15T19:47:28Z
nameservers: diva.ns.cloudflare.com, jermaine.ns.cloudflare.com
status: client transfer prohibited
error: —

Public well-known

passive

/.well-known/security.txt: HTTP 200 · found
/robots.txt: HTTP 200 · found
/security.txt: HTTP 200 · found

Analyzed 2026-11-02T16:12:31Z WORDLE passive OSINT (DNS/TLS/HTTP/RDAP/well-known) — no exploits More recent checks

looking for more information about this company or any company in the world? -Contact http://companyforensics.org

This service was brought to you by http://dotsynergygroup.com