GitLab

1. Native DevSecOps Integration: With the ASPM functionality natively embedded in the Ultimate tier, you can tie it directly into your CI/CD pipelines, merge request workflows, and the scanning tools that come along with it (SAST, DAST, dependency scanning) as well as some excellent dashboards with reduced context switching. 2. Comprehensive scan coverage & release gates: The ability to have multiple scanners, both those provided by GitLab and ones I choose to bring in, and to have all of those give guardrails like blocking merge results if certain findings are detected all within one pipeline is a breath of coverage that is hard to find. 3. Security Dashboards, Visibility & Governance Features: The security dashboards that are visible at project and group level, as well as the overall vulnerability reports, compliance center, all provide the ability to see your security posture across multiple projects which is a must for any organization that is held to a compliance or governance standard.

What I like most about GitLab is its all in one platform that integrates code management, issue tracking, and CI/CD pipelines seamlessly. This helps our team efficiently validate releases, track bugs, and deploy updates without switching between multiple tools. The mearge requiest process provides excellent transparency in code change, making testing and verification much smoother. Its automation features save time and reduce manual effort, ensuring faster, more reliable releases and better collaboration between QA and developers teams.

Best part about gitlab is how much it consolidates into one platform. Instead of jumping between tools for code reviews, security scans and project tracking everything is right there in a single interface. Transparency in Gitlab is really good.

1. Noise and Duplicate Findings: Correlating findings across projects can be difficult if you don't have dedicated analysts, especially in the early onboarding phases when the scanners are being properly tuned. Duplicate findings can also be a problem when multiple branches of the same project are being scanned. 2. Customization & Filtering Limitations: When issues are filtered and scored there are too many limitations, specifically with refining dashboards as well as grouping vulnerabilities. 3. Lack of Contextual Prioritization: Unlike other ASPM tools, GitLab doesn't do the best job of explaining and understanding why a finding is prioritized and the actual exploitability of a vulnerability is minimal.

GitLab is a powerfull but has some challenges. It can slow down when handling large repositories or multiple pipelines, impacting testing speed. The interface is complex for new users, making navigation harder initially. Also notification for merge requests or pipeline updates are sometimes delayed, affecting timely coordination during release cycle.

Some features feel a bit heavy or overwhelming, especially for teams that don't use the full GitLab ecosystem. UI gets cluttred at times, and navigating certain settings. Upgrades on self hosted version also require careful planning as a single version jump can occasionally break older pipeline configurations. None of these are deal breakers but they do slow down things at times.