Do we like GitLab?
Developer platform for writing, securing and shipping software; open-core, all-remote, US-incorporated and Nasdaq-listed.
Our score: 6 out of 10. A useful, open-core product with a decent remote-work record. A run of maximum-severity security flaws and the 2026 layoffs stop us calling it a clear yes.
GitLab sells a platform where software teams store code, test it and ship it. It has been all-remote since it started. Bill Staples, formerly CEO of New Relic, took over as CEO in December 2024. Co-founder Sid Sijbrandij stepped back to executive chair to focus on his health.
Security is the big worry. In the autumn of 2026 GitLab patched several critical flaws. They included a CVSS 10.0 path-traversal bug that CISA added to its Known Exploited Vulnerabilities list, and a 10.0 code-execution bug fixed on October 21. Cybersecurity Dive noted that hackers have used at least five GitLab flaws in attacks since 2021, per CISA's catalog.
To be fair, GitLab's own hosted service was already patched when these flaws went public, and the Oct 21 bug was reported through its HackerOne bug bounty. When Red Hat's self-run GitLab server was breached in 2025, GitLab said its own systems weren't affected and that self-hosting customers must apply patches themselves.
In May and June 2026 GitLab announced its 'Act 2' restructuring. TechCrunch reported about 350 jobs (14%) cut, 22 countries exited and management layers flattened, in the same week it reported revenue up 23%. Staples said the cuts weren't a downturn response. For a company famous for borderless remote hiring, that stings.
Our score is 6. It is a solid, widely used product with no big scandals or fines in what we found. The repeated critical security holes and the layoffs hold it back from a clear yes.