Source code hosting market share 2026: what the data really measures

There is no single market share figure for source code hosting in 2026. The broadest cross-platform measure, Stack Overflow's 2025 Developer Survey, found 81.1% of respondents used GitHub, 35.6% used GitLab and 16.6% used Azure DevOps, in a multi-select question. SEC filings and platform counts measure revenue, customers and accounts instead, so they cannot be combined into one share.

Anyone who quotes "GitHub has X% of the Git hosting market" is quoting one of those survey numbers out of context, or making a number up. This post builds the picture from four kinds of data that each count something different: developer surveys, platform self-reported accounts and repositories, revenue and paying customers from SEC filings, and CI tool usage as an indirect signal of where code lives. Every figure carries its date and source, disagreements are shown, and the last part explains what this means for applying one security policy across several platforms.

Key takeaways

• Stack Overflow's 2026 results are out, but without a code hosting question. They were published on 6 October 2026 (30,903 responses, 169 countries). The pages we read do not ask about GitHub, GitLab, Bitbucket or Azure DevOps, so 2025 remains the latest survey data here.
• Survey shares add up to well over 100%. GitHub, GitLab and Azure DevOps sum to 133.3% of Stack Overflow 2025 respondents, because many developers use more than one platform.
• GitHub's own totals disagree. Octoverse 2025 (28 October 2025) reports "180 million-plus developers," meaning accounts. Microsoft's 2025 proxy (mailed about 21 October 2025) says 150 million users.
• Most of GitLab's revenue is self-managed. In the quarter ended 31 July 2026, SaaS was $97.6 million of $286.3 million (34.1%), per GitLab's 10-Q.
• Bitbucket and Azure DevOps have no standalone public numbers. Atlassian reports revenue by deployment option, not product, and Microsoft does not break out Azure DevOps. Bitbucket Data Center is excluded from Atlassian's 28 March 2029 Data Center end of life.
• CI data points the same way. JetBrains' State of CI/CD Tools 2026 (598 respondents) shows GitHub Actions in 47% of organisations and GitLab CI in 32%.
• The practical conclusion is multi-platform. Security tooling, inventory and policy have to work across every SCM an organisation runs.

Has Stack Overflow published its 2026 survey results?

Yes, on 6 October 2026. The results site lists 30,903 responses from 169 countries. The announcement describes a "more editorial approach this year," highlighting selected data points, and says the full dataset will be released later on GitHub.

We read the 2026 results home page and the 2026 Technology page. Their sections cover work, AI, technology for AI, community and knowledge. None asks which code hosting or collaboration platforms respondents use. The closest item on the Technology page asks about categories such as knowledge management and enterprise search platforms (16,241 respondents), not named products.

So the 2025 survey is the latest Stack Overflow data on platform usage. If the full 2026 dataset contains the question, the 2025 figures become the prior year. We do not mix the two years anywhere in this post.

What the Stack Overflow 2025 survey says about GitHub, GitLab, Azure DevOps and Bitbucket

The question that produced the numbers

The figures usually quoted as "Git hosting market share" come from a 2025 question labelled "Code documentation and collaboration tools." It asked which collaborative work management and/or code documentation tools respondents had used regularly over the past year. It was multi-select.

That wording matters. It is not a question about where your code is hosted, which is why Jira and Confluence appear in the same list. A respondent who reads open source code on GitHub while their employer's code lives elsewhere can reasonably tick GitHub.

According to the methodology page, the survey ran from 29 May to 23 June 2025 and used 49,009 responses from 177 countries after about 15,000 were excluded. Recruitment was mainly through Stack Overflow's own channels, so engaged Stack Overflow users are over-represented. The collaboration tools question had 30,065 respondents, including 23,683 professional developers.

Table 1 (ranked): Stack Overflow 2025 collaboration tools, by share of all respondents

This table orders the tools by the measured percentage. It ranks a survey number, not the products.

Source: Stack Overflow 2025 Developer Survey, Technology.

Professionals report slightly lower GitHub use than the full sample and slightly higher GitLab and Azure DevOps use. Students and hobbyists lift the GitHub number a little; workplaces lift the others.

Bitbucket. The section we read had no Bitbucket row for either group. A planning search snippet put Bitbucket at 0.1% in a documentation tools row, which looks like a different question or a write in. We could not confirm any Bitbucket figure on the primary page, so we report none.

A separate GitHub number. The "Community platforms" question shows "GitHub (public)" at 66.9% of all respondents and 67.5% of professionals, from 30,190 respondents. It measures GitHub as a community venue, not a work tool, and should never be merged with the figure above.

Why survey percentages add up to more than 100%

GitHub, GitLab and Azure DevOps in the table sum to 133.3% of respondents. That is expected for a multi-select question. Developers use more than one platform for ordinary reasons: work code on one and open source on another, an acquisition that was never consolidated, a legacy product line on an older system, mirrors for public visibility, or contractors working across client environments.

The sum also gives a floor for overlap. If 81.1% use GitHub and 35.6% use GitLab, at least 16.7% of respondents use both (81.1 plus 35.6, minus 100). The true overlap is likely higher, but the survey does not publish it, so we only state the arithmetic minimum.

For security teams this is the important part. A vulnerability policy, branch protection standard or scanning rule written for one platform covers only that platform's repositories. Where developers work across two or three systems, the gap is the part of the estate where policy depends on someone configuring the second system like the first.

How many developers and repositories does GitHub report?

Octoverse 2025

GitHub's Octoverse 2025 was published on 28 October 2025 (updated 28 February 2026) and covers 1 September 2024 to 31 August 2025. It reports "180 million-plus developers" with more than 36 million joining in the year; 630 million total repositories, 121 million of them new; 395 million public and open source repositories, up 19%; 43.2 million pull requests merged per month on average, up 23%; and nearly 1 billion commits pushed in 2025. By country it lists the United States at 28 million developers, India at 21.9 million, Brazil at 6.89 million and Indonesia at 4.37 million.

The definition is the key detail. Octoverse's glossary defines a developer as "Anyone with a GitHub account." That includes dormant accounts, people with several accounts and students who signed up once. It is not monthly active users and not unique people.

Microsoft's proxy statement

Microsoft's 2025 definitive proxy statement, first mailed on or about 21 October 2025, says GitHub supports "a global community of 150 million users," hosts "more than 1 billion repositories and forks," and has 20 million GitHub Copilot users. It gives no GitHub revenue figure; GitHub cloud services appear only inside the definition of Microsoft's Azure and Other Cloud Services revenue metric.

Table 2: platform self-reported scale, as published

Where the GitHub numbers disagree

The two GitHub totals were published a week apart and differ by 30 million. The documents do not explain why. Plausible reasons: a proxy is drafted months before it is mailed and may carry an older figure, and the proxy does not define "users." The repository counts differ in scope as well, since "1 billion repositories and forks" includes forks. These are not two estimates of the same quantity.

Secondary websites quote GitHub totals well above 180 million. We found no primary source for them and do not use them. If you need one GitHub number, quote Octoverse 2025 as "180 million+ accounts in the year to August 2025," not as active developers.

A GitHub annual revenue run rate of $2 billion, attributed to Microsoft's October 2024 earnings call, is also widely repeated.

What GitLab's SEC filings reveal

GitLab is the only one of the four large platforms that is a standalone public company, so its filings are the most detailed public data on a code hosting business. They report revenue and paying customers, not seats or repositories.

Fiscal 2026 (year ended 31 January 2026)

From the FY2026 10-K and the fourth quarter earnings release dated 3 March 2026: revenue of $955.2 million, up 26% from $759.2 million; fourth quarter revenue of $260.4 million, up 23%; 10,682 customers above $5,000 of annual recurring revenue (ARR), up from 9,893; 1,456 customers above $100,000 ARR, up from 1,229; 155 above $1 million ARR, up from 123; and a dollar-based net retention rate of 118%, down from 123%. FY2027 revenue guidance was $1,099 million to $1,118 million.

The 10-K describes three deployment options: GitLab.com (multi-tenant, managed by GitLab), Self-Managed (on the customer's infrastructure) and Dedicated (single-tenant, managed by GitLab, including a government edition).

Table 3: GitLab revenue by line, three months ended 31 July

The part of the 10-K we read did not split revenue by deployment. The 10-Q for the quarter ended 31 July 2026 does.

Source: GitLab Form 10-Q, quarter ended 31 July 2026. Shares and changes are our arithmetic on the filing's figures in thousands.

For the six months to 31 July 2026, SaaS was $185.8 million of $550.4 million (33.8%), against $136.2 million of $450.5 million (30.2%) a year earlier.

What this shows, with caveats:

1. Self-managed is still most of the revenue. Self-managed subscription plus license revenue was $181.4 million, 63.3% of the quarter. That is revenue, not users or repositories.
2. SaaS is growing faster, 35.5% against 14.3% for self-managed subscriptions. The SaaS line we read is not split between GitLab.com and Dedicated.
3. Customer counts are not split by deployment either.

Planning notes listed 1,519 customers above $100,000 ARR at 30 April 2026 and 1,571 at 31 July 2026. The 10-Q text we read ended before the key metrics section, so we could not confirm them and leave them out.

For security teams, Table 3 is the most useful figure in this post. If roughly six in ten GitLab revenue dollars come from customers running GitLab on their own infrastructure, a tool that only connects to the multi-tenant service misses a large part of many organisations' GitLab estate.

What Atlassian's 10-K says about Bitbucket and the Data Center shift

Atlassian does not report Bitbucket revenue or users. Its FY2025 10-K (year ended 30 June 2025) describes Bitbucket as "a git-based source code management platform for professional development teams," lists it as a cloud app and a Data Center product, and says Atlassian has more than 300,000 customers overall. It reports revenue by deployment option across all products.

Table 4: Atlassian revenue by deployment option, all products

Source: Atlassian FY2025 Form 10-K. Shares and changes are our arithmetic. The filing says Server maintenance revenue became immaterial after the Server end of support date in fiscal 2024.

The table shows the end of Server and a self-managed Data Center line still growing in FY2025. It does not show Bitbucket's part of either. The same filing says Jira, Confluence and Jira Service Management generate the majority of revenue.

Bitbucket's status in the Data Center end of life

Atlassian's end of life page sets a phased schedule. From 30 March 2026, new customers cannot buy Data Center subscriptions. On 30 March 2028, existing customers lose the ability to buy new subscriptions, expansions or upgrades. On 28 March 2029, Data Center products reach end of life and become read-only.

Bitbucket and Bamboo Data Center are excluded; the page says they "will not end of life." Existing customers get a Bitbucket Hybrid License covering Bitbucket Data Center, Bamboo Data Center and Bitbucket Cloud, available at renewal, with no data transfer required. Self-managed Bitbucket will therefore remain part of many estates beyond 2029.

Planning notes also held a figure of 15 million Bitbucket developers (secondary sites citing Atlassian, late 2025) and 10 million registered users in 2019. We found neither in a primary document, so both are unconfirmed.

Where does Azure DevOps sit?

Microsoft does not report Azure DevOps separately in the documents we read. The only primary cross-platform figure we found is from Stack Overflow 2025: 16.6% of all respondents and 18.6% of professionals selected "Azure Devops."

Two cautions. Azure DevOps is a suite (Boards, Repos, Pipelines, Artifacts, Test Plans), and the survey option does not say which part was used; a team planning in Boards while hosting code on GitHub can tick it. And Azure DevOps exists as a cloud service and a self-hosted server product, which the survey does not separate. JetBrains labels its CI option "Azure DevOps Server," a further naming difference.

So the honest answer is that about one in six Stack Overflow 2025 respondents used some part of Azure DevOps, and there is no public figure for its repositories, users or revenue.

What CI tool shares suggest about where repositories live

CI usage is an indirect signal. A team on GitHub Actions almost certainly hosts code on GitHub, and a team on GitLab CI uses GitLab. Standalone CI tools say nothing about hosting.

Table 5: JetBrains State of CI/CD Tools, organisational use

Source: JetBrains, State of CI/CD 2026. Multi-select. The State of CI/CD Tools Survey 2026 had 598 respondents, 576 of whom used at least one CI/CD tool. The page does not state the survey dates.

JetBrains is open about the limits. The page draws on four datasets, including its Developer Ecosystem Survey 2026 (21,946 respondents in the introduction, 22,082 responses in the methodology, run May to July 2026), and notes that its two 2026 surveys sometimes disagree: Jenkins is 28% in one and 37% in the other. Respondents were recruited through JetBrains channels.

There is a second disagreement. Planning notes from secondary coverage of JetBrains' October 2025 CI/CD post gave 2025 organisational use as GitHub Actions 33%, Jenkins 28% and GitLab CI 19%. The 2026 page's 2025 column shows 41%, 31% and 34%. These are probably different JetBrains surveys, but the 2025 post returned an access error when we tried to read it. Use the 2026 page and name the survey with any figure.

Where the CI data agrees with the surveys: the relative order of GitHub, GitLab and Azure DevOps CI matches their order in the Stack Overflow 2025 table. Bitbucket Pipelines at 6% is a weak hint about Bitbucket's footprint among these respondents, but Bitbucket users can run other CI tools.

The long tail and self-hosted options

Outside the four large platforms there is a long tail, and almost none of it publishes usage data.

• Gitea and Forgejo are open source forges anyone can install. Self-hosted installs do not report to a central server by default, so there is no installed base figure.
• Codeberg is a non-profit hosted service running Forgejo with modifications. On 23 October 2026 its home page showed 448,150 users, 742,230 projects and more than 1,700 association members. These are live counters; quote them with a date.
• SourceHut is a hosted and self-hostable forge. We found no published user count.
• AWS CodeCommit said in July 2024 that it would "de-emphasize AWS CodeCommit." On 24 November 2025 AWS announced its return to full general availability, open to new customers, in 29 regions. Teams that migrated away may still have archived repositories there.
• Self-managed editions of the large platforms (GitHub Enterprise Server, GitLab Self-Managed, Bitbucket Data Center, Azure DevOps Server) show up only in vendor revenue lines, where reported at all.

If you run a self-hosted forge, no public dataset will describe your setup. That is an argument for your own inventory, covered in the walkthrough below.

Where the datasets disagree, in one place

How we measured

Datasets.

1. Stack Overflow 2025 Developer Survey. Fielded 29 May to 23 June 2025; 49,009 responses from 177 countries; 30,065 answered the collaboration tools question. Counts respondents who used a tool regularly in the past year. Multi-select.
2. Stack Overflow 2026 Developer Survey. Published 6 October 2026; 30,903 responses from 169 countries. Used only to confirm that no code hosting question appears in the published results.
3. GitHub Octoverse 2025. Data from 1 September 2024 to 31 August 2025. Counts accounts, repositories, pull requests and commits.
4. Microsoft 2025 proxy statement. Mailed about 21 October 2025. Counts undefined "users," repositories and forks, Copilot users.
5. GitLab FY2026 10-K, Q4 FY2026 release, Q2 FY2027 10-Q. Year ended 31 January 2026; quarter ended 31 July 2026. Counts dollars, customers above ARR thresholds and registered users.
6. Atlassian FY2025 10-K. Year ended 30 June 2025. Counts dollars by deployment option across all products.
7. Atlassian Data Center end of life page, read 23 October 2026. Dates and product status only.
8. JetBrains State of CI/CD 2026. 598 respondents. Counts organisations' CI tool use as reported by respondents.
9. AWS DevOps blog (24 November 2025) and codeberg.org (read 23 October 2026). Status and live counters.

Why they cannot be combined. A survey share is a share of people answering one question. Octoverse counts accounts. A 10-K counts dollars or customers above a threshold. A CI share is a share of respondents' organisations. Adding GitHub's 180 million accounts to GitLab's 50 million registered users does not give a market size: one person can hold both, accounts are not people, and each company defines "user" its own way. Dividing GitLab revenue by Atlassian revenue is meaningless because most Atlassian revenue is not Bitbucket.

Arithmetic we did. Shares and growth rates within a single filing, from that filing's dollar figures, and the minimum GitHub and GitLab overlap within one Stack Overflow question. Nothing across sources.

What we excluded. Figures we saw only in snippets or secondary articles and could not confirm on a primary page: Bitbucket 0.1% and 15 million developers, GitHub totals above 180 million, the $2 billion GitHub run rate, and GitLab's April and July 2026 $100,000 ARR customer counts.

What the datasets agree on

• GitHub has the largest figure on every measure that includes it: survey share, account count and JetBrains 2026 CI share.
• GitLab is the second most selected source code platform in both survey families (35.6% in Stack Overflow 2025; 32% for GitLab CI in JetBrains 2026), with a large self-managed revenue base.
• Azure DevOps appears in roughly one in six or seven responses in both survey families.
• Bitbucket is the least measurable of the four, with no confirmed survey share or product disclosure, but a self-managed edition its vendor will keep beyond 2029.
• Self-managed deployment remains a large share of paid usage where reported: 63.3% of GitLab revenue in the July 2026 quarter and a $1.47 billion Atlassian Data Center line in FY2025.
• Multi-platform use is normal.

What a multi-SCM estate means for security policy and scanning

"We are a GitHub shop" is rarely the whole story. Acquisitions, contractors, legacy products, regulated workloads kept self-hosted and CI living away from the code all produce estates with two or three SCMs. The risks are predictable:

• Uneven policy. Branch protection, required reviews and signed commit rules are configured per platform, with different models and defaults. See hardening GitLab vs GitHub default settings.
• Uneven scanning. Platform-native security features apply only to that platform, often only on some tiers. See why GitHub-only security tooling does not cover GitLab, Bitbucket or self-hosted SCMs.
• Slower incident response. When a vulnerable version is announced, "where do we use it?" across three platforms with three tools is slower and less complete. See SBOM incident response: finding affected products fast.
• Unreachable self-hosted instances. A tool that only reaches multi-tenant services cannot see a Bitbucket Data Center or GitLab Self-Managed instance behind a firewall.

Walkthrough: build your own SCM share table

Public data cannot tell you your own split. A short inventory can. These commands count repositories per platform so you can check that every one is covered by the same scanning and policy. Replace the organisation, group and workspace names with yours.

Step 1: GitHub

gh repo list my-org --limit 4000 \
  --json name,visibility,isArchived,pushedAt > github-repos.json
jq '[.[] | select(.isArchived == false)] | length' github-repos.json

For GitHub Enterprise Server, set GH_HOST to your server's hostname first.

Step 2: GitLab

glab api --paginate \
  "groups/my-group/projects?include_subgroups=true&archived=false&per_page=100" \
  > gitlab-projects.json
jq -s 'add | length' gitlab-projects.json

For GitLab Self-Managed, run glab auth login --hostname gitlab.example.internal first.

Step 3: Azure Repos

az extension add --name azure-devops
az devops project list --organization https://dev.azure.com/my-org \
  --query "value[].name" -o tsv > ado-projects.txt
while read -r project; do
  az repos list --organization https://dev.azure.com/my-org \
    --project "$project" --query "length(@)" -o tsv
done < ado-projects.txt | paste -sd+ - | bc

Step 4: Bitbucket Cloud

Use automation credentials from your workspace administrator, kept in environment variables:

curl -s -u "$BB_USER:$BB_TOKEN" \
  "https://api.bitbucket.org/2.0/repositories/my-workspace?pagelen=100" | jq '.size'

For Bitbucket Data Center, use the server's REST API under /rest/api/1.0/repos the same way.

Step 5: side by side, with a date

printf "platform,active_repos,date\n" > scm-share.csv
printf "github,%s,%s\n" "$(jq '[.[] | select(.isArchived == false)] | length' github-repos.json)" "$(date +%F)" >> scm-share.csv
printf "gitlab,%s,%s\n" "$(jq -s 'add | length' gitlab-projects.json)" "$(date +%F)" >> scm-share.csv
column -s, -t scm-share.csv

Step 6: check coverage per platform

For each row, answer three questions: is every active repository connected to dependency and SBOM scanning, does the same branch protection standard apply, and does the same policy gate run in CI? One row per platform and three columns is usually enough to find the gap.

If you use Safeguard, the same scan runs the same way wherever the code came from:

safeguard scan --dir .

Results are written as JSON under ./output, so the same downstream step can read them in GitHub Actions, GitLab CI, Azure Pipelines or Bitbucket Pipelines. A minimal GitLab CI job:

dependency_scan:
  stage: test
  script:
    # install the Safeguard CLI as described at docs.safeguard.sh/docs/cli
    - safeguard scan --dir .
  artifacts:
    paths:
      - output/

One scan command and one output format across four CI systems gives one set of results to compare, instead of four.

Where Safeguard fits

Safeguard connects to GitHub, GitLab, Bitbucket and Azure DevOps, so one SBOM, dependency scanning and policy layer can cover a mixed estate. Safeguard's integrations documentation lists GitHub (cloud and Enterprise Server 3.7 and later), GitLab (SaaS and Self-managed 15.0 and later), Bitbucket (Cloud and Data Center 7.0 and later) and Azure DevOps at organisation or project scope; check it for the current list before planning around a specific self-hosted version. Setup guides: GitHub, GitLab, Bitbucket, Azure DevOps.

Once repositories are connected, the platform shows which projects contain a given component and version, matches components against vulnerability databases, uses reachability analysis to rank what your code actually calls, and evaluates policies and gates. Griffin fix pull requests open in the SCM that holds the repository; autonomous remediation ships switched off.

What Safeguard does not do here: it does not configure platform settings such as branch protection or required reviews, and it cannot tell you any platform's market share. Those controls still have to be set on each platform from its own documentation.

Common mistakes

Reading the data:

1. Calling a survey share a market share. 81.1% of Stack Overflow 2025 respondents used GitHub; that is not 81.1% of repositories or revenue.
2. Normalising multi-select shares to 100%. The shares exceed 100% by design.
3. Treating accounts as people. Octoverse counts accounts, many dormant or duplicated.
4. Mixing survey years in one chart, such as Stack Overflow 2025 beside JetBrains 2026.
5. Treating a collaboration tools question as a hosting question. That is why Jira is in it.
6. Reading Atlassian or Microsoft revenue as Bitbucket or Azure DevOps revenue.
7. Quoting a number without a date.

Acting on the data:

8. Buying single-platform tooling because one platform has the largest share. The overlap floor says many teams touch two.
9. Forgetting self-managed instances, which carry most of GitLab's revenue.
10. Assuming retired platforms are empty. Old CodeCommit or Server repositories can still feed builds.
11. Counting covered platforms instead of covered repositories. "Three of four SCMs" can mean 99% or 40%.

FAQ

What is GitHub's market share in 2026?

No market share figure is published. The latest cross-platform survey number is Stack Overflow 2025: 81.1% of 30,065 respondents used GitHub regularly. The 2026 results, published 6 October 2026, do not include that question in the pages we read.

How many users does GitHub have?

Octoverse 2025 (28 October 2025) reports "180 million-plus developers," defined as accounts. Microsoft's 2025 proxy, from the same month, says 150 million users. Neither counts active users.

How many people use Azure DevOps?

Microsoft publishes no figure. In Stack Overflow 2025, 16.6% of respondents to the collaboration tools question selected Azure DevOps, which may include people using only Boards or Pipelines.

Is Bitbucket being discontinued?

No. Atlassian's Data Center end of life on 28 March 2029 excludes Bitbucket and Bamboo Data Center, and existing customers get a Bitbucket Hybrid License that also covers Bitbucket Cloud.

Is AWS CodeCommit still available?

Yes. AWS de-emphasized it in July 2024, then announced on 24 November 2025 that it was returning to full general availability, open to new customers, in 29 regions.

How much of GitLab's revenue is self-managed?

About 63.3% in the quarter ended 31 July 2026: $181.4 million of $286.3 million, per GitLab's 10-Q. SaaS was $97.6 million, about 34.1%.

Why do developer survey percentages add up to more than 100%?

The question is multi-select and many developers use several platforms. GitHub, GitLab and Azure DevOps sum to 133.3% in Stack Overflow 2025.

How do I find out which code hosting platforms my company uses?

Count repositories per platform with each platform's CLI or API, as in the walkthrough, and record the date. That gives a measured internal split for checking scanning and policy coverage.

Can one security tool cover GitHub, GitLab, Bitbucket and Azure DevOps?

Yes, if it integrates with all four and with the self-hosted editions you run. Check each tool's own documentation for supported editions and versions.

Fix it without waiting for upstream

Knowing where your code lives is the first half of the job. The second half is closing vulnerabilities in the dependencies those repositories ship, on every platform, without waiting for each team to get to it.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

To try this on your own repositories, wherever they are hosted, download Safeguard and follow the CLI documentation.

The first demo is a real CLI session. You run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository; it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. It works on a checkout from any of the four platforms, because it runs against files on disk.

Click through it at your own pace, or open it full screen.

The second demo sets up the runner on your own machine, approves it with its device code, then scans from the terminal. For teams with self-hosted SCMs, it is a way to run scans on a machine you control, next to checkouts you already have.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once connected, Claude can answer questions about your projects and the vulnerabilities affecting them from your own Safeguard records, whichever SCM the projects came from.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Stack Overflow 2025 Developer Survey, Technology
• Stack Overflow 2025 Developer Survey, Methodology
• Stack Overflow 2026 Developer Survey results
• Stack Overflow 2026 Developer Survey, Technology
• Stack Overflow blog: the results of the 2026 developer survey are here (6 Oct 2026)
• Stack Overflow blog: getting ready for 2026 results (30 Sep 2026)
• GitHub Octoverse 2025
• Microsoft 2025 definitive proxy statement (SEC)
• Microsoft FY2025 Q1 earnings call page (30 Oct 2024)
• GitLab FY2026 Form 10-K (SEC)
• GitLab Q4 and FY2026 earnings release (SEC)
• GitLab Form 10-Q, quarter ended 31 July 2026 (SEC)
• Atlassian FY2025 Form 10-K (SEC)
• Atlassian Data Center end of life
• JetBrains State of CI/CD 2026
• AWS DevOps blog: AWS CodeCommit returns to general availability (24 Nov 2025)
• Codeberg home page (read 23 Oct 2026)
• Safeguard integrations documentation

Last reviewed: 23 October 2026. Survey, filing and platform figures change with each release; check the linked sources for the latest numbers.