Easy to reach. Easy to attack.
Bots find your login page in hours. One repository switched to public by mistake exposes your code. Any device with valid credentials gets in.
ZERO TRUST FOR DEVOPS
Secure access to GitLab and GitHub.
Give your developers fast, direct access to code. Keep everyone else out. InstaSafe connects verified users on trusted devices to GitLab and GitHub, without a VPN and without exposing your servers to the internet.
Protect your source code without slowing your developers.
GitLab and GitHub run your software business. Your code, your pipelines and the keys to your production systems all live there. You should not have to choose between keeping them safe and keeping your teams productive.
- YOUR PRODUCTEvery line of code your team has written, with its full history.
- YOUR PATH TO PRODUCTIONDeploy keys and CI/CD credentials connect the platform to your cloud and servers.
- YOUR RELEASESWhoever controls the pipeline controls what your customers install.
- YOUR TRUSTPeople, runners and integrations each hold keys that work until revoked.
Your code platform is a prime target.
the problem
GitLab and GitHub are excellent platforms, and their teams fix flaws fast. But a fix only protects you once you install it. Until then, a server open to the internet is open to every attacker who reads the advisory.
86,000+GitLab servers found reachable from the internet in public scans.
10 / 10Severity of the GitLab flaw patched in October 2026. No login needed to run code on the server.
88%Of GitHub Enterprise Server instances still unpatched weeks after a critical fix in March 2026, per researchers at Wiz.
- new advisory: Unauthenticated code execution. Critical, gitlab. CVE-2026-110264, October 2026. Rated 10 out of 10. No login needed to run code on the server.
- still unpatched: 88% of servers behind the fix. High, ghes. Weeks after a critical GitHub Enterprise Server fix in March 2026, per researchers at Wiz.
- exposed surface: 86,000+ servers answer the internet. High, public scan. Every one of them reachable by anybody who has read the same advisory you have.
- credential abuse: A token presented from another country. Critical, cloud. A leaked token or SSH key carries no idea of where it is being used from. It simply works.
Recent critical flaws in the platforms themselves.
Each one is public, each one was fixed, and each one was exploitable until the fix was installed.
advisories _ gitlab + github_
- CVE-2026-110264 · GitLabOctober 2026. Unauthenticated code execution.
- CVE-2026-3854 · GitHubMarch 2026. Server takeover with a single git push.
- CVE-2024-4985 · GitHub Enterprise ServerMay 2024. Admin login without a password.
- CVE-2022-0735 · GitLabFebruary 2022. Runner registration tokens exposed.
where VPNs fall short
Legacy access puts your code and your network at risk.
Most teams pick one of two options for self-hosted GitLab and GitHub. Neither works.
Safer. Slower. Still exposed.
Every user lands on your whole network. Contractors and mobile users struggle to connect. SaaS tools like Slack still need wide IP allow lists.
- J. Fernandes: VPN won't connect again. Third time this week.
- Alen Joseph: Another IP to allow-list. The list is 40 lines now.
- Arjun M: Clone is crawling. Everything goes through the tunnel.
- Neha V: The gateway is being probed. It is on the internet.
a typical self-managed setup, with a VPN_
- user
VPN client
profile, certificate
- edge
VPN gateway
on the internet
open to the internet - corporate network
Everything inside
- GitLab
- File servers
- Databases
- Build hosts
- Everything else
- Complex to runClients, profiles, certificates, firewall rules and capacity to manage.
- Too much accessOne compromised laptop can reach your databases.
- Blind to devicesAn infected laptop gets the same access as a healthy one.
- A target itselfThe gateway sits on the internet with its own flaws to patch.
Zero Trust access for every repository.
InstaSafe checks who you are and what device you are on before you ever reach GitLab or GitHub. Then it connects you to that application only, never to the network.
- DEVELOPERThe InstaSafe agent establishes identity, a second factor and the device's posture before anything leaves the machine.
- YOUR NETWORK OR CLOUDThe InstaSafe gateway stays silent to everyone else. Self-hosted servers disappear from the internet; cloud repositories accept only your company's path.
- CODEGitLab or GitHub, self-hosted or cloud. Your code travels to your own gateway, not through our cloud.
Secure for you. Simple for developers.
- SHRINK YOUR ATTACK SURFACETake self-hosted GitLab and GitHub off the internet. Attackers cannot target what they cannot find.
- MAKE STOLEN KEYS USELESSTokens and SSH keys work only through your InstaSafe path, on approved devices.
- KEEP DEVELOPERS MOVINGSame URLs, same git commands, same IDE. No VPN to fight with.
- CUT COST AND COMPLEXITYRetire developer VPNs. Onboard contractors in minutes and offboard them in one step.
Stop the attacks that target code platforms.
Lock credentials to your company
A token found in a public file or a breached tool cannot be used from outside your InstaSafe path.
Hide self-hosted servers
No public address. New flaws cannot be tried by strangers while you patch.
Bind sessions to trusted devices
A captured session is useless on the attacker's machine. MFA runs on every login.
Check every device, all session long
25 checks at login and during the session. Fall out of policy, lose access.
Offboard in one step
Disable the user in your directory. Their path closes, whatever keys they left behind.
Contain mistakes
Only people on your approved path can reach your repositories, even one made public by error.
Lock down admin access
Admin consoles open only to admins, on managed devices, after fresh MFA.
Give runners their own identity
Build runners connect with a limited machine identity, separate from people.
deploy your way
Self-hosted or cloud. One policy, one console.
GitLab Self-Managed · GitHub Enterprise Server
Take your server off the internet. Replace the VPN.
- Deploy two InstaSafe gateways next to the server, with automatic failover.
- Publish web and git for developers, admin access for admins only.
- Connect your directory: AD, Entra ID, Okta or Google Workspace.
- Move teams over. URLs and git commands stay the same.
- Remove public access.
GitLab.com · GitHub Enterprise Cloud
Make your organisation accept only your InstaSafe path.
- Run an InstaSafe gateway with one fixed exit IP.
- Set InstaSafe as single sign-on for your group or enterprise.
- Route build runners through the same gateway.
- Add the gateway IP to GitLab's IP restriction or GitHub's IP allow list.
Requires GitLab Premium or Ultimate, or GitHub Enterprise Cloud.
Everything you need in one platform.
capabilities _ gitlab + github_
Zero Trust Access
Identity and Device Trust
Visibility and Operations
0 of 12 markedtick what your evaluation actually needs — take it into the demo
Modernise access to your code.
- REPLACE THE DEVELOPER VPNGive engineers direct access to GitLab and GitHub, without network access.
- SECURE CONTRACTORS AND OFFSHORE TEAMSGrant access to the repositories they need, on the devices you approve, for as long as you choose.
- HIDE SELF-HOSTED GITLAB AND GITHUBRemove your servers from the internet and patch on your own schedule.
- LOCK CLOUD REPOSITORIES TO YOUR COMPANYMake GitLab.com and GitHub Enterprise Cloud refuse logins from anywhere else.
- PROTECT ADMIN CONSOLESSeparate admin access from developer access, with stronger checks.
- SECURE CI/CD RUNNERSKeep pipelines running without opening your servers to the internet.
FAQ
Questions, answered.
Tap a question. If yours is not here, a specialist can answer it.
Talk to a specialist//Ready when you are//
Lock down your code. Free your developers.
See InstaSafe hide a GitLab server and block a stolen token, live, in 30 minutes.
Regulated, air-gapped, or on-premise? See deployment options