CI Gate configuration

Last updated: Oct 27, 2026

---

You can install Fluid Attacks' CI Gate to apply the vulnerability acceptance policies automatically.

CI Gate, as the general policies of your organization or group specify, can automatically break builds that contain vulnerabilities that are not remediated or accepted. When CI Gate breaks the build, no software author can deploy a build with these vulnerabilities to production. This makes your team remediate security issues and puts security first at that point of the software development lifecycle.

To install the gate, you must have a Group token. It is the same credential that Fluid Attacks' scanners use to authenticate (as INTEGRATES_API_TOKEN), not a personal token. For more information, read CLI authentication. To use CI Gate, make sure that it has Internet access to connect to Fluid Attacks' API. This page shows how to manage this token. It also has references about how to configure policies to break the build and how to see the executions of CI Gate.

Generate the Group token

To generate the Group token on the Fluid Attacks platform, follow these steps:

1. Go to the DevSecOps section of the group where you want to use CI Gate.

   

2. Click the Manage token button.

3. In the pop-up window, click Generate.

   

After the platform generates the token, click Copy to use it immediately. The token is valid for 180 days and applies only to the group where you created it.

At any time, you can click Reveal token to see it again.

Update the Group token

Fluid Attacks' platform sends you a notification seven days before the Group token expires.

After your token expires, follow the same instructions above. In this case, the pop-up window of step 3 tells you that the token expired.

Reset the Group token

You can reset the Group token before it expires. Follow these steps:

1. Go to the DevSecOps section of your group.
2. Click the Manage token button.
3. In the pop-up window, click Reveal token.
4. When the window shows your current token, click the Reset button to generate a new token.

The pop-up window shows the new token. You can copy it and use it immediately.

Configure policies to break the build

On the Fluid Attacks platform, you can configure these policies to break the build:

• Grace period where newly reported vulnerabilities will not break the build
• Minimum CVSS score of an open vulnerability to break the build
• Number of days until vulnerabilities are considered technical debt and do not break the build

To configure them for your organization or for one or more of its groups, go to the Policies section.

View the CI Gate execution details

On Fluid Attacks' platform, you can examine the results of each execution of CI Gate for a group. For example, you can see if it broke the build and which unremediated vulnerabilities it found. To do this, go to the DevSecOps section of the group. To learn about this section, read View details of the security of your builds.