Prevent the deployment of builds with vulnerabilities

You can install Fluid Attacks’ CI Gate  to automatically enforce the vulnerability acceptance policies.

CI Gate, aligned with your organization’s or group’s general policies , can automatically break builds that contain vulnerabilities that have not been remediated nor accepted . Breaking the build means preventing any software author from deploying a build with said vulnerabilities into production. This mechanism prompts your team to address security issues, effectively prioritizing security at that moment of the software development lifecycle.

A CI Gate token is required for installation of the gate. To use CI Gate, ensure Internet connectivity, so it can connect to Fluid Attacks’ API. Continue reading to learn how to manage this token. Further below are references to configuring policies to break the build and viewing CI Gate’s executions.

Generate the CI Gate token

Follow these steps to generate the CI Gate token on Fluid Attacks’ platform:

1. Go to the Scope section of the group where you want to use CI Gate.

1. Scroll all the way down to locate the CI Gate card.
2. Click the Manage token button.

1. In the pop-up window, click on Generate.

   

Once generated, you can click on Copy to capture the token for immediate use. The token is valid for 180 days and is unique to the group where it is created.

​

You can always come back and click on Reveal token to view it.

Update the CI Gate token

Fluid Attacks’ platform sends you a notification seven days before the CI Gate token expires .

After your token expires, you must follow the same instructions provided in Generate the CI Gate token . In this case, the pop-up window referred to in step 4 states that the token has expired.

Reset the CI Gate token

You can reset the CI Gate token while your current one is still valid. Follow these steps:

1. Go to your group’s Scope and locate the Manage token button.
2. In the pop-up window, click on Reveal token.
3. Once your current token is displayed, click the Reset button to generate a new token.

The new token is generated in the pop-up window, and you can copy it for immediate use.

Configure policies to break the build

Fluid Attacks’ platform allows you to configure the following policies related to breaking the build:

1. Grace period where newly reported vulnerabilities will not break the build 
2. Minimum CVSS score of an open vulnerability to break the build 
3. Number of days until vulnerabilities are considered technical debt and do not break the build 

To configure them for your entire organization or for specific groups, go to the Policies section .

View the CI Gate execution details

On Fluid Attacks’ platform, you can inspect the outcomes of each execution of CI Gate for a specific group, such as whether it broke the build and what unremedied vulnerabilities it found. To do it, go to the group’s DevSecOps section. Read about the latter in View details of the security of your builds .