Platform integrations

Last updated: Nov 4, 2026

---

Rationale

Fluid Attacks uses an in-house implementation for integrations with source code providers, for example, the GitHub App of Fluid Attacks. At this time, this implementation supports:

• Authentication as the app, to get access to the installation of a client
• Reception of provider events and sending of these events to the related platform workflow

Fluid Attacks selected it, and not other alternatives, because of these items:

• An in-house implementation replaces only a small quantity of code. Thus, a third-party layer gives only a small maintainability benefit.
• The credentials, for example, the private key of an app and its webhook signing secret, are the most sensitive secrets of the full integration. When these secrets stay in-house, Fluid Attacks keeps their custody and their blast radius fully in its own trust boundary.

Alternatives

As the application became larger, Fluid Attacks became more interested in a third-party integration solution. These are the solutions that Fluid Attacks examined. The list starts with the solution that is most interesting for the requirements of Fluid Attacks.

Nango

• Nango gives a SaaS platform to manage third-party API integrations. It includes a dedicated flow for integrations of the GitHub App type.
• With its GitHub App flow, you must upload the private key of the app to the Nango platform. The scope of that key is not one client. It is the master credential that authenticates as the app in all installations, without a time limit.
• Nango would also receive the provider events, and not Fluid Attacks directly. Thus, the webhook signing secret would also go out of the direct control of Fluid Attacks.
• Nango automatically mints short-lived installation tokens, but this is only a small quantity of code. With Nango, Fluid Attacks must continue to keep its own logic to unwrap the payload and send it to the related workflow. Thus, the integration code does not become much smaller, and Nango adds one more network hop.
• For integrations that use only classic OAuth, without an app-style master credential, the trade-off seems different. Thus, it can be good to examine Nango again for these integrations.

Usage

Fluid Attacks uses an in-house implementation for provider integrations, for example, the Fluid Attacks GitHub App, in the Fluid Attacks platform.

Other in-house dependencies

• Platform audit logs
• Platform authentication
• Platform authorization