CI/CD Security Gate
Automated security checks before production deployment
Shift security left by integrating automated security checks into your CI/CD pipeline. EdgeDNS validates security configuration before code reaches production.
The Challenge
Security misconfigurations often slip through to production because security checks happen too late in the development cycle. Manual security reviews create bottlenecks, while skipping them introduces risk. Teams need automated, fast security gates that integrate with existing CI/CD workflows.
The Solution
Integrate EdgeDNS into your deployment pipeline to automatically verify security headers, SSL configuration, and security scores before promoting to production. Block deployments that fail security thresholds and provide actionable feedback to developers.
Endpoints Used
Combine these EdgeDNS endpoints to build this solution.
/v1/security/headersTry in PlaygroundSecurity Headers: Verify CSP, HSTS, X-Frame-Options are configured
/v1/domain/sslTry in PlaygroundSSL Certificate: Check certificate validity and expiration
/v1/score/securityTry in PlaygroundSecurity Score: Get overall security grade for pass/fail decision
/v1/domain/hstsTry in PlaygroundHSTS Preload: Verify HSTS is properly configured
Results You Can Achieve
Catch issues before production
Security validation in staging prevents production incidents
Reduce security review bottlenecks
Automated checks free security teams for higher-value work
Enforce security standards consistently
Same security requirements applied to every deployment
Code Example
CI/CD security gate check
// GitHub Actions / GitLab CI security gate
async function securityGate(stagingUrl) {
const headers = { 'Authorization': 'Bearer YOUR_API_KEY' };
// Grade ranks: A=1, B=2, C=3, D=4, F=5 (lower is better)
const gradeRank = { 'A': 1, 'B': 2, 'C': 3, 'D': 4, 'F': 5 };
const MINIMUM_GRADE = 'B';
const [secHeaders, ssl, score] = await Promise.all([
fetch(`https://api.edgedns.dev/v1/security/headers?url=${stagingUrl}`, { headers }),
fetch(`https://api.edgedns.dev/v1/domain/ssl?domain=${new URL(stagingUrl).hostname}`, { headers }),
fetch(`https://api.edgedns.dev/v1/score/security?domain=${new URL(stagingUrl).hostname}`, { headers }),
].map(p => p.then(r => r.json())));
const issues = [];
// Check if grade is worse than minimum (higher rank number = worse grade)
if (gradeRank[score.data.grade] > gradeRank[MINIMUM_GRADE]) {
issues.push(`Security grade ${score.data.grade} below minimum ${MINIMUM_GRADE}`);
}
if (!secHeaders.data.headers.strictTransportSecurity) {
issues.push('Missing HSTS header');
}
if (ssl.data.daysUntilExpiry < 30) {
issues.push(`SSL certificate expires in ${ssl.data.daysUntilExpiry} days`);
}
if (issues.length > 0) {
console.error('Security gate FAILED:', issues);
process.exit(1);
}
console.log('Security gate PASSED');
}Learn More
Explore industry standards and best practices related to this use case.
Ready to build CI/CD Security Gate?
Get started with 200 free API requests per month. No credit card required.