CI/CD Security Gate
Automated security checks before production deployment
Shift security left by integrating automated security checks into your CI/CD pipeline. EdgeDNS validates security configuration before code reaches production.
The Challenge
Security misconfigurations often slip through to production because security checks happen too late in the development cycle. Manual security reviews create bottlenecks, while skipping them introduces risk. Teams need automated, fast security gates that integrate with existing CI/CD workflows.
The Solution
Integrate EdgeDNS into your deployment pipeline to automatically verify security headers, SSL configuration, and security scores before promoting to production. Block deployments that fail security thresholds and provide actionable feedback to developers.
Endpoints Used
Combine these EdgeDNS endpoints to build this solution.
/v1/security/headersTry in PlaygroundSecurity Headers: Verify CSP, HSTS, X-Frame-Options are configured
/v1/domain/sslTry in PlaygroundSSL Certificate: Check certificate validity and expiration
/v1/score/securityTry in PlaygroundSecurity Score: Get overall security grade for pass/fail decision
/v1/domain/hstsTry in PlaygroundHSTS Preload: Verify HSTS is properly configured
Results You Can Achieve
Block-on-fail security gate in pre-deploy
Run header, TLS, and DNS authentication checks against the staging environment; fail the pipeline before promotion if posture regressed.
Free security-team review cycles
Routine pre-deploy validation runs unattended, leaving security headcount for design review and incident work.
Same checks across every deploy
One pipeline definition enforces the same security baseline on every release branch — no per-team drift in what gets validated.
Code Example
CI/CD security gate check
// GitHub Actions / GitLab CI security gate
async function securityGate(stagingUrl) {
const headers = { 'Authorization': 'Bearer YOUR_API_KEY' };
// Grade ranks: A=1, B=2, C=3, D=4, F=5 (lower is better)
const gradeRank = { 'A': 1, 'B': 2, 'C': 3, 'D': 4, 'F': 5 };
const MINIMUM_GRADE = 'B';
const [secHeaders, ssl, score] = await Promise.all([
fetch(`https://api.edgedns.dev/v1/security/headers?url=${stagingUrl}`, { headers }),
fetch(`https://api.edgedns.dev/v1/domain/ssl?domain=${new URL(stagingUrl).hostname}`, { headers }),
fetch(`https://api.edgedns.dev/v1/score/security?domain=${new URL(stagingUrl).hostname}`, { headers }),
].map(p => p.then(r => r.json())));
const issues = [];
// Check if grade is worse than minimum (higher rank number = worse grade)
if (gradeRank[score.data.grade] > gradeRank[MINIMUM_GRADE]) {
issues.push(`Security grade ${score.data.grade} below minimum ${MINIMUM_GRADE}`);
}
if (!secHeaders.data.headers.strictTransportSecurity) {
issues.push('Missing HSTS header');
}
if (ssl.data.daysUntilExpiry < 30) {
issues.push(`SSL certificate expires in ${ssl.data.daysUntilExpiry} days`);
}
if (issues.length > 0) {
console.error('Security gate FAILED:', issues);
process.exit(1);
}
console.log('Security gate PASSED');
}Learn More
Explore industry standards and best practices related to this use case.
Ready to build CI/CD Security Gate?
Get started with 200 free API requests per month. No credit card required.