Onboarding #4:
StackHawk Application Security
Automation in CI/CD


Ryan Severns|September 2, 2020

Our onboarding guide walking you through how to get started with application security testing with StackHawk.

Getting Started with StackHawk

To help you get started, we have written this onboarding guide with all the tips and tricks about getting up and running with StackHawk. This post covers how to automate your application security testing in CI/CD.

stackhawk-onboarding-4-application-security-automation-img-1 image

CI/CD Automation

Security testing is best automated in your pipeline, helping developers fix any new bugs as close to commit as possible.

Whether on every commit or every pull request, kick off a StackHawk scan as part of your CI/CD pipeline. Thankfully, moving from local scans to CI/CD automation is simple.

stackhawk-onboarding-4-application-security-automation-img-2 image

Here are a few CI/CD tips:

  • Scan Microservices for Faster Performance: While our scanner is fast, there is only so much you can do for performance when scanning a monolith or customer facing production application. Whenever possible, we recommend scanning at the microservices layer for faster performance (and typically faster fixes).

  • Triage Findings for Blocking Mode: You can configure your pipeline scans in non-blocking or blocking mode. We recommend doing an initial triage of your findings so that you have no new findings showing in terminal output or our web app before instrumenting in blocking mode, allowing you to break build if there are any newly introduced bugs.

Read our documentation to get started with automation for your CI/CD provider.

Next Up: tips on integrating StackHawk with the rest of your engineering tooling.

As always, we are here to help at support@stackhawk.com.

Ryan Severns  |  September 2, 2020