Book a Security Review

The pipeline we run ourselves

Every control on this page is one we operate for our own platform, every day.

Security bolted on at the end costs a release. We build it into each stage, from the commit to the running process, and we hold ourselves to it before we ask a client to: the academy, the scanner and the Dome all ship through this exact pipeline.

Seven stages

From the commit to the running process

  1. 01

    Source

    A self-hosted forge, protected branches, and a static analysis gate on every pull request that must come back with zero findings at every severity before a merge.

    Forgejo, Bearer

  2. 02

    Build

    Images built on our own runners without a Docker daemon, from minimal signed base images, with every dependency pinned to a digest.

    Kaniko on Kubernetes runners, Wolfi and Chainguard bases

  3. 03

    Sign

    Every image is signed at build time with keys that never leave the vault. A weekly run mirrors and re-signs the third-party images we depend on.

    cosign, keys held in OpenBao

  4. 04

    Admit

    The cluster refuses to run an image that is not signed by us. There is no exception path.

    Sigstore policy-controller

  5. 05

    Deploy

    Nothing is applied by hand. A manifest names each image by digest, a pull request changes it, and the cluster converges on what the repository says.

    ArgoCD, GitOps

  6. 06

    Run

    Immutable nodes with no shell, workloads that do not trust each other, untrusted code in a sandbox, and post-quantum encryption between every service.

    Talos Linux, Kuma mesh with ML-KEM-1024, gVisor, Cilium

  7. 07

    Detect

    Kernel-level detection sees privilege escalation and credential access as they happen, and an alert reaches a human.

    Tetragon, eBPF

Want to talk through your DevSecOps pipeline?

Tell us where you are today and where you want security to fit in.

Talk to our team