Swif.ai employs a comprehensive set of security scanning tools to ensure the safety and integrity of our code, containers, infrastructure, and application secrets.
Below is a summary of the primary tools in use, their purposes, and how they are integrated into our workflows.
1. SonarQube
Purpose:
SonarQube is an open-source platform for continuous inspection of code quality. It performs automatic reviews with static analysis to detect bugs, code smells, and security vulnerabilities across 29 programming languages.
Usage at Swif.ai:
Integrated with our GitLab repositories.
Runs on every commit through automated CI pipelines to the dev or stage branch.
Developers are required to address new alerts on their commits.
2. Trivy
Purpose:
Trivy is an open-source vulnerability scanner for container images, file systems, and Git repositories. It is especially effective for scanning Java-based and Go applications.
Usage at Swif.ai:
Used to scan Docker images for vulnerabilities in both system packages and application dependencies.
Run on every PROD build.
Integrated into CI/CD pipelines for automated scanning.
Example scan command for Java-based Docker images:
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd)/trivy-output:/trivy-output docker.io/aquasec/trivy image --severity HIGH,CRITICAL --format json --db-repository aquasec/trivy-db:2 --java-db-repository aquasec/trivy-java-db:1 --timeout 10m xxx.xxx.io/st-apis:6de20dc6
Results are output in JSON format for further processing and review.
3. kube-bench
Purpose:
kube-bench is an open-source tool that checks whether Kubernetes clusters are deployed securely according to the CIS Kubernetes Benchmark.
Usage at Swif.ai:
Used to audit both production and development Kubernetes clusters.
Regular scans are performed, especially after cluster upgrades.
Ensures compliance with security best practices for Kubernetes configuration.
Example findings include checks on file permissions, ownership, and secure configuration of kubelet and kube-proxy.
4. Azure Key Vault (Secret Management)
Purpose:
Azure Key Vault is Microsoft Azure's managed service for storing and controlling access to secrets, keys and certificates. Swif.ai uses it to keep application secrets (database credentials, API keys, auth secrets) out of source code, deployment files and CI/CD pipelines.
Usage at Swif.ai:
All Swif.ai application services read their environment variables from Azure Key Vault. That's 20 services and 23 workloads, including the Kafka consumers.
Secrets are no longer stored in plain text in Git, deployment manifests or CI/CD pipeline substitutions.
Each environment (Development, US Production and EU Production) has its own vault and its own access controls, so the environments are fully separated.
Each variable is stored as its own secret, scoped to a single application.
To rotate a secret, we update it in the environment's vault and redeploy the service. No code or configuration change is needed.
When we migrated, every service was redeployed with the same image. Its environment was checked value by value before and after (they matched), and all workloads were confirmed healthy.
Security Scanning Practices
Automation: Scanning is automated for code (SonarQube), containers (Trivy), and infrastructure (kube-bench).
Frequency: Scans are performed on every commit (code), during CI/CD builds (containers), and quarterly or after major upgrades (Kubernetes).
Remediation: Developers are expected to address new vulnerabilities as they are detected.
Secret management: Application secrets are kept in Azure Key Vault, with one vault per environment, and loaded when a service is deployed. Secrets are never committed to source control or injected by pipelines.
Summary
Tool | Target | Purpose |
SonarQube | Source Code | Static code analysis, bug & vulnerability detection |
Trivy | Docker Images | Vulnerability scanning for containers & dependencies |
kube-bench | Kubernetes Clusters | CIS benchmark compliance & cluster hardening |
Azure Key Vault | Application Secrets | Centralized, per-environment secret storage and rotation |
By leveraging these tools, Swif.ai maintain a robust security posture across our software development lifecycle and infrastructure.
If you have questions about accessing dashboards or running scans, please reach out to the Swif.ai Support team.