Application Security
Get vulnerabilities fixed in production
Cantina writes the fix, opens the pull request, and merges it once CI passes. It then checks that the change is live in production.
Automate the engineering work behind each fix
Cantina handles the work required to resolve a vulnerability: making the code change, getting it through testing, and checking the deployment. For a vulnerable dependency, that can mean applying a firewall rule while the version update goes through CI.
Protect the application while the patch moves through CI
- 01
Limit exposure
Apply a web application firewall rule when the issue calls for one.
- 02
Submit the fix
Open a pull request with the code or dependency change.
- 03
Check CI and merge
Wait for the automated tests to pass before merging.
- 04
Verify production
Confirm that the deployed application includes the fix.
Fix pipeline
-
WAF rule active
blocking exploit path
-
Pull request opened
bump lodash 4.17.20 → 4.17.21
-
CI checks passed
142 checks green
-
Verified in production
fix live · rule retired
Check every stage of the fix, including deployment
-
Firewall rules
Block the vulnerable request path while the patch is being shipped.
-
Dependency updates
Open the version-bump PR for a vulnerable package.
-
CI checks
Use the project's automated tests before merging.
-
Deployment checks
Verify that the fix reached production.
What security teams say about Cantina
Security leadership
Cantina is the first platform we have used that carries the work through from finding an issue to driving the fix, and it lets my team operate like one far larger than it is. We keep finding new uses for it across our security program.
Matt Mock
Chief Information Security Officer
Watch Cantina patch a vulnerable dependency
See the firewall rule, pull request, CI results, and production check in a demo.