05 · Secure
Security evidence on a schedule.
Scheduled scans, guardrails before deploy, and a record of who changed what.
Real Shipfast screen · sample data
Scans
CIS and policy scans, on a schedule.
kube-bench and Checkov, on the schedule you set.
- CIS Kubernetes benchmark per cluster
- Scheduled or on demand
- Results kept for every review
Real Shipfast screen · sample data
Before deploy
Risky settings stopped early.
kubesec checks every template when it is rendered.
- A clear reason for every flag
- Same rules for every team and client
- Risky kinds blocked on shared clusters
Render check · workerkubesec
spec: containers: - name: worker securityContext: privileged: true
BlockedPrivileged container. Remove
privileged: true to continue.IllustrativeChecked before it reaches a cluster
Access and audit
Who did what, and exactly what changed.
Sign-in, roles and API keys in one place.
- Keycloak SSO and GitHub sign-in
- Roles to create, deploy, approve and view
- Activity log with a diff for every change
Activity logtoday 11:42 · Asha (DevOps)
Changedclient-portal · productionvariables
- WORKER_MEMORY: 512Mi+ WORKER_MEMORY: 1Gi- API_REPLICAS: 3+ API_REPLICAS: 4
IllustrativeEvery change, with a diff
How it works
From cluster to audit-ready.
ConnectScans ready straight away.
SchedulePick when they run.
FixFindings with clear reasons.
ProveResults and the log, at every review.
FAQ
Questions, answered.
Which benchmarks are covered?
The CIS Kubernetes benchmark through kube-bench, plus Checkov policies and kubesec checks.
Can we sign in with our identity provider?
Yes, through Keycloak single sign-on, or with GitHub.
Is every change recorded?
Yes. The activity log keeps who changed what and when, with a diff.
Where can I read more about security?
See the Security and trust page for how Shipfast handles access, data and disclosure.
Now onboarding pilot teams
Ready to ship faster?
Bring one app. We'll connect a cluster and ship a release with you.