Security score
storefront · production
Open findings by severity, with the fix beside each one.
- Score
- 84
- Critical
- 0
- High
- 1
Illustrative interface with sample data.
All services
Protect what you run · Security
Find the risks before someone else does.
Vulnerable packages, leaked secrets, unpatched servers, weak domains and attacks, found on the servers and code you already run here, with the fix beside each one.
- Vulnerable dependencies
- Leaked secrets
- Server hardening and updates
- Attacks blocked automatically
Works with
- Composer
- npm
- OSV
- Ubuntu
- Cloudflare
- TLS
- SPF and DMARC
- SOC 2 evidence
Protect what you run
Security that knows what you run.
Your code and packages
Known vulnerabilities in Composer and npm packages, and secrets committed by mistake, checked on every deploy.
Your servers
SSH settings, open ports, pending security updates and who has access, graded, with one-click fixes.
Your domains
Certificates, TLS versions, security headers, SPF and DMARC, and DNS records that could be taken over.
Attacks and audits
Brute-force and scanning blocked automatically, access reviews, and compliance evidence ready for auditors.
Inside Security
What you can do
A closer look at what Security does, grouped by the work it supports.
Code
Ship without known holes
Problems in what you deploy, found before and after it goes live.
- Dependency scanningComposer and npm lock files checked against the OSV vulnerability database, with the version that fixes each one.
- Deploy gateStop a deploy that would ship a critical vulnerability, unless you’ve accepted the risk.
- Secret scanningAPI keys, passwords and private keys committed to your code or leaked into logs and error reports.
Servers
Hardened and patched
The servers you run here, checked like an auditor would.
- Hardening scoreSSH settings, root login, open ports, fail2ban and the firewall, graded per server with one-click fixes.
- Security updatesPending operating system updates on each server, applied on a schedule, with reboots in a window you choose.
- Team SSH keysGive members SSH access to chosen servers from their profile; it’s removed when they leave.
Edge
Domains and traffic
What the internet sees, and who’s knocking.
- Domains and emailCertificates, TLS versions, security headers, SPF, DMARC and CNAMEs that could be taken over.
- Firewall and botsCloudflare security level, bot protection and “under attack” mode per domain.
- Attack blockingBrute-force logins and scanners spotted in access logs and blocked automatically.
Compliance
Ready for the questionnaire
Evidence from what the platform already records.
- Access reviewsA regular review of members, roles, API tokens and SSH keys, with a record of each decision.
- Compliance reportsSOC 2 and ISO 27001-style evidence from your audit log, access reviews, backups and patching, ready to export.
A practical path through Security
Turn on. Scan. Fix.
Security uses what you already manage here, so there’s nothing to install.
- Turn on SecuritySwitch it on for a project; the first scans start straight away.
- Read the findingsSee the most serious problems first, each with what to do about it.
- Fix and confirmApply the fix, run the check again, and watch the finding clear.
Safety and accountability
Careful with what it touches.
Checks read what they need and change nothing unless you choose a fix. Findings about secrets never show the secret itself.
- Read-only checks
- Fixes only when you choose
- Secrets never displayed
- Ignored with a reason
- Recorded in the audit log
- Your servers and accounts
Better together
Works with the rest of BuildPusher.
- Deploy: Every deploy is scanned, and risky ones are stopped before they go live.
- Infrastructure: Server hardening, patching and SSH keys apply to the servers you manage here.
- Monitoring: Findings and blocked attacks use the same alerts and incidents.
Build and shipDeployRelease from Git to your own servers, with previews, approvals and a recovery point for every deploy.Servers you ownInfrastructureCreate servers in your own cloud accounts, host websites on them, and keep them backed up.Understand productionMonitoringUnderstand uptime, application behaviour and incidents across every environment you run.Understand your audienceAnalyticsSee how visitors find your site, what they read, and which visits turn into outcomes.See it as visitors doAuditWatch a simulated visitor use your site and your competitors’, and see what to improve, with pictures.
Good to know
Straight answers about Security.
Do I need to install anything?
No. Security reads what BuildPusher already manages: your deploys, servers and domains.
Will it change my servers?
Only when you choose a fix, or turn on automatic blocking or updates.
Where does vulnerability data come from?
The open OSV database, which collects advisories for Composer, npm and more.
Part of BuildPusher
Start with Security.
Every service has a free tier. Turn on the others when a project needs them, on the same account and bill.