Integrations · DevSecOps
Your pipeline already produces the evidence. Send it.
Engineers should not have to translate their own work into compliance artifacts by hand. CertiField takes the output your pipeline already generates and binds it to the controls it bears on, at the point it is produced.
- GitHub · GitLab webhooks
- Signature validated
- CI scan ingest
- Two-way Jira sync
- Ref
- I-21
- Kind
- Repositories
- GitHub
- HMAC signature
- GitLab
- constant-time token
Webhooks that verify who sent them.
GitHub and GitLab webhooks are accepted with provider signature validation — HMAC for GitHub, a constant-time token comparison for GitLab. Pipeline runs are recorded against the repository link so a scan result has a build behind it rather than arriving as an anonymous file.
Machine-to-machine ingest uses API keys scoped to an organization, with the secret stored as a salted hash and an optional IP allowlist. A key with no organization binding is rejected outright rather than defaulting to something permissive.
- Ref
- I-22
- Kind
- CI ingest
- Parsers
- Grype · Trivy · Gitleaks · Semgrep
Four pipeline scanners, parsed on arrival.
Gitleaks
Findings are stored, but the secret never is. Both the matched secret and its surrounding context are redacted before the raw payload is kept — copying a live credential into a system that is backed up, replicated and rendered into authorization packages would spread the exposure rather than record it.
Semgrep
Parse errors are carried across as informational coverage gaps. A file Semgrep could not read is a file it did not scan, and counting it clean is how an unscanned path reaches a package unnoticed.
Trivy
Table output is refused with a message naming the flag you need rather than failing somewhere deep as invalid JSON. The error tells you what to change.
Grype
A clean run is recorded, not discarded as a suspected schema mismatch. Storing the clean scan is what lets previously-open findings show as resolved instead of leaving the last dirty scan as the newest data point forever.
All four upload by hand as well, in the same formats. There is no separate manual path to keep in step with the automated one.
- Ref
- I-23
- Kind
- Jira
- Direction
- two-way
- Credential
- encrypted at rest
Remediation stays where engineers already work.
POA&M items and checklist findings sync with Jira in both directions, so an engineer closing a ticket updates the authorization record without opening a second tool. Status syncs on a short cycle; history syncs hourly and is guarded so a slow backfill cannot stampede.
Jira accounts map to CertiField users, so an assignment means the same person on both sides. The API token is encrypted at rest and never returned by any endpoint.
- POA&M items raised and tracked as Jira issues
- Status flows back so the record reflects real progress
- User mapping so assignment is meaningful in both systems
- No second tracker for engineers to forget about
Next step