TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Vulnerability Class Reduction

1 post · Jan 2025

What this trail covers

Cloudflare is actively working to reduce entire classes of vulnerabilities in its software development lifecycle. This includes enhancing static analysis tools with custom rulesets to proactively detect and block injection vulnerabilities and secrets in code. The company leverages automation, secure defaults, and developer training to prevent these issues from reaching production, aiming to meet CISA's 'Secure by Design' pledge goals. This has resulted in a 79% reduction of secrets in code and a 44% reduction of potential SQL injection and code injection vulnerabilities in the second half of 2024.

All Cloudflare trails
  1. Demonstrating reduction of vulnerability classes: a key step in CISA’s “Secure by Design” pledgeThis post details Cloudflare's proactive approach to reducing entire classes of vulnerabilities, specifically injection vulnerabilities and secrets in code, aligning with CISA's 'Secure by Design' pledge. It outlines the use of custom SAST rulesets integrated into CI/CD workflows to block these issues at the pull/merge request stage, leading to a 79% reduction in secrets and a 44% reduction in injection vulnerabilities in H2 2024. Future plans include further maturing secure frameworks, threat modeling, and developer training.