Why (Continuous) Fuzzing
Dec 10, 2020Yevgeny Pats
Summary
This post details the challenges and solutions for integrating continuous fuzzing into CI/CD pipelines. It outlines the need for asynchronous jobs to handle long-running fuzzing tasks, strategies for selecting which versions to fuzz (master + stable branches), and the implementation of regression fuzz tests for merge requests to catch bugs early. It also mentions GitLab's Security Dashboard for reporting vulnerabilities found by fuzzers.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting