<p>A well-established CI/CD pipeline gets entwined with many enterprise processes and the security of the pipeline gets more and more crucial. In this article, we will outline how <a href="https://appcircle.io">Appcircle</a> ensures the mobile app security of your CI/CD pipeline.</p>
<h2 id="code-security-in-appcircle">Code Security in Appcircle</h2>
<ul>
<li>Appcircle connects to your repository to fetch your projects and branches so that you can build your apps in the cloud, however, the source codes are not stored in Appcircle infrastructure.</li>
<li>The source code is fetched for the build only to a brand-new build agent specifically created for that build. Once the build is complete, the agent is killed along with all the source code and any leftover data from the build.</li>
<li>Using OAuth, Appcircle is able to support GitHub, GitLab, and Bitbucket. The agents connecting to your repositories follow the protocols enforced by the repository providers. As Appcircle connects to your repository using a read-only token, Appcircle doesn&#8217;t have write access to cloned repositories.</li>
<li>For all other repository providers, the only provided option is to use SSH connections for the utmost security.</li>
<li>Appcircle never modifies the contents of the repository itself. During the build, it is possible to modify the contents with custom scripts and workflow steps, but these are not permanent and only applicable to the local copy.</li>
<li>Appcircle team does not have access to the source code for any means and purposes. The OAuth tokens or the SSH keys are stored securely in HashiCorp Vault and they are only used to fetch the branch and commit list or during the build.</li>
</ul>
<h2 id="ci-cd-infrastructure-security-in-appcircle">CI/CD Infrastructure Security in Appcircle</h2>
<ul>
<li>Appcircle fully runs on GCP, which considers cloud security as the highest priority with many built-in security features and services. For more information on cloud security, please refer to the <a href="https://cloud.google.com/security">Google Cloud Security</a>.</li>
<li>Appcircle is built on Kubernetes. For every single build, there is a brand-new virtual machine specifically created for you. This makes it possible for Appcircle to protect and keep your source codes isolated.</li>
<li>The virtual build agents are separated from each other and they are not directly accessible from the outside.</li>
<li>Even your concurrent builds run on different containers which eliminate the chances of conflicts and instability.</li>
<li>After the build is done, the virtual machine is killed and there is no residual data storage.</li>
<li>Only the selected build artifacts and the build logs are retained, and they are not accessible by the Appcircle team.</li>
<li>If you use Cache Pull and Cache Push components, artifacts are stored on different buckets and only accessible by the same organization. Upload and download URLs are signed and can only be accessed for a short period of time.</li>
<li>Virtual Build agents communicate with SSL. All the communication keys and tokens are rotated constantly.</li>
</ul>
<h2 id="data-security-in-appcircle">Data Security in Appcircle</h2>
<ul>
<li>All secret data, including the keys, signing identities, environment variables, and secrets are stored in an HashiCorp Vault. Vault keys are unsealed by GCP Cloud KMS which provides extra security. Since these are highly confidential and crucial elements for DevOps, Appcircle provides the best-in-class security for any private element.</li>
<li>For instance, the secret environment variables (both text keys and files) are not accessible externally. They can only be utilized in a build and they cannot be exposed by the build module users (e.g. they are automatically removed from the build logs). They cannot be modified and the only way to update them is by deleting and re-adding.</li>
<li>As for the signing identities, again, if a user does not have access to the signing identities module, they cannot view, download or edit the signing identities while being able to use them in builds.</li>
<li>You can be highly confident when sharing the build logs with developers or others for any kind of assistance needed. They can see neither your secrets nor the signing identities.</li>
<li>Appcircle uses <a href="https://www.keycloak.org/">Keycloak</a> for Identity and Access Management. Appcircle provides different authentication methods, such as OpenID/SAML SSO, GitHub, Bitbucket, Google, Microsoft and two-factor authentication. If you use email login, Appcircle requires you to choose a complex password during registration.</li>
</ul>
<h2 id="enterprise-grade-user-management-and-logging-in-appcircle">Enterprise-Grade User Management and Logging in Appcircle</h2>
<ul>
<li>For enterprises, Appcircle provides fine-grained permissions for all submodules so that you can manage which user can access which module at what level. This makes it well-suited for a team without the need to worry about widespread access.</li>
<li>Appcircle provides logs for all modules so that the enterprise admin can track which build is done by whom. This provides full transparency and visibility across the entire platform.</li>
<li>If you delete your user, no data is kept. All artifacts, keys and secrets are deleted completely.</li>
</ul>
<h2 id="billing-safety-with-appcircle">Billing Safety with Appcircle</h2>
<ul>
<li>Appcircle uses <a href="https://stripe.com">Stripe</a>, which is world’s one of the most used and trusted payment platforms. Your credit card information is never stored in Appcircle and does not pass through Appcircle infrastructure.</li>
<li>The Stripe platform is the only place where transactions are made, and 3D Secure is used for all transactions with supported credit cards.</li>
</ul>
<h2 id="even-higher-security-with-private-cloud-and-on-premise-options">Even Higher Security with Private Cloud and On-Premise Options</h2>
<ul>
<li>You may use your own machines to run your builds completely isolated from others.</li>
<li>Appcircle also provides private cloud and on-premise deployments as well. Even though Appcircle provides high security, you can optionally ensure that the full CI/CD pipeline is hosted in your own infrastructure.</li>
</ul>
<p>With Appcircle, you can manage the full CI/CD pipeline of mobile apps in a secure and trusted environment.</p>


Mobile App Security: How to Make Your App Secure

Related Posts

Speed Up your Release Process with Appcircle’s Azure Bot for SwiftLint and Detekt

Using Azure Boards for Mobile App Development

Streamline Project Integration and Test Automation with Repeato and Appcircle

Multi-Layered Team Management in Mobile DevOps

Mobile App Security: How to Make Your App Secure

Related Posts

Speed Up your Release Process with Appcircle’s Azure Bot for SwiftLint and Detekt

Using Azure Boards for Mobile App Development

Streamline Project Integration and Test Automation with Repeato and Appcircle

Multi-Layered Team Management in Mobile DevOps

Subscribe to Appcircle Circle