# Improving product reliability by imposing constraints as a part of CI/CD process

DevFeed: [Improving product reliability by imposing constraints as a part of CI/CD process](<https://devfeed.tech/articles/improving-product-reliability-by-imposing-constraints-as-a-part-of-ci-cd-process-26344.md>)

Original publisher: [Read original article](<https://medium.com/revolut/improving-product-reliability-by-imposing-constraints-as-a-part-of-ci-cd-process-597cf2307224?source=rss----44c5ac415e14---4>)

Author: Pedro Moura

Published: 2023-11-03T14:26:59Z

Content type: article

Language: en

Sources: [Revolut Engineering](<https://devfeed.tech/sources/revolut-engineering.md>)

Topics: [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Data analysis](<https://devfeed.tech/topics/data-analysis.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [blocking](<https://devfeed.tech/tags/blocking.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [data-analysis](<https://devfeed.tech/tags/data-analysis.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [sast](<https://devfeed.tech/tags/sast.md>), [sca](<https://devfeed.tech/tags/sca.md>), [scanners](<https://devfeed.tech/tags/scanners.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [software-development](<https://devfeed.tech/tags/software-development.md>)

## AI overview

Revolut describes a CI/CD approach that uses automated risk calculation, data analysis, security scanning, and deployment constraints to improve product reliability. The approach aims to identify vulnerabilities and bugs early, mitigate them, and potentially block high-risk applications from reaching production.

## Source excerpt

At Revolut, we always aim to consistently provide efficient, high-quality, and secure services. Our primary goals are to enhance product quality, increase customer satisfaction, and reduce business risk. To achieve those goals, we should aim to be as proactive -- rather than reactive -- as possible. This means fixing any point of failure before it reaches production by identifying, reporting, and potentially blocking deployments that can impact the reliability of our products. In this article, we'll explain how we achieve those goals using automated risk calculation, data analysis, and imposing constraints to push for the mitigation of open vulnerabilities and the fix of reported bugs identified in our products. Challenges faced by Revolut Each application/service has its own specifications, with different technology stacks and architectures, bringing a diversity of security challenges and different vulnerabilities. That being said, application risk cannot be based only on the reported security vulnerabilities but also in the context of that specific application. Continuous scanning, reporting, visibility, and risk evaluation are essential to providing the best security advice and automated security controls. Nowadays there are several types of security scanners (SAST, SCA, DAST, IaC, etc.) that help security professionals to identify and report vulnerabilities, where each of them can belong to a different third-party provider. For further information on these, read our article on continuous security. Data scraped from different sources creates friction when it's needed to group findings and provide mitigations. This can also decrease mean time to identify vulnerabilities and mean time to provide mitigations. Also, to avoid such negative workflow impact, security must be shifted left. Without a centralised source of truth for security-related application data, most of the time is wasted on searching for information/findings in segmented platforms and finding the corre