Wisec

A build that breaks your rules stops at the gate.

Which rules must a build meet to go on, and who decides?

You write block or warn policies for your organisation. The Wisec gate enforces them in your pipeline, after analysis, and shows what was broken.

Policy as Codeblock / warnSigned gate requests
1 · Notify

Notarisation never blocks.

The first step, wisec_notify, collects, signs and sends the build, then hands back. Your pipeline carries on while Wisec analyses.

2 · Gate

The gate waits for the verdict.

At the end of the pipeline, wisec-agent --gate polls Wisec until the analysis is done, then reads the result of your policies.

Being analysedPassed
3 · Block

One block rule, and the build stops.

A hardcoded secret, a CVE above your threshold, a critical file changed, an unapproved contributor, a score under your minimum: the gate exits with an error and shows the violations.

Being analysedPassedStopped at the gate
4 · VEX

A triaged CVE stops blocking.

A vulnerability declared not affected or fixed in the signed VEX is removed from the gate. The secret still blocks: it has to come out of the code.

Being analysedPassedStopped at the gate
The policies

Five rules, two moments.

Each policy has an action: block fails the gate, warn is logged without failing. They are managed per organisation, by an administrator.

PolicyEvaluatedFires on
secrets_detectedbefore analysisA hardcoded secret found by gitleaks
critical_file_modifiedbefore analysisA change to a critical file (CI configuration, Dockerfile…)
unapproved_contributorbefore analysisA commit author missing from your approved contributors
cve_severityafter analysisA CVE at or above your severity threshold
risk_thresholdafter analysisA build security score under your minimum
In the pipeline

Two steps, one blocking point.

The gate is the only place a policy blocks. Without the wisec_gate step, no block policy ever fails your pipeline: the build is notarised, nothing more.

  • WISEC_GATE_TIMEOUT How long to wait for the analysis, 120 seconds by default.
  • WISEC_STRICT When true, the gate fails if the analysis is not done in time; when false, it lets the build through.
  • Signed requests. Each gate call is signed with the agent key, valid for five minutes and bound to the project and the commit.
./wisec-agent --gate
Book a demoRead the documentation