Security and Compliance Plugins

Security and compliance plugins connect Release with tools for secrets management, vulnerability scanning, code analysis, and policy enforcement. You can use these integrations to add security gates to your release pipelines, pull secrets from external vaults at runtime, scan code for vulnerabilities, and enforce policies before deployments proceed.

Available Plugins

Secrets Management

• Conjur Plugin - Store and retrieve secrets using CyberArk Conjur.
• Conjur Connection Plugin - Configure shared Conjur connections for your team.
• HashiCorp Vault Plugin - Retrieve secrets from HashiCorp Vault.
• Azure Keyvault Integration - Retrieve secrets from Azure Key Vault.
• AWS Secrets Manager Plugin - Retrieve secrets from AWS Secrets Manager.

Vulnerability Scanning and Code Analysis

• Checkmarx Plugin - Run static application security testing (SAST) scans.
• Black Duck Plugin - Scan for open-source vulnerabilities and license risks.
• Fortify SSC Plugin - Retrieve scan results from Fortify Software Security Center.
• Fortify on Demand Plugin - Run cloud-based Fortify security scans.
• SonarQube Plugin - Check code quality gates and analysis results.
• Sonatype Nexus IQ Plugin - Evaluate component vulnerabilities and policy violations.

Policy and Risk

• OPA Integration - Enforce policies using Open Policy Agent.
• Change and Risk Prediction (CRP) Plugin - Predict deployment risk based on historical data.