Integrations
Connect third-party services for deeper security analysis.
Integrations let Vergate access your cloud provider accounts and run provider-specific security checks. Credentials are encrypted with Fernet encryption before storage.
#Supported Providers
GitHub
Branch protection, secret scanning, Dependabot, repo settings.
Vercel
Password protection, environment variable exposure.
Netlify
SSL, HTTPS enforcement, security headers.
Supabase
RLS, API exposure, MFA, OTP settings.
Cloudflare
SSL mode, HSTS, DNSSEC, WAF rulesets, min TLS.
Firebase
Firestore rules, hosting, service account auth.
Railway
Env var secrets, service exposure, deploy config.
Stripe
Webhook config, key mode, API key inventory.
Fly.io
TLS cert expiry, network exposure, apps.
Render
Env var secrets, auto-deploy, services.
Slack
Bot permissions, channel exposure, token type.
Code ScansBeta
GitHub Actions workflow security analysis.
#How Credentials Are Stored
All credentials are encrypted using Fernet symmetric encryption before being stored in the database. The encryption key is set via the INTEGRATION_ENCRYPTION_KEY environment variable.
#Health Checks
Each integration has a health check that validates the stored credentials against the provider's API. If a token expires or is revoked, the integration will show as unhealthy.
#Security Scanning
Once connected, you can run security scans against your integrations. Each provider has a dedicated analyzer that checks provider-specific security configurations:
| Provider | Checks |
|---|---|
| GitHub | Token validity, branch protection, secret scanning, Dependabot |
| Vercel | Token validity, password protection, sensitive env vars |
| Netlify | Token validity, SSL, HTTPS, security headers (CSP, HSTS) |
| Supabase | Connectivity, RLS, API exposure, MFA, OTP expiry |
| Cloudflare | SSL mode, Always HTTPS, HSTS, DNSSEC, min TLS, WAF |
| Firebase | Service account auth, Firestore rules, hosting sites |
| Railway | Token validity, env var secrets, deployment URLs |
| Stripe | Key validity, test/live mode, webhook config, API keys |
| Fly.io | Token validity, TLS cert expiry, IP assignments |
| Render | Token validity, env var secrets, auto-deploy |
| Slack | Token validity, token type, channel exposure, message access |