Security that runs on every deploy
PortDock checks your images, your code and your running applications, keeps the reports, and gives your organization the identity and access controls it expects.
- 01
git clone
- 02
Semgrep · SAST
- 03
docker build
- 04
Trivy
- 05
rollout
- 06
OWASP ZAP · DAST
Scanning
Three scanners, one pipeline
Turned on per application, each with its own settings — and a policy that can stop a risky release.
Image vulnerabilities
Every image is scanned for known vulnerabilities in OS packages and dependencies, before or after it goes live.
- Critical, high, medium and low with the fixed version
- Block the deploy on critical or high
- Ignore vulnerabilities without a fix
- A mirror of the database for servers without internet
Static analysis (SAST)
The source is analysed right after the checkout, before the build: injections, unsafe deserialization, weak cryptography, secrets, insecure Dockerfiles…
- Rule, file and line, CWE, description and fix
- Block the deploy on high findings
- Rule sets: p/default, p/owasp-top-ten, p/secrets or your own
- Manual scans of any branch
Dynamic scan (DAST)
Once the new version is live, a baseline scan explores it from inside the PortDock network and reports what it reveals — without attacking it.
- Missing security headers, insecure cookies, information leaks
- Instances and solution for every alert
- A custom URL per application
- In the background, the report attached to the deployment
Reports
Reports for every build and every deploy
Open a report in the browser or download it, one by one or all together. Each deployment page lists its scans with a single ZIP.
HTML
A self-contained report for people: summary, severities and every finding with its fix.
CSV
Opens in Excel — for audits, spreadsheets and tickets.
JSON
The normalized findings, for your own automations.
SARIF · Trivy · ZAP
The raw report of each tool, for code scanning platforms and security teams.
Controls
Identity, access and traceability
Everything a security review asks for, already there.
Identity
Sign in the way your company already does.
- OpenID Connect with PKCE: Entra ID, Okta, Google, Keycloak, Authentik
- LDAP / Active Directory with LDAPS or StartTLS
- Two-factor authentication with a policy for everyone
- Password sign-in can be turned off
Access
Least privilege, down to each project.
- Viewer, developer and maintainer roles per project
- Protected environments and approvals
- Read-only SQL console for members
- API tokens per user
Traceability
Who did what, when and from where.
- Audit log of every action with the IP address
- CSV / JSON export
- Streaming to a SIEM over webhook or syslog
- Deployment approvals recorded with a comment
Secrets and infrastructure
Encrypted at rest, pinned in transit.
- Variables and credentials encrypted with AES-256-GCM
- SSH keys encrypted, host keys pinned
- Secure cookies and signed webhooks
- Updates with a backup and automatic rollback
In the interface
Security, visible to everyone who needs it
Evaluate PortDock on your own infrastructure
Installation takes a few minutes on any Linux server. No licence key or registration is required.
$ git clone https://github.com/gavrilencu/PortDock.git portdock$ cd portdock$ sudo bash install.sh