Continuous Penetration Testing in Delivery (Continuous Penetration Testing In Delivery)

Continuous Penetration Testing in Delivery

Wire open-source scanners from the ProjectDiscovery ecosystem into CI so findings block or ticket before EC2 promote.

pipeline stage: ProjectDiscovery scanners

Yıllık PDF pentest, sürekli riski kapatmaz.

Concepts, defined where they first appear

📦 Analysis API
Django read/analysis endpoints consumed by MFEs and the control plane.

📦 Closed Network CI
Pipelines on self-hosted GitLab CE runners inside a closed network.

📦 Artifact
Versioned deploy package shipped to EC2.

📦 Continuous Pentest
Open-source security scanning in the pipeline (ProjectDiscovery ecosystem).

Blurring these layers produces the wrong truth in analytics and on the map UI.

Shape of the problem

Wire open-source scanners from the ProjectDiscovery ecosystem into CI so findings block or ticket before EC2 promote.

pipeline stage: ProjectDiscovery scanners

The split that works

Yıllık PDF pentest, sürekli riski kapatmaz.

pipeline stage: ProjectDiscovery scanners
        ↓
   explicit contract → frontend

Frontend bridge

Ops maps, wait-geofence UI, and MFEs consume these read models — they never bind to raw ERP/MySQL.

The mappings that get confused most often

❌ ERP MySQL = analytics database
✓ ERP is a write store; analytics lives in PostGIS

❌ Let the map trust public/vendor routers blindly
✓ Production needs your API/OSRM edge

❌ Log ML outputs with PII
✓ Evaluation and serving obey privacy boundaries

A checklist for auditing your own system

1. Which store is source of truth for this surface?
2. Which API contract does the frontend call?
3. What happens if one cluster node dies?
4. How is lag shown to operators?
5. Deny-list: any client domain/vendor leakage?

What to take away from this part

1. Polyglot stores exist for different workloads; one-DB fantasies are fragile.
2. Frontends consume clean read models, not the ERP.
3. ML/OSRM outputs need an API contract before they hit the map.

A beautiful map drawn from a dirty source is still a lie.