Avito Details Security Gates Implementation to Enforce Vulnerability Remediation Without Disrupting Developers

Avito has published an in-depth technical case study on implementing security gates that enforce vulnerability remediation policies while minimizing friction for development teams. Alexander Trifanov, head of Application Security at the company, describes nearly ten years of experience building controls that prevent SLA violations without turning security into a bottleneck.

The article defines a security gate as any automated check that can block or allow actions based on policy. Quality gates focus on code standards and functionality, while security gates target vulnerabilities and compliance. Both rely on a signal source, policy engine, and enforcement mechanism, but the latter protects against risk accumulation at company scale.

Trifanov explains that manual SLA extensions quickly erode control. Developers learn that deadlines can be moved, leading to repeated violations. A properly designed gate forces explicit risk acceptance by security before problematic actions proceed.

Pipeline Architecture and False-Positive Handling

Avito rejected synchronous scanner execution inside CI/CD pipelines. Instead, pushes trigger asynchronous orchestration of SAST, SCA, secret detection, and YAML configuration checks. Results are normalized in ASOC or SOAR, then automatically assigned to service owners with SLA-based priorities.

Each finding tracks three fields: status (active/inactive), verification_status (valid, false candidate, false positive), and verification_reason. Automated heuristics, validators, and limited AppSec review reduce noise before tasks reach developers.

Key requirements for any gate include robust false-positive workflows, deduplication of near-identical findings, and an emergency bypass switch. The bypass proved critical for business continuity during incidents.

First Gate at Deployment Stage

The initial gate queries SOAR at deployment time and blocks releases containing active vulnerabilities past SLA. High-severity issues trigger immediate blocks; medium-severity issues allow two full sprints before enforcement.

Services in maintenance mode rarely trigger gates because deployments are infrequent. Avito therefore created a manual “red button” that can block entire organizational units (groups of teams) from deploying any services until issues are addressed. The capability has never been used, yet its existence drives higher compliance.

Pre-receive Gate and Library Handling

A second, earlier gate uses server-side pre-receive hooks in GitHub, GitLab, and Bitbucket. Only fast scanners run within a strict ten-second limit. Rejected pushes return the finding identifier so developers can request false-positive validation.

Feedback revealed developers reluctant to pin library versions and analysts storing non-deployed code. These edge cases led to a dedicated library-update flow that scans requests before packages are fetched in development environments or CI/CD.

Kubernetes and Kyverno Experiments

Attempts to embed policy enforcement directly into Kubernetes using Kyverno are discussed as an ongoing direction for covering services that bypass traditional pipelines. The article concludes that multiple overlapping gates at different lifecycle stages reduce the impact of any single missed detection.