Dependencies
Ruff
Rationale We use Ruff to lint and format Python source code. Ruff allows us to achieve the following: Lint Python files in an extremely fast fashion with hundreds of rules inherited from other linters like pyflakes, flake8, pylint, among others. Such ...
In-house: Platform audit logs
Rationale Audit logging for Fluid Attacks' platform is performed by an in-house implementation. Such implementation uses AWS DynamoDB Streams and Lambda triggers to update a separate database that is completely focused on providing real-time ...
In-house: Platform authorization
Rationale Authorization flows for Fluid Attacks' platform are performed by an in-house implementation. Such implementation currently supports: Role permissions based on specific API resolvers. Organization-level, group-level and user-level access for ...
In-house: Platform authentication
Rationale Authentication flows for Fluid Attacks' platform are performed by an in-house implementation. Such implementation currently supports: OAuth with Microsoft Azure OAuth with GitLab OAuth with Bitbucket Email-based OTP tokens for two factor ...
Visual Studio Code
Rationale VSCode is the code editor used by Fluid Attacks' engineering team. The main reasons why we chose it over other alternatives are: It is Open source. It is a modern code editor. It supports thousands of extensions, making it very flexible. It ...
Docker
Rationale Docker is the containerization tool used by Fluid Attacks' infrastructure. The main reasons why we chose it over other alternatives are: It is Open source. It is the most popular containerization tool in the market. GitLab CI and AWS Batch ...
Hypercorn
Rationale Hypercorn is the web-server used by Fluid Attacks' Platform. The main reasons why we chose it over other alternatives are: It is Open source. It has full asynchronous programming support, which is critical for performance. It supports both ...
Ariadne
Rationale Ariadne is one of the main libraries used by Fluid Attacks' API. The main reasons why we chose it over other alternatives are: It is Open source. It is built for GraphQL, the query language the API uses. It supports Asynchronous ...
Tree-sitter
Rationale Tree-sitter is the core library used by Fluid Attacks' scanner. It is critical for reporting Static Application Security Testing (SAST) vulnerabilities to our clients. The main reasons why we chose it over other alternatives are: It is Open ...
Starlette
Rationale Starlette is the backend framework we use for our Platform. The main reasons why we chose it over other alternatives are: It is Open source. It is a high-level framework that reduces cognitive complexity for developers by providing things ...
React
Rationale React is the main frontend library we use. The main reasons why we chose it over other alternatives are: It is Open source. It is a low-level library, meaning that is is highly flexible and powerful at the cost of providing too many ...
GraphQL
Rationale GraphQL is the query language we use for our official API. The main reasons why we chose it over other alternatives are: It is Open source. It provides a very flexible syntax that allows end users to fetch exactly the data they need. It ...
Sops
Rationale Sops is the tool we use for managing most of our organizational secrets like passwords, access keys, PII, among others. It allows us to version encrypted files within our Git repositories in a stateless approach. The main reasons why we ...
Makes
Rationale We use Makes to easily create reproducible tasks for any programming language and system architecture. Makes allows the following: Build environments for all our products (Python, TypeScript, Terraform, Go, Cue, Kotlin, etc.) Build CI/CD ...
Kubernetes
Rationale Kubernetes is the system we use for hosting, deploying and managing our applications. It comprises infrastructure solutions like RBAC Authorization, distributed persistent storage, managing resource quotas, managing DNS records, managing ...
Commitlint
Rationale Commitlint is the tool we use to standardize our commit messages and enforce compliance during CI/CD tests. By using Commitlint, we achieve well-structured commit messages that: Follow a convention Are readable for humans and machines The ...