Security included

Every Apply.Build app ships with a WAF, isolation and vulnerability scanning at no extra cost. Here's what that looks like for acme-shop, a small web shop.

Protect

Bots start probing your app as soon as it's online.

Automated scanners crawl the internet looking for new sites. They search for exposed config files and password files, try common passwords on login forms, and send malformed requests hoping to reach your database. Apply.Build puts a web application firewall (WAF) in front of every app. It filters this traffic before it ever reaches your code, and there's nothing to configure.

  • See who's attacking. A live view shows blocked requests, where they come from, and what they tried.
  • Your app runs in its own sealed box. Each app gets its own micro-VM, a lightweight virtual machine. A compromised app next door can't reach yours.

Elsewhere: a separate firewall service with its own setup and bill.

app.apply.build/security

Patch

Most of your app's code was written by someone else.

acme-shop depends on hundreds of open-source packages. When a security flaw is found in one of them, your app is exposed until you update, and nobody tells you. Apply.Build continuously checks every package your app ships with. When a flaw turns up, you're told which app is affected, which package causes it, how serious it is, and which version fixes it.

  • A full list of what's inside your app. We record every package in each build, in a format known as an SBOM (software bill of materials). It's the inventory customers, auditors and the EU Cyber Resilience Act increasingly ask for.
  • Alerts where you already work. Vulnerability alerts go to Slack or Discord.

Elsewhere: a separate dependency-scanning tool.

Also on by default

Micro-VM isolation

Each application runs in its own lightweight virtual machine with a memory-safe hypervisor. Strong isolation means a compromised neighbour cannot affect your workload.

Guardrails by default

TLS is automatic. All traffic flows through a single controlled ingress point. Environment variables are encrypted at rest.

Alerts where you work

Vulnerability findings and app status changes go straight to Slack or Discord, so nothing waits for you to log in.

Ready to deploy securely?

Start with a free tier. All security features are included from day one.

Deploy your first app free