Hosting Platform Integrations
Overview
Section titled “Overview”Fencer integrates with popular hosting platforms to scan your cloud infrastructure for security misconfigurations. By connecting Heroku, Render, Railway, Vercel, DigitalOcean, or Supabase, you get automated security checks tailored to each platform — covering areas like database exposure, access control, environment variable hygiene, and deployment protection.
Each integration creates a cloud account asset in Fencer and triggers infrastructure scanning. All of them except DigitalOcean also sync team member identities for access tracking.
Prerequisites
Section titled “Prerequisites”- The Administrator role in Fencer and a valid subscription.
- An account on the hosting platform you want to connect.
- For OAuth-based platforms (Heroku, Railway, Vercel, DigitalOcean): you must be able to authorize Fencer’s OAuth application.
- For Render: an API key. For Supabase: a personal access token. Each needs read access to your account resources.
How it works
Section titled “How it works”When you connect a hosting platform, Fencer stores your credentials securely (encrypted at rest) and queries the platform’s API to enumerate your infrastructure resources — services, databases, storage buckets, team members, and configuration. Each resource is checked against a set of platform-specific security rules. Fencer scans right after you connect, then daily (weekly on plans without daily scans).
Findings are reported as vulnerabilities with severity levels (Critical, High, Medium, Low) and linked to the specific asset where the issue was detected. Team members discovered through the integration are synced as vendor identities for identity management when your plan includes it.
Connecting a hosting platform
Section titled “Connecting a hosting platform”Navigate to Admin > Integrations in your organization, click the card of the hosting platform you want to connect, and click Continue. The rest of the flow varies by platform:
Heroku
Section titled “Heroku”- Enter Name or alias for this Heroku connection and choose an Environment (e.g., Production).
- Click Connect Heroku. A popup takes you to Heroku to authorize Fencer with the
identity,read, andread-protectedscopes. - After authorization, Fencer stores the OAuth tokens and begins scanning.
Render
Section titled “Render”- Enter Name or alias for this Render connection, choose an Environment, and paste your Render API key.
- Fencer loads the workspaces the key can access. Select one under Render workspace.
- Click Connect.
Railway
Section titled “Railway”- Click Connect Railway. You are redirected to Railway to authorize Fencer via OAuth.
- Review the permissions and click Allow. Fencer then fetches your workspaces, projects, and services.
Vercel
Section titled “Vercel”- Click Connect Vercel. You are redirected to Vercel to add the Fencer integration.
- After authorization, Fencer detects whether you connected a team or personal account and begins scanning projects.
DigitalOcean
Section titled “DigitalOcean”- Click Connect DigitalOcean. You are redirected to DigitalOcean; review the permissions and click Authorize Application.
- Back in Fencer, enter Name or alias for this DigitalOcean connection, choose an Environment, and select the DigitalOcean Project to scan.
- Optionally turn Scan registry images and Scan container images on or off, and limit Regions to scan.
- Click Connect to create the connection and start the first scan.
Supabase
Section titled “Supabase”- Enter Name or alias for this Supabase connection, choose an Environment, and paste a personal access token into Supabase API key.
- Select your Supabase organization, then choose a Supabase project or All Projects.
- Click Connect. Fencer validates the token and begins scanning.
Security checks by platform
Section titled “Security checks by platform”Each platform has tailored checks based on its infrastructure model.
Heroku
Section titled “Heroku”| Check | Severity | Description |
|---|---|---|
| Account 2FA | High | Verifies two-factor authentication is enabled on the Heroku account. |
| Deprecated stack | High | Flags apps running on deprecated runtime stacks. |
| Beta stack | Medium | Flags apps running on beta runtime stacks. |
| Addon open to internet | Medium | Tests whether addon database URLs are reachable from the public internet. |
Render
Section titled “Render”| Check | Severity | Description |
|---|---|---|
| Public database | High | Detects Postgres databases with no IP allowlist. |
| Account 2FA | High | Flags workspace members without MFA enabled. |
| Shell access without 2FA | High | Members with admin or developer roles must have MFA for shell access. |
| Internal service exposed | Medium | Services named “internal”, “admin”, “backend”, or “private” deployed as public web services. |
| Cross-environment secret leak | Medium | Sensitive environment variables shared between production and non-production. |
| Missing health check | Low | Web services missing a configured health check path. |
| Missing runtime version | Low | Services missing explicit runtime version pinning. |
| Excessive admin permissions | Low | Team workspaces where 50% or more of members have admin roles. |
Railway
Section titled “Railway”| Check | Severity | Description |
|---|---|---|
| Exposed TCP port | High | Database services exposed via public TCP proxy domains. |
| Default template password | High | Services using default passwords (e.g., “postgres”, “password”, “changeme”). |
| Team 2FA enforcement | High | Workspace members without two-factor authentication. |
| Public database URL | High | Services using public database URLs instead of private network URLs. |
| Deployment protection | Medium | Auto-deploy to production without required approval gates. |
| Environment variable leakage | Medium | Sensitive variables shared identically between production and non-production. |
| Resource limits | Medium | Workspaces without usage hard limits configured. |
| Root container | Low | Services using default builders that run as root. |
Vercel
Section titled “Vercel”| Check | Severity | Description |
|---|---|---|
| SAML SSO disabled | High | Team accounts without enforced SAML single sign-on. |
| Deployment protection disabled | Medium | Preview deployments without password, SSO, or authentication protection. |
| Firewall not enabled | Medium | Projects without the Web Application Firewall enabled. |
| Sensitive env var exposed to preview | Medium | Sensitive environment variables scoped to both production and preview. |
| Excessive function timeout | Medium | Serverless functions with timeout exceeding 60 seconds. |
| CORS wildcard origin | Medium | Routes allowing unrestricted cross-origin requests. |
| Attack challenge mode disabled | Low | Projects without browser verification for suspected attacks. |
| Excessive function memory | Low | Serverless functions with memory allocation exceeding 1024 MB. |
DigitalOcean
Section titled “DigitalOcean”| Check | Severity | Description |
|---|---|---|
| Public write on Spaces bucket | Critical | Object storage buckets allowing public write access. |
| Unrestricted public ingress | Critical | Firewalls allowing all inbound ports from the public internet. |
| Public database | High | Databases with missing or overly permissive firewall rules. |
| Database engine end of life | High | Managed database engine versions at or near end of life. |
| Public read on Spaces bucket | High | Object storage buckets allowing public read access. |
| Firewall allows public SSH/RDP | High | Firewalls exposing SSH (port 22) or RDP (port 3389) to the internet. |
| Droplet without cloud firewall | High | Droplets with a public IP that are not attached to a cloud firewall. |
| Load balancer accepts plaintext HTTP | High | Load balancers accepting HTTP without redirecting to HTTPS. |
| Expired TLS certificate | High | Expired TLS certificates. |
| CDN custom domain without certificate | High | CDN custom domains whose certificate is expired or missing. |
| Kubernetes control plane unrestricted | High | Kubernetes control plane APIs reachable from the public internet. |
| Kubernetes workload excessive privilege | High | Kubernetes workloads that run privileged or share the node namespace. |
| Team MFA not required | High | Team accounts without MFA enforcement. |
| Public list on Spaces bucket | Medium | Object storage buckets allowing public enumeration. |
| Spaces versioning disabled | Medium | Object storage buckets without versioning enabled. |
| Droplet backups disabled | Medium | Droplets without backups enabled. |
| Kubernetes auto-upgrade disabled | Medium | Kubernetes clusters that do not auto-upgrade patch releases. |
| Kubernetes surge upgrade disabled | Low | Kubernetes clusters with surge upgrades disabled. |
Supabase
Section titled “Supabase”| Check | Severity | Description |
|---|---|---|
| RLS disabled | High | Database tables without Row Level Security enabled. |
| Permissive RLS policy | High | RLS policies with overly broad rules (e.g., USING (true)). |
| Account 2FA | High | Organization members without MFA enabled. |
| Public storage bucket | High | Storage buckets marked public with sensitive names. |
| Email confirmation disabled | Medium | Sign-up configured to skip email verification. |
| Weak password policy | Medium | Minimum password length below 8 characters. |
| Insecure redirect URL | Medium | OAuth redirect URLs using wildcards, localhost, or non-HTTPS. |
| Security definer function | Medium | Database functions running with elevated privileges. |
| Auth users policy | Medium | Missing RLS policies on the auth.users table (High when a policy uses USING (true)). |
| Webhook security | Medium | Database webhooks configured without an authorization header. |
| CAPTCHA disabled | Low | Sign-up forms without CAPTCHA protection. |
Monitor integrations (SIEM)
Section titled “Monitor integrations (SIEM)”Heroku and DigitalOcean also have separate monitor integrations that forward activity to Security Monitoring, where detection rules evaluate it. Both need a Fencer plan that includes Security Monitoring.
Heroku (Monitor)
Section titled “Heroku (Monitor)”Heroku (Monitor) forwards Heroku application and router logs to Fencer through an HTTPS log drain. You must be an Org Admin on the Heroku app (Cedar/standard apps), or an admin of the Shield Private Space. Heroku Fir (OTLP) and Enterprise Audit Trail events are not supported.
- Go to Admin > Integrations, click the Heroku (Monitor) card, and click Continue.
- Enter an Integration Name (for example,
web-prod) and click Connect. - On the connection’s edit page, copy the Drain URL with Copy URL. It embeds the drain credentials, so treat it as a secret.
- Add the drain in Heroku:
- Cedar / standard apps:
heroku drains:add '<drain URL>' -a <app-name> - Shield Private Space:
heroku spaces:drains:add '<drain URL>' --space <space-name>
- Cedar / standard apps:
Regenerate drain URL on the edit page issues a new URL and immediately invalidates the old one, so every Heroku drain using it stops delivering logs until you update it.
DigitalOcean (Monitor)
Section titled “DigitalOcean (Monitor)”DigitalOcean (Monitor) polls the DigitalOcean Actions API every five minutes for team activity such as Droplet creation and deletion and firewall changes. There is nothing to set up on the DigitalOcean side beyond a token.
- In DigitalOcean, create a Personal Access Token with the
actions:readscope. - Go to Admin > Integrations, click the DigitalOcean (Monitor) card, and click Continue.
- Enter an Integration Name and the Personal Access Token, then click Connect. Fencer starts polling as soon as you save. Submit a new token on the edit page to rotate it.
DigitalOcean Security History, DOKS control-plane audit logs, and App Platform and Functions logs are not available through this integration. Forward App Platform and Functions logs with a Custom Source instead.
Editing and disconnecting
Section titled “Editing and disconnecting”To edit a hosting platform connection, navigate to Admin > Integrations, find the connection under Active Integrations, and click Edit. What you can change depends on the platform:
- Heroku: the connection name and environment.
- Render and Supabase: the connection name, environment, and API key (leave the key blank to keep the stored one). The workspace, organization, and project cannot be changed.
- DigitalOcean: the connection name, environment, and the registry and container image scanning toggles. The project cannot be changed.
- Railway and Vercel have no edit page. To change them, remove the connection and connect again.
To disconnect, click Remove on the connection and confirm. Fencer clears the stored credentials and removes the connection and its vendor record. You can reconnect at any time by going through the setup flow again.
Troubleshooting
Section titled “Troubleshooting”- OAuth authorization fails: Ensure you have the required permissions on the hosting platform. For Heroku and DigitalOcean, you must be the account owner or have admin-level access.
- API key rejected: Verify the key has not been revoked and has sufficient read permissions. For Render, the key needs access to the workspace you selected. For Supabase, the personal access token needs access to the organization.
- Missing checks or incomplete results: Some checks require specific permissions. For example,
Heroku addon connectivity checks require the
read-protectedOAuth scope. If a scope was not granted during authorization, reconnect the integration. - Stale data after infrastructure changes: Scans run daily (weekly on some plans). To see updated results sooner, open the account on Posture > Infrastructure and click Run scan.