Hide infrastructure
Keep your build pipeline off the internet
Jenkins, ArgoCD, GitLab CI — reachable by your developers, invisible to everyone scanning for the next supply-chain foothold.
Take the keys to your software off the internet
CI/CD is the keys to your software kingdom, and it usually sits on the public internet behind a login page. That page names the tool and version and invites the attack. Jenkins alone has had 400+ CVEs, and a compromised pipeline lets an attacker inject code into everything you ship — the SolarWinds and Codecov class of breach.
| The usual fix | What to consider |
|---|---|
| Login page + SSO | Better than basic auth, but the endpoint is visible and the login page is attackable. |
| IP allowlisting | Breaks for remote developers and is painful to keep current. |
| Private subnet + bastion | Keeps CI/CD off the public internet — but the bastion is itself an attack surface. |
Developers get in, exploit tools get nothing
Put the dashboard behind LayerV; let developers in by identity, and let webhooks in by key.
POST /v1/qurls
{
"target_url": "https://jenkins.acme.co",
"label": "dev@acme.co",
"expires_in": "12h",
"one_time_use": true
}A link to the CI/CD dashboard for one developer — invisible to everyone else.
Hide the dashboard
The Jenkins or ArgoCD endpoint drops off the public network — no version to fingerprint, no CVE to fire at it.
Developers authenticate
They sign in through Okta and get a qURL to the dashboard. Same browser workflow, no VPN.
Pipelines get their own
Webhook triggers and API-driven deploys create qURLs programmatically, scoped to one endpoint.
What to install, and how someone gets in
Publish with
Connector sidecar beside the CI server ↗Give access with
The SDK for people, headless resolve for jobs ↗- 01Run the connector sidecar beside Jenkins, ArgoCD, or GitLab CI, pointed at its local port
- 02Close the public route to it and confirm the old address stops answering
- 03Mint a per-developer link after login with POST /v1/resources/{id}/qurls
- 04Have pipelines and webhooks redeem headlessly with POST /v1/resolve
Developers and webhooks both still get in
Jenkins is off the map, and neither your team nor your automation notices — each has its own way through.
A developer
Okta sign-in, then a qURL to the dashboard in the same browser tab. No VPN client, no bastion, no allowlist entry to chase.
A webhook or deploy job
The pipeline mints its own qURL scoped to one endpoint, expiring with the run. Nothing outlives the build.
An on-call incident at 3am
No allowlist edit, no ticket — just an identity check, and your IdP is already awake to do it.
Ship from a pipeline no one can find
Eliminate CI/CD as a target
Can't exploit Jenkins CVEs against infrastructure that doesn't exist on the internet.
Supply chain protection
Hidden build infrastructure can't be compromised by external attackers to inject malicious code.
No developer friction
Developers authenticate via Okta SSO and access CI/CD dashboards in their browser. No VPN needed.
Automated pipeline support
qURL API enables programmatic access for webhooks and API-driven deployments.
Built for
- Engineering teams running self-hosted Jenkins, ArgoCD, or GitLab CI
- Organizations concerned about software supply chain attacks
- DevOps teams with internet-facing build infrastructure
- Companies with compliance requirements around build pipeline security