Back End & Beyond
This Spring-based framework is a standard for building back-end services at CARFAX.
What is Spring Boot or Spring MVC?
This ASPM platform aggregates findings from Tenable, Wiz, GitLab, and NowSecure into a single risk view at CARFAX.
What is ArmorCode?
This Atlassian AI assistant is embedded in Confluence and Jira and gives context-aware answers from CARFAX project content.
What is Rovo?
This container orchestration platform, sometimes referred to as CKE at CARFAX, runs containerized deployments.
What is Kubernetes?
This JavaScript library became a CARFAX standard front-end framework and remains the primary choice today.
What is React?
This logging technique associates log lines with context metadata.
What is structured logging?
CARFAX's security policies are based on the principles and practices of this federal framework.
What is NIST?
The Spark Plug roadmap names this protocol integration that would give the tool access to enterprise tools like Outlook and Slack.
What is MCP, or Model Context Protocol?
CARFAX uses this HashiCorp tool for defining and provisioning infrastructure as code.
What is Terraform?
This internal UI component library helps make CARFAX products look and feel consistent.
What is Stencils?
A back-end guild presentation used this type of app, designed to work with AI agents, as an example while demonstrating logging techniques.
What is an MCP app?
This CARFAX initiative aims to prevent new Critical/High vulnerabilities by blocking them at the merge request level in GitLab.
What is Shift Left?
This developer assistant tool from GitHub provides real-time AI code completion and inline suggestion capabilities directly inside the IDE.
What is GitHub Copilot?
This source code management and CI/CD platform hosts repositories and runs automated scanning on every push.
What is GitLab?
This language gives web pages their structure, including headings, paragraphs, links, and buttons.
What is HTML?
These three JVM languages are the primary server-side languages used by CARFAX back-end engineers.
What are Java, Kotlin, and Groovy?
At CARFAX, members of each development team who are security-focused carry this title and meet twice a month.
What is a Security Champion?
This term describes autonomous AI systems capable of multi-step planning, tool usage, and decision-making to complete complex workflows.
What are AI Agents (or Agentic Workflows)?
This AWS service is commonly used for secure storage of application credentials.
What is AWS Secrets Manager?
This language controls the colors, fonts, spacing, and layout of a web page.
What is CSS?
In addition to vanilla REST, Carfax also uses these two popular API styles, one originating at Facebook, one at Google.
What are gRPC and GraphQL?
This type of GitLab scan identifies hardcoded API keys, passwords, and tokens in CARFAX code.
What is Secret Detection?
The Shift Left project is evaluating this type of AI-assisted approach to accelerate developer vulnerability fixes.
What is agentic remediation?
CARFAX infrastructure is designed for redundancy and geographic diversity so service can continue even if one of these goes offline.
What is a data center?
Before CARFAX standardized on React, the front-end landscape was described with this metaphor because teams could choose nearly any technology.
What was the Wild West era?