Security Starts with the Container: How Artem Rozhko Integrated Development Environment Security at Growe

Think a software vulnerability appears only when a developer makes a coding mistake? Not at all. Quite often, a team inherits one as an unpleasant “bonus” along with a library, a container base image, or a third-party component that may have been used for years without ever causing a problem.

Now imagine there are hundreds of such components, while software updates are being released continuously.

Checking every component manually? That is practically impossible. So what can be done instead?

This was precisely the question Ukrainian cybersecurity specialist Artem Rozhko sought to answer while working at Growe in 2023–2024.

Rather than relying on a final security review of an already completed product, he integrated security mechanisms directly into the environment through which code passed on its way to deployment.

How to Check Code Before It Goes Live

At Growe, the scale was considerable: more than two hundred repositories containing software code. Artem Rozhko took on the challenge by automating part of the security control process.

What matters here, however, is not only what was automated, but how. The engineer integrated several types of security checks directly into the development process. We asked him what exactly they were.

“Some looked for vulnerabilities in containers, while others searched for passwords, access keys, or other sensitive data accidentally left in the code,” he explained.

According to Artem, there were also tools for checking third-party libraries and analyzing code for potentially dangerous flaws.

“In practice, this meant creating several layers of control before the product was deployed,” the cybersecurity specialist explains. “If the system detected a problem at one of the stages, the team could see it before it reached the production environment.”

However, increasing the number of automated checks created another challenge: the results came from multiple sources. This made it extremely difficult for the team to understand which “fires” needed to be put out first.

To address this issue, Artem Rozhko initiated the implementation of the DefectDojo platform at Growe, allowing the results of different security checks to be consolidated in one place.

Imagine this: where there had previously been dozens of separate reports, the team now had a unified view of the vulnerabilities that had been identified.

This principle — not merely finding problems, but embedding their automated detection and subsequent handling into the routine development process — later became one of the foundations of Artem Rozhko’s methodological work.

Minimizing Human Error Through Automation

At Growe, the Ukrainian cybersecurity specialist also worked to transfer part of the repetitive security checks to automated systems.

“To do this, we created more than 150 Python scripts that performed recurring tasks without requiring constant human intervention,” Artem recalls.

This was not simply about saving time. The solution made it possible to apply the same rules across a large number of systems and identify potential red flags more quickly.

Another area of his work involved secure remote access to the company’s internal resources. Artem Rozhko maintained the CloudConnexa cloud VPN infrastructure used by more than a thousand employees across different regions.

He also paid particular attention to container security. At Growe, hardened Chainguard base images were standardized, while security updates were installed automatically. The average reader may not immediately understand what that means, so we asked Artem to explain why this mattered.

“Try to think of a container as a box that holds an application together with the libraries and settings it needs,” he says. “If the foundation of that box already contains an outdated component or an insecure configuration, the problem can automatically be inherited by every product built on top of it.”

From Practice to Methodology

Artem Rozhko structured the experience he gained from working with such systems — first at the Ministry of Defense of Ukraine, later at Revenue Grid, GR8, and Growe, and today at iCapital — into his own methodology.

His methodological guide, titled Integration of Container Scanning Tools into Continuous Delivery Processes for Security by Design, was published by the Kyiv-based Gutenberg publishing house in 2025.

“Finding a vulnerability is only the minimum requirement,” Artem says, describing it as merely the first step reflected in his methodology. “The next step is to determine its actual risk, understand whether it should block deployment, establish consistent rules across different teams, and continue monitoring even after the product has gone live.”

The author of the approach also insists that a pre-deployment check cannot be the final one.

“New vulnerabilities are disclosed all the time,” Artem notes. “That is why systems that have already been deployed also require repeated assessment.”

Instead of a Conclusion

For a long time, identifying problems after the fact was considered the traditional approach. But that era appears to be coming to an end.

What lies ahead is a model in which security no longer serves as the final barrier before deployment, but functions as a continuous part of the development process itself.

That is the logic at the core of Artem Rozhko’s approach.