How Caregility uses GitHub
Caregility is a virtual healthcare platform that connects patients with clinicians through an easy-to-use web application. The company has grown from around 30 to over 120 employees and serves clients in the United States and abroad. Based in Eatontown, NJ, Caregility's agile development teams work with in-staff clinicians to build products with patients in mind.
Consolidating DevOps infrastructure
As a rapidly growing startup, Caregility needed DevOps practices that could scale with the company's expansion. The company's existing CI/CD architecture—which included both Azure DevOps and on-premise GitLab infrastructure—was too complex and created pain points across the technology organization. Caregility turned to GitHub to consolidate its toolset, standardize version control, and improve its security posture.
Securing access for distributed teams
Access control was a key challenge when working with geographically diverse developers. Caregility's former platform relied on IP address access-listing, which became insufficient as the company grew. GitHub's single sign-on (SSO) provided a more robust solution for securing and managing access control for a distributed workforce. New developers could access the codebase with a simple login, and most were already familiar with GitHub. "As a new Engineer, GitHub facilitated a fast onboarding process and enabled efficient communication between teams within the technology organization," said John Franey, Lead Backend Software Engineer.
Enabling code reuse through innersource
Consolidating operations through GitHub enabled Caregility to adopt an innersource framework that encourages code reuse throughout the organization. For Caregility, this includes a corporate identity library that provides a standardized menu of tools used across various product and service user interfaces, reducing the time to ship new features.
"GitHub helps guide our DevOps journey within the organization and fosters greater collaboration between various tech teams to work together on projects," says Babitha Singh, VP, DevOps. "GitHub has helped us ensure that we have security controls baked into our CI/CD pipeline and GitHub Actions has allowed us to easily incorporate code linting and other best practices in our CI pipelines."
Proactive security scanning
Securing its patient and clinician-facing platform is a chief concern for Caregility and a requirement for serving healthcare provider customers. Previously, Caregility's compliance team conducted time-consuming security scans on production code, with results filtering through multiple departments before reaching developers for fixes.
Caregility's team turned to GitHub Advanced Security to shift security earlier in the development process. Tools like Secret Scanning and Code Scanning protect the codebase and empower developers to take a proactive approach to security. Developers can now see potential issues in committed code before it's pushed into production, helping save time and eliminate redundancy.
"We want to protect our customers and their patients by more efficiently securing our platform from vulnerabilities and exploits," explains Justin Trugman, VP of Software Development. "By continuously scanning our codebase and dependencies, we can detect vulnerabilities and remediate them quickly, which is vital to the safety of patients and clinicians using our platform."
Managing open source dependencies
Vulnerabilities are not limited to in-house code. Open source dependencies can also be attack vectors. Caregility mitigates these risks using Dependabot, which continuously scans GitHub repositories in the background. When an insecure dependency is discovered, Dependabot sends an alert and generates a pull request with a suggested fix, enabling faster remediation.
"Dependabot makes the process of delivering a secure and stable product to our customers much easier," says Trugman. "Since using Dependabot we've fixed over 350 vulnerable dependencies."
Results
Since streamlining its workflow with GitHub, Caregility has enhanced its security posture and facilitated greater collaboration across the technology organization. "With GitHub, we consolidated our repositories, code security, CI/CD pipelines, and access controls into a single platform," explains Bin Guan, Chief Product and Innovation Officer. "The extra agility that is unlocked helps us deliver feature functionalities faster and more securely, which in turn helps support patients and save people's lives."