Cloudflare accelerates debugging and improves security

A web performance and security company, Cloudflare offers CDN, DNS, DDoS protection, and security products and services to millions of customers worldwide. The company has approximately 2,000 employees, a quarter of which are engineers.

Looking for a new code search tool

Cloudflare's engineering team builds and runs the software that powers and protects approximately 25 million Internet properties around the world. When performance and security issues arise, it's critical that Cloudflare engineers can find and fix code quickly.

But using their code host's native code search functionality wasn't cutting it. For example, it would take ASCII characters and run them through ElasticSearch. Special characters, including spaces, were completely ignored and there was no way to filter results based on file types, folder names, or code logic.

“We were trying to answer questions like who was using specific dependencies and different libraries and where are these lines of code or log lines coming from. We needed to be able to search thousands of repos to find them.”

For a while, the team worked around this by cloning all the repos onto their machines and using their local system's search functionality. But with over 2,600 repositories, the process proved slow and unwieldy.

“It would take two days just to copy the repos onto a laptop, so I could search them,” said Stock. Meanwhile, if the code base was updated during the time it took to copy the repos, then the engineer wouldn't be searching the latest codebase. Further, once team members cloned the repos, they wouldn't have space left on their machine for other work.

Finding Sourcegraph

Stock, who was then on the Dev Tools team, and has since moved to Service Automation, knew there had to be a better solution. He discovered the open source version of Sourcegraph, a universal code search and intelligence tool for developers.

Sourcegraph integrates with all code repos, programming languages, and file formats. It also provides advanced code navigation features that let developers explore source code on any branch, commit, or PR.

"Sourcegraph is the only code search tool that natively integrates with our code and understands how our code works," said Stock.

Expanding throughout the team

Once Stock downloaded and began using the open source version of Sourcegraph, he started sharing search result URLs with engineers. Soon, Sourcegraph spread organically throughout the organization and the internal DevOps team decided to deploy Sourcegraph for all Cloudflare engineers.

Now, with Sourcegraph universal code search, Cloudflare engineers can solve the big code problems they face every day. For example, engineers can quickly identify out-of-date code libraries by only searching certain repositories, while excluding specific file types. And it's easier to search for error logs. As a result, the team can refactor and debug faster and feel confident they've addressed each issue.

Finding and addressing security risks

Sourcegraph has also become essential to how the Cloudflare security team can quickly address security risks and root-cause incidents.

“When a potential security issue comes up, I often have to go into another engineer's project to quickly understand how the code works to understand the critical functions, where the data is flowing, what sort of controls or checks are happening. With Sourcegraph, I can jump into another engineer's project and quickly explore and better understand the code faster.”

Another plus, according to Haynes, “it's the best way to prove we're not vulnerable to a particular CVE, if and when we get asked by an auditor.”

Saving time, from days to minutes

Whether searching for instances of a library or refactoring an entire application, it's hard to put exact numbers on how much time the organization saves as a result of using Sourcegraph, because it's a 'death by a thousand paper cuts' scenario.

Each time an engineer uses the tool to search and understand code, instead of cloning the repo, he or she saves time and feels more confident in the results. When you have 500 engineers searching code repos, multiple times a day, throughout each day, that's a huge time savings.

In the end, it all adds up to increased developer productivity -- and better code.