Course
DevSecOps: Security in the Pipeline
Shift security left without breaking trust — SAST, DAST, secrets scanning, dependency auditing, and container scanning wired into CI so findings land as feedback, not as a gate developers route around.
Reviews
Enrolled members can rate this course.
No reviews yet.
The Shift-Left Model
Why security belongs in the pipeline, where each control sits in the lifecycle, and how to gate without triggering a developer revolt.
- 01Security as a Feedback Loop, Not a GateThe real model behind 'shift left': detection latency drives fix cost, and a finding that arrives in minutes teaches — one that arrives in a quarterly PDF teaches nothing.18mOpen
- 02Anatomy of a Security-Aware PipelineOne pipeline, five stages, and the rule that decides where each control lives: fast and deterministic early, slow and probabilistic late.20mOpen
- 03Advisory vs Blocking: Gating Without a RevoltSeverity isn't exploitability, day-one findings need a baseline not a wall, and every gate needs designed escape hatches — or developers will build their own.20mOpen
The Scanner Toolkit
SAST, secrets scanning, and dependency auditing — what each tool actually catches, where each one lies to you, and how to tune the noise.
- 01SAST: Static Analysis That Doesn't Cry WolfStatic analysis is the workhorse of shift-left and its biggest noise source — the job isn't running Semgrep, it's curating what it's allowed to say.22mOpen
- 02Secrets Scanning: Committed Keys Are ForeverDeleting the line doesn't delete the secret — git is append-only, bots watch every public commit, and the only real remediation is rotation.20mOpen
- 03Dependency Auditing: Most of Your Code Isn't YoursYou imported hundreds of thousands of lines of stranger code — lockfiles, scanners, SBOMs, and the attack classes (confusion, typosquatting, install scripts) that audits alone don't cover.22mOpen
Ship and Defend
Container scanning, DAST against the running app, and the triage and ownership loops that keep findings from rotting in a backlog.
- 01Container Scanning: Images Are Frozen FilesystemsEvery package in the image ships to prod and stays that vulnerable until you rebuild — base-image hygiene, digest pinning, and Trivy flags that keep the gate honest.22mOpen
- 02DAST: Attacking the Running AppSAST reads the recipe; DAST tastes the soup — it finds the findings that only exist because the app runs, if you can get it authenticated and pointed at the right target.20mOpen
- 03Making the Loop Work: Triage, Ownership, and TrustThe scanners are the easy half — the program survives or dies on one triage queue, clear ownership, expiring exceptions, and honest metrics.20mOpen