DevSecOps
Bake security into the pipeline instead of bolting it on after the fact.
18+
completed
~18.5h
total time
7
projects
Shift-Left Security in CI/CD
Add pre-commit secret scanning, dependency vulnerability checks, and a fail-the-build security gate to a real GitHub Actions pipeline.
Container Image Scanning
Scan a container image for OS and dependency vulnerabilities with Trivy, generate an SBOM, and sign the image with cosign.
Secrets Management with Vault
Run HashiCorp Vault locally, store and retrieve static secrets, and generate short-lived dynamic database credentials.
Infrastructure as Code Security Audits
Run tfsec and Checkov against a deliberately misconfigured Terraform module, triage the findings, and wire the scan into CI.
SAST and DAST Pipeline Integration
Add static analysis (Semgrep) and dynamic analysis (OWASP ZAP) to a CI pipeline against a small intentionally-vulnerable web app.
Policy as Code with OPA
Write Rego policies with Open Policy Agent, test them with the built-in unit test framework, and enforce one against raw Kubernetes manifests.
Writing an Incident Response Runbook
Write a real, usable incident response runbook for a specific scenario — a leaked cloud credential — then pressure-test it.