"Security is not a gated process; it is a continuous thread." This is a comprehensive, stage-by-stage guide to building a modern DevSecOps pipeline—from the first line of code to production runtime.
- Beginners: guided labs, curated tools, and clear adoption order
- Practitioners: production-ready controls, metrics, and templates
- DevOps/SRE/Security: a shared source of truth across disciplines
- Read the overview: docs/README.md
- Run the first lab: labs/README.md
- Align on SLAs: templates/vuln-sla-matrix.md
- See the pipeline example: pipelines/github-actions/devsecops.yml
Recommended stack and order of adoption:
- Shift-left hygiene: pre-commit + SAST (Gitleaks, Semgrep)
- CI PR gates: required checks + SCA (GitHub Actions + Trivy)
- Supply chain: SBOM + signing (Syft + Cosign)
- DAST/API: staging scans (OWASP ZAP)
- CD & K8s: policy-as-code (Kyverno)
- Runtime detection: eBPF alerts (Falco)
- IR + detections: runbooks and tuning
- Lab 01: Pre-commit SAST
- Lab 02: CI PR Gates
- Lab 03: SBOM and Signing
- Lab 04: K8s Admission Policies
- Lab 05: Runtime Detection
- Lab 06: DAST and API Testing
- Lab 07: IR and Detections
- Program overview: docs/README.md
- Reference architecture: docs/reference-architecture.md
- Maturity model: docs/maturity-model.md
- Metrics and KPIs: docs/metrics.md
- Learning paths: docs/learning-paths.md
- Resource index: docs/resources.md
- Tool comparison: docs/tool-comparison.md
- Case studies: docs/case-studies.md
- Cheatsheets: docs/cheatsheets.md
- Awesome catalog: docs/awesome-catalog.md
- Glossary: docs/glossary.md
- Project blueprints: projects/README.md
- Ready configs: configs/README.md
- Operational checklists: checklists/README.md
- Incident playbooks: playbooks/README.md
- Policy packs: policies/README.md
- Metrics dashboards: dashboards/README.md
- Repo templates: repo-templates/README.md
- Skill maps: skill-maps/README.md
- Secure SDLC checklists: sdlc-checklists/README.md
- Sample repos: samples/README.md
- Integration guides: integrations/README.md
- Security testing recipes: recipes/README.md
- Incident metrics templates: metrics-templates/README.md
- Maturity scorecards: scorecards/README.md
- Evidence packs: evidence-packs/README.md
- GitHub Actions starter workflows
- Semgrep rules
- Trivy examples
- Syft + Grype examples
- Cosign examples
- Kyverno policy library
- OPA Gatekeeper library
- Falco rules
- OpenTelemetry demos
- 🔄 Phase 1: Shift Left (IDE & Pre-Commit)
- 🏗️ Phase 2: CI Security (Build & Static Analysis)
- 📦 Phase 3: Supply Chain (SBOM & Artifacts)
- 🌐 Phase 4: DAST & Application Testing
- ☸️ Phase 5: CD & Infrastructure (Cloud/K8s)
- 🕵️ Phase 6: Runtime & Threat Detection
- 🤖 Phase 7: AI-Driven Remediation (2026 Trend)
Goal: Catch vulnerabilities and secrets before they are even pushed to Git.
- Gitleaks: Prevent hardcoded secrets (API keys, passwords) from being committed.
- Talisman: A hook to scan outgoing changes for sensitive information.
- Pre-commit: A framework for managing multi-language git hooks.
- Snyk IDE Plugin: Real-time vulnerability feedback inside VS Code/JetBrains.
Goal: Automate code quality and vulnerability checks on every PR.
- SAST (Static Analysis):
- IaC Scanning (Infrastructure as Code):
Goal: Secure your "Ingredients list" and ensure dependency integrity.
- SCA (Dependency Scanning):
- Trivy: Scans packages, OS libraries, and configurations.
- SBOM Management:
- Signature & Trust:
- Sigstore/Cosign: Keyless signing to verify image provenance.
Goal: Identify vulnerabilities in the running application (Dynamic Analysis).
- OWASP ZAP: World's most popular free DAST tool.
- Nuclei: Template-based scanning for fast vulnerability detection.
- 42Crunch: Dedicated security for APIs (REST/GraphQL).
Goal: Secure deployment and cloud configuration.
- Kyverno: Kubernetes admission controller to block non-compliant pods.
- Prowler: AWS, Azure, and GCP security assessment and hardening.
- ArgoCD: Secure GitOps deployments with drift detection.
Goal: Observe behavior in production and block attacks.
- Falco: The surveillance camera for Kubernetes (eBPF-powered).
- Trivy Operator: Continuous security scanning inside your cluster.
- Istio: Service mesh to enforce mTLS and zero-trust networking.
Goal: Move from "Finding" to "Fixing" automatically.
- Plexicus: AI agents that generate fix PRs for your security findings.
- Jit: Orchestrate your entire security stack in one developer-friendly portal.
- Mend.io: Automated patching of vulnerable open-source libraries.
Contributions are welcome! If you have a tool or resource that fits the 2026 DevSecOps landscape, please open a PR.
Distributed under the MIT License. See LICENSE for more information.