DevSecOps: Integrating Security Into Your CI/CD Pipeline

In This Guide

• 1. Why "Shift Left" Isn't Enough — You Need "Shift Everywhere"
• 2. The DevSecOps Pipeline — Security at Every Stage
• 3. SAST — Finding Bugs in Source Code
• 4. SCA — Your Dependencies Are Your Attack Surface
• 5. Secrets Detection — Catching Leaked Credentials
• 6. Container and IaC Scanning
• 7. DAST — Testing the Running Application
• 8. Complete GitHub Actions Security Pipeline
• 9. Making It Work — Culture, Not Just Tools
• 10. Frequently Asked Questions

Stage	Security Activity	Tools	Feedback Time
IDE / Pre-commit	Secrets detection, basic SAST	gitleaks, Semgrep IDE extension	Instant (before commit)
Pull Request	Full SAST, SCA, license check	Semgrep, Snyk, Trivy	2-5 minutes
Build	Container scan, IaC scan, SBOM	Trivy, Checkov, Syft	3-8 minutes
Staging	DAST, API fuzzing	OWASP ZAP, Nuclei	10-30 minutes
Production	Runtime protection, WAF, monitoring	Falco, Datadog ASM, Cloudflare WAF	Real-time
Ongoing	New CVE alerts, pen testing	GitHub Dependabot, Snyk Monitor	Continuous

Developer Workstation CI Pipeline Production ┌───────────────────┐ ┌────────────────────────┐ ┌──────────────────┐ │ IDE Linting │ │ ┌──────────────────┐ │ │ WAF / CDN │ │ Pre-commit hooks │──▶│ │ SAST (Semgrep) │ │──▶│ Runtime RASP │ │ • gitleaks │ │ │ SCA (Snyk/Trivy) │ │ │ Log monitoring │ │ • Semgrep │ │ │ Secrets scan │ │ │ Anomaly detection│ └───────────────────┘ │ │ License check │ │ └──────────────────┘ │ └──────┬───────────┘ │ │ │ Pass? │ │ ▼ │ │ ┌──────────────────┐ │ │ │ Build & Package │ │ │ │ Container scan │ │ │ │ IaC scan │ │ │ │ SBOM generation │ │ │ └──────┬───────────┘ │ │ │ Pass? │ │ ▼ │ │ ┌──────────────────┐ │ │ │ Deploy → Staging │ │ │ │ DAST (ZAP) │ │ │ │ API fuzz testing │ │ │ └──────────────────┘ │ └────────────────────────┘

Tool	Languages	Speed	False Positive Rate	Cost
Semgrep	30+ (JS, Python, Go, Java, PHP...)	Fast (seconds)	Low	Free OSS / paid Pro
CodeQL	C/C++, Java, JS, Python, Go, Ruby	Slow (minutes)	Very low	Free on GitHub
SonarQube	29 languages	Medium	Medium-high	Free Community / paid
Bandit (Python)	Python only	Fast	Low-medium	Free

- name: Run Semgrep SAST
  uses: returntocorp/semgrep-action@v1
  with:
    config: >-
      p/security-audit
      p/owasp-top-ten
      p/nodejs
      p/php
    generateSarif: true

# Or run directly for more control:
- name: Semgrep scan
  run: |
    pip install semgrep
    semgrep scan \
      --config p/security-audit \
      --config p/owasp-top-ten \
      --error \                    # Fail CI on findings
      --severity ERROR \           # Only block on critical
      --sarif -o semgrep.sarif \   # Upload to GitHub Security tab
      .

rules:
  - id: php-raw-sql-query
    patterns:
      - pattern: $DB->query("..." . $VAR . "...")
    message: >
      Direct variable interpolation in SQL query detected.
      Use prepared statements: $db->execute("... WHERE id = ?", [$var])
    languages: [php]
    severity: ERROR
    metadata:
      cwe: CWE-89
      owasp: A03:2021

  - id: no-auth-middleware
    patterns:
      - pattern: |
          $app->$METHOD($PATH, function($req, $res) { ... });
      - pattern-not: |
          $app->$METHOD($PATH, authenticate, ...);
    message: Route handler without authentication middleware
    languages: [javascript]
    severity: WARNING

# Node.js — built-in audit
npm audit --audit-level=high
# Fix automatically where possible:
npm audit fix

# Python
pip-audit --require-hashes --strict
# Or:
safety check --full-report

# Go
govulncheck ./...

# PHP (Composer)
composer audit

# Universal — Trivy scans any project type
trivy fs --severity HIGH,CRITICAL --exit-code 1 .

# Generate SBOM (Software Bill of Materials)
syft . -o spdx-json > sbom.spdx.json

Severity	CI Behavior	SLA	Example
Critical (CVSS 9+)	Block merge	Fix within 24 hours	Remote code execution in Express
High (CVSS 7-8.9)	Block merge	Fix within 7 days	SQL injection in ORM library
Medium (CVSS 4-6.9)	Warn, don't block	Fix within 30 days	ReDoS in validation library
Low (CVSS 0-3.9)	Log only	Fix in next dependency update cycle	Info disclosure in debug mode

What We've Learned at Pillai Infotech

We started with "block on all vulnerabilities" and reverted within a week — developers couldn't merge because of low-severity findings in transitive dependencies they didn't control. The policy above took three iterations to get right. The key insight: block on things developers can actually fix quickly (direct dependencies, critical severity), warn on everything else.

# Install gitleaks
brew install gitleaks  # macOS
# Or: go install github.com/gitleaks/gitleaks/v8@latest

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

# Run manually against entire repo history
gitleaks detect --source . --verbose

# Scan only staged changes (fast, for pre-commit)
gitleaks protect --staged --verbose

[extend]
useDefault = true  # Include all default patterns

# Add custom patterns for your APIs
[[rules]]
id = "pillai-api-key"
description = "Pillai Infotech API Key"
regex = '''nc_bot_[a-zA-Z0-9]{10,}'''
secretGroup = 0
entropy = 3.5

[[rules]]
id = "openrouter-key"
description = "OpenRouter API Key"
regex = '''sk-or-v1-[a-f0-9]{64}'''

# Allowlist — files that legitimately contain example keys
[allowlist]
paths = [
  '''\.env\.example''',
  '''docs/api-examples\.md''',
]

# Scan a Docker image for OS and library vulnerabilities
trivy image --severity HIGH,CRITICAL myapp:latest

# Scan Dockerfile for misconfigurations
trivy config --severity HIGH,CRITICAL Dockerfile

# Scan Terraform files
trivy config --severity HIGH,CRITICAL ./terraform/

# Common Dockerfile issues Trivy catches:
# - Running as root (no USER instruction)
# - Using :latest tag (unpinned base image)
# - Secrets in ENV or ARG instructions
# - Package manager cache not cleaned
# - Unnecessary packages installed

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production   # Deterministic install
COPY . .
RUN npm run build

# Stage 2: Production — minimal image
FROM node:20-alpine AS production

# ✅ Don't run as root
RUN addgroup -g 1001 appgroup && \
    adduser -u 1001 -G appgroup -s /bin/sh -D appuser

WORKDIR /app

# ✅ Only copy what's needed
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/package.json ./

# ✅ Read-only filesystem where possible
USER appuser

# ✅ Health check for orchestrator
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

EXPOSE 3000
CMD ["node", "dist/server.js"]

# Scan Terraform
checkov -d ./terraform/ --framework terraform

# Common findings:
# ✗ S3 bucket without encryption
# ✗ Security group with 0.0.0.0/0 ingress on port 22
# ✗ RDS without encryption at rest
# ✗ CloudTrail not enabled
# ✗ IAM policy with * resource

# Scan Kubernetes manifests
checkov -d ./k8s/ --framework kubernetes

# Common findings:
# ✗ Container running as root
# ✗ No resource limits set
# ✗ No readOnlyRootFilesystem
# ✗ hostNetwork: true

# Baseline scan — fast, finds low-hanging fruit (5-10 min)
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py \
    -t https://staging.pillaiinfotech.com \
    -r zap-report.html \
    -l WARN

# Full scan — thorough, runs active attacks (30-60 min)
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-full-scan.py \
    -t https://staging.pillaiinfotech.com \
    -r zap-full-report.html

# API scan — import OpenAPI spec, test every endpoint
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-api-scan.py \
    -t https://staging.pillaiinfotech.com/openapi.json \
    -f openapi \
    -r zap-api-report.html

name: Security Pipeline
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for comprehensive scan
      - name: Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/security-audit p/owasp-top-ten
          generateSarif: true
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          severity: HIGH,CRITICAL
          exit-code: 1
          format: sarif
          output: trivy-results.sarif
      - name: Upload Trivy SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

  container-scan:
    runs-on: ubuntu-latest
    needs: [sast, dependency-scan]  # Only build if code is clean
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Trivy image scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          severity: HIGH,CRITICAL
          exit-code: 1

  iac-scan:
    runs-on: ubuntu-latest
    if: contains(github.event.pull_request.changed_files, 'terraform')
    steps:
      - uses: actions/checkout@v4
      - name: Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ./terraform
          framework: terraform
          soft_fail: false

Anti-Pattern	What Happens	Better Approach
Block on every finding	Developers add # nosemgrep everywhere	Block on critical/high only, track rest as tech debt
Security team owns all findings	3-month backlog, developers uninvolved	Developer who wrote the code fixes it, security team advises
Security review as gate	2-week review queue, bypassed for "urgent" releases	Automated checks + security champions in each team
Only scan main branch	Vulnerabilities found after deploy	Scan on every PR — fix before merge
No triage process	500 open findings, no one looks at them	Weekly triage: classify, prioritize, assign, SLA

What We've Learned at Pillai Infotech

The metric that matters isn't "number of vulnerabilities found" — it's "mean time to remediate." We track MTTR by severity. Our target: critical findings fixed within 24 hours, high within a week. When MTTR starts creeping up, it's usually a culture problem (developers ignoring findings) not a tooling problem. The fix is always the same: make findings visible in the PR, not in a separate dashboard nobody checks.

Related Articles