DevSecOps Tutorial with Examples.
DevSecOps tutorial with scanners on a repo you own: threat modeling, SAST, secrets scanning, SCA and SBOMs, DAST, a CI security gate and image signing.
Architecture at a glance
Click any box to open the lesson that teaches it
DevSecOps pipeline at a glance
design → commit → gate → sign → test, with every tool taught on this site
How it fits together (6 steps)
- Design: model the system and its data flows with pytm and STRIDE before writing code.
- Every push runs one CI job with three checks: Gitleaks for secrets (history included), Bandit and a Semgrep rule for code, and pip-audit, a Syft SBOM and Grype for dependencies.
- The security gate fails the build on any finding. You fix the code, rotate a leaked key or bump a pin, then push again.
- Release: build a hardened image, sign its digest with cosign, push it to a registry and verify the signature before it runs.
- Test the running app from the outside with a ZAP baseline scan.
- Guardrails from other topics cover infrastructure code, CI secrets, vaults and scripts.
Beginner
Start here — no prior experience needed
Threat Modeling as Code with pytm and STRIDE
Describe a login service as a pytm data-flow model, read the threats it generates, fix the public flow with TLS, and record why one finding is accepted.
Static Analysis (SAST) with Bandit and a Custom Semgrep Rule
Plant shell=True and yaml.load in a Python file, read Bandit's findings, write a Semgrep rule for a bug only your team knows about, and fix both to green.
Secrets Scanning with Gitleaks: The Key You Deleted Is Still There
Commit an API key, delete it in the next commit, and watch Gitleaks find it in history anyway. Then rotate, record the decision, and block the next one.
Intermediate
For developers with core concepts down
Dependency Scanning (SCA) and SBOMs with pip-audit, Syft and Grype
Pin an old requests release, read the advisories pip-audit reports, build a CycloneDX SBOM with Syft, scan it with Grype, then bump the pin to a clean run.
DAST with an OWASP ZAP Baseline Scan Against Your Own App
Run a passive OWASP ZAP baseline scan against a tiny Python app in its own container, read each warning, add the missing headers, and get to exit 0.
A CI Security Gate: Gitleaks, Bandit and pip-audit in One Workflow
Combine secrets, code and dependency scans into one script and one GitHub Actions job that fails on a planted bug, passes after the fix, and sees history.
Advanced
Production-grade patterns for experienced engineers
Also part of DevSecOps (AppSec in the pipeline)
Taught in other topics. Each link opens the lesson in its home topic.
Bash Security Best Practices
Write secure Bash scripts — safe temp files with mktemp, avoiding command injection, handling secrets, and setting file permissions.
Secrets: Real Log Masking, and the Base64 Trick That Defeats It
GitHub Actions masks a secret printed directly to the log — but transforming it first (base64, a substring, a hash) produces output the masker never recognizes as the secret, leaking it in full.
Docker Security
Harden Docker images and containers: non-root users, read-only filesystems, secrets management, image scanning, and runtime policies.
Multi-Stage Builds
Use multi-stage Dockerfiles to produce small, secure production images by separating build and runtime environments.
sensitive = true: What It Hides, and What It Doesn't
sensitive = true masks a secret in plan output, but state keeps it in plain text. Real runs show both, plus why an ephemeral variable is refused.
Variable Precedence: host_vars Beats group_vars, and extra-vars Beats Everything
The same variable name, defined in three places, resolves to three different values depending on where you look — verified by actually stacking group_vars, host_vars, and -e against each other.
Scanning Terraform for Misconfiguration with Checkov
Catch a public S3 bucket and SSH open to the internet in Terraform before anything is deployed: run Checkov, gate on the checks that matter, fix, re-scan.
Policy as Code: Testing Terraform Plans with OPA and Conftest
Write Rego rules and run them on a real terraform plan: untagged resources and SSH open to the internet fail, the fix passes, the policy has its own tests.
MCP Authorization: OAuth 2.1, CIMD and a Real Identity Provider
Protect an MCP server with OAuth: the 401 and resource metadata, audience and scope checks, CIMD versus DCR, token refresh, Keycloak and DPoP in the SDK.
Running MCP in Production: Scaling, Caching and Operations
Run MCP as several instances: nginx and the 421 Host check, a shared request-state key, SQLite, cache hints, key rotation, audit logs and Kubernetes.