Security
Advanced 18 min read Security

DevSecOps & Compliance

Shift security left: bake scans, policy checks and compliance evidence into the pipeline itself. From SAST and dependency audits to SBOMs and SLSA, make security a first-class CI stage.

shift leftSASTdependency auditSBOMSLSApolicy as codecompliancecontinuous security
Prerequisites: Security Fundamentals Container Security CI/CD Fundamentals
Introduction

What is this?

DevSecOps treats security as a continuous property of the delivery pipeline, not a gate at the end. Every commit triggers SAST, dependency audits, secret scans and image scans; policy as code validates infrastructure before apply; and compliance evidence (SBOM, signatures, audit logs) is generated as an artifact of the same pipeline that ships the code.

Motivation

Why do you need it?

  • Findings found at design and build time cost a fraction of those found in production.
  • Automation removes the bottleneck of security reviews without removing the security itself.
  • Compliance becomes evidence produced by the pipeline, instead of a manual audit scramble.
  • Policy as code means infrastructure changes are reviewed by the same engine that approves apps.
  • A single trusted pipeline is auditable end to end: who built what, from which source, signed by whom.
Think about it

Mental model

Imagine

Cooking with taste-tests at every step

Think of

Shift-left security in a pipeline

You do not cook an entire meal and taste it only at plating. You sample at each step so problems are fixed while they are cheap. DevSecOps adds the security 'taste test' as a stage of every build.

Mechanics

How it works

  • Static analysis (SAST) and secret scanning run on every commit and fail fast on findings.
  • Dependency and image audits (SCA, Trivy) compare resolved versions against CVE databases.
  • Policy as code (OPA, Kyverno, checkov) validates IaC and manifests before they reach a cluster.
  • The pipeline produces provenance: SBOM, signatures and build logs that prove artifact lineage.
  • Runtime and continuous monitoring (Falco, CSPM, SIEM) close the loop on the deployed state.

Security gates along the delivery pipeline.

Commit
Dependency audit
Build image
Policy check
Sign + promote
Reference

Key commands

semgrep --config auto --error .

Run static analysis with default rules and fail on any finding.

trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:1.0

Scan an image and exit non-zero if high/critical CVEs are found.

trivy image --format spdx-json --output sbom.spdx.json myapp:1.0

Emit an SPDX SBOM for the image as compliance evidence.

checkov -d . --framework terraform

Scan infrastructure-as-code for policy violations before apply.

gitleaks detect --redact .

Detect secrets in the working tree and redact them from output.

Hands-on

Examples

Security gates as pipeline steps

Security gates as pipeline steps
gitleaks detect --redact .
semgrep --config auto --error .
curl -sL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:1.0
trivy image --format spdx-json --output sbom.spdx.json myapp:1.0

Each step gates the build: secrets are scanned, SAST runs, the image is scanned with an exit code on high/critical findings, and an SBOM is emitted as compliance evidence for the artifact.

Real world

In production

  • Every PR runs the security stage; pipeline stops replace review backlogs.
  • SBOMs and signatures are stored beside the artifact for compliance and incident response.
  • Policy as code blocks non-compliant Terraform and Kubernetes changes at plan time.
  • Vulnerability posture is a tracked metric that gates promotion, not a manual checklist.
  • Evidence is exported to auditors on demand: scan reports, SBOMs, sign-off logs, access audits.
Guidelines

Best practices

  • Make security stages fail the pipeline on real findings, with a waiver workflow for exceptions.
  • Scan the exact artifacts that ship, from the exact commit, not a nightly snapshot.
  • Use policy as code so compliance rules are versioned, reviewed and tested like software.
  • Generate provenance and SBOMs at build time and attach them to the artifact.
  • Close the loop with runtime monitoring so deployed drift is detected, not just prevented.
Watch out

Common mistakes

  • Scanning only at release time and ignoring the per-commit diff.
  • Running scanners but never acting on the findings — a false sense of security.
  • Adding exceptions to scanners without an owner, a reason and an expiry.
  • Treating compliance as a snapshot instead of continuous, automated evidence.
  • Building the pipeline to be green at any cost, so gates become decoration.
Root cause analysis

Common issues

Error
Pipeline red on a finding nobody understands
Root cause

A rule matches a pattern with no obvious real-world impact

Fix

Read the rule documentation, reproduce locally, and either fix the code or file a tracked, expiring waiver.

Error
SBOM missing from the artifact
Root cause

The SBOM stage ran on a different image or was skipped on this branch

Fix

Generate the SBOM in the same step that builds the final artifact and store it with the image digest.

Error
Policy gate blocks an infrastructure change at plan time
Root cause

The IaC violates a compliance rule (e.g. public bucket, missing encryption)

Fix

Fix the configuration to satisfy the policy, or route an exception through the approval workflow.

When things break

Debugging tips

  • Reproduce the scanner's finding locally with the exact version the pipeline uses.
  • Start with a baseline scan to separate pre-existing debt from new findings.
  • Use SARIF output to file and track findings in the same issue tracker as bugs.
  • Check pipeline logs for the failing stage and the exact rule that tripped.
Interviews

Interview checkpoint

Practice

Hands-on lab

Shift-Left Security Gates
30 min · advanced
In progress
Objectives
  • Create a repo and commit a fake secret
  • Scan the tree for credential patterns
  • Show the secret persists in git history
  • Capture pipeline-style scan evidence in a report

Shift-Left Security Gates

30 min · advanced

0/6 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

What is the core idea of shift-left security?

2

What does an SBOM provide for an artifact?

3

A security gate that never fails is a sign the pipeline is well secured.

Quick reference

Cheat sheet

Pipeline gates
gitleaks detectSecret scan on the diff
semgrep --config auto --errorSAST that fails the build
trivy image --exit-code 1Block on HIGH/CRITICAL CVEs
checkov -d .IaC policy compliance
Evidence & provenance
trivy image --format spdx-jsonEmit an SBOM
cosign sign IMGSign the image
cosign attestAttach provenance
SLSA levelsGrade supply-chain integrity
Go deeper

Official documentation

OWASP DevSecOps Guideline
docs
OWASP SAMM
docs
Snyk Documentation
docs
SLSA — Supply-chain Levels
docs
Sigstore
docs