DevSecOps Pipeline
SAST, DAST, dependency scanning, compliance gates - security baked into your pipeline, not bolted on.
“DevSecOps is what happens when security stops being the department of 'no' and starts being the department of 'not in production.'”
What you'll learn
Security that only exists in a PDF is not in the pipeline
DevSecOps is a clumsy word for 'the same pipeline that tests the app also refuses known-bad code, known-bad dependencies, and known-bad images'. Security review still happens. It happens with evidence, not with a meeting that starts after the deploy.
Shift-left is not a slogan if the scan is warn-only forever. A gate that never gates is interior design.
SAST: read the code before it ships
Static analysis (Semgrep, CodeQL, SonarQube) looks at source. Run it on the pull request. Fail on issues you have agreed are real: injection sinks, hardcoded credentials, obviously broken crypto. Do not fail the build on a style opinion dressed as a CVE.
Tune the rules. An unread 4,000-finding report is how engineers learn to ignore security.
DAST and the thing that only exists while running
Dynamic testing hits a live (usually non-prod) app. It finds the misconfigured header, the open admin route, the 'we forgot auth on this one handler'. It is slower and noisier than SAST. Run it on staging, on a schedule, and before a release you cannot casually roll back.
If staging is a snowflake, DAST results are fiction. Fix staging first.
Dependencies and images: the supply chain you already have
Lockfiles exist so npm ci is not a lucky draw. Dependabot, Renovate, Snyk, or OS-level scanners tell you when a library you forgot is on fire. Auto-open the PR. Review it. 'We'll bump next quarter' is how next quarter inherits last year's CVE.
Scan container images in CI (Trivy, Grype, the registry's scanner). Rebuild base images on a cadence. A two-year-old node:16 image is a decision, even if nobody wrote it down.
Compliance gates without turning the pipeline into a museum
SOC2 and friends want change history, access control, and proof that prod deploys were reviewed. Git already has the history. Branch protection, required checks, and a documented exception path are the control. An SBOM (Syft, the build's own manifest) is a file you can hand someone.
Do not add a human approval to every microservice lint job. Add it where the blast radius is production data. That is the difference between governance and a queue.