Skip to main content
_d
devops/ness

Learn DevSecOps: Secrets, Scanning, Supply Chain and Cluster Security

Learn DevSecOps by adding one control at a time to a pipeline you already have: keep secrets out of Git, scan code, dependencies and images, prove what you shipped with SBOMs, then replace long-lived credentials. Each step says which tool to run and where it fails.

The path pairs with the CI/CD path; its Secure pipelines stage is a good starting point.

  1. Stage 1: Foundations

    Find the problems you already have.

    1. 1Secret scanning in GitCatch leaked keys before and after push.
    2. 2SAST vs DASTKnow which scanner finds what.
    3. 3Dependency scanning (SCA)Triage vulnerable packages without alert fatigue.
    4. 4Container vulnerability scanningScan images in CI and fail on what matters.

  2. Stage 2: Supply chain

    Prove what you built and who built it.

    1. 5Software supply chain attacksUnderstand the attack paths.
    2. 6SBOMs and attestationGenerate, sign and verify provenance.
    3. 7npm supply chain hardening in CILock installs against malicious packages.

  3. Stage 3: Identity and secrets

    Remove long-lived credentials.

    1. 8Short-lived credentials and dynamic secretsSwap static keys for expiring ones.
    2. 9Vault vs Secrets Manager vs DopplerPick a secrets store.
    3. 10Least-privilege IAM without breakageTighten permissions safely.

  4. Stage 4: Runtime

    Clusters and production.

    1. 11Kubernetes security best practicesHarden RBAC, Pod security and admission.
    2. 12Vault as a Kubernetes secrets backendInject secrets without storing them in etcd.
    3. 13Handling vulnerabilities in productionRun a CVE response without panic.

Keep these open

Every guide on this path names the versions and docs it was checked against and lists its sources at the end. Browse all security guides or another learning path.