Security (DevSecOps) · Module 08

A complete DevSecOps pipeline

Put every tool together into one pipeline: shift left to find issues early, DAST with OWASP ZAP against a test environment, security gates with clear thresholds, and a vulnerability triage process with SLAs, exceptions and metrics.

Practice interactively →

What you will learn

• Explain shift left and order security checks by stage
• Run an OWASP ZAP baseline scan and read its results
• Design security gates that block what matters without stalling the team
• Triage findings, assign SLAs and manage security exceptions

Lessons

1. Shift left - bringing security earlier

   The earlier a defect is found the cheaper it is to fix; DevSecOps puts automated security checks at every stage from the IDE to production and makes security a shared team responsibility.

2. DAST with OWASP ZAP

   DAST tests the running application from outside like an attacker; ZAP has a passive baseline scan safe for every PR, an active full scan for test environments, and an API scan that reads OpenAPI.

3. Security gates in the pipeline

   A security gate is an automated checkpoint that decides whether the pipeline may continue; set clear thresholds based on severity and fixability, separate blocking from warning, and provide a controlled emergency exit.

4. Vulnerability triage and management

   Tools produce hundreds of findings; triage decides which are real, who owns them, their priority and fix deadline, manages time-limited exceptions and measures MTTR so the process improves over time.