Introduction to DevSecOps: Git, Semgrep, CI
Building security into the delivery pipeline.
Level 101 · 19 lessons · 15 practice labs
Lessons
Foundations
- What DevSecOps is: You will understand how DevSecOps builds security into every step instead of leaving it to the end, and why that is cheaper and faster.
- Shifting left: the value of catching flaws early
- Error and debug information leaks: You will see how detailed error and debug output can leak internal details, and learn how to turn it off in production.
- Shrinking the service surface: You will learn to shrink a service's attack surface by switching off unneeded features and open endpoints, and to turn that into a checklist.
- Least privilege for service files: You will make sure only the users who need it can reach a service's files and configuration, and learn to find and fix wrong permissions.
- Short task: list a sample service’s exposed endpoints and excess privileges
Code and dependencies
- No secrets in Git: You will learn why passwords and keys must never enter Git history, how to find and rotate ones that slipped in, and the right places to keep them.
- Dependency scanning: You will learn to scan third-party libraries a project uses for known flaws, and to handle the warnings in order of importance.
- Parameterised queries: You will see how parameterised queries keep input separate from commands and stop SQL injection at the root, and learn to apply them in your own code.
- Static analysis: Semgrep: You will use Semgrep to scan code for risky patterns without running it, interpret the findings, and filter out false alarms.
- Security regression tests: You will learn to use automated tests to make sure a security flaw that was fixed once does not come back later.
- Catching secrets that leak into logs with a test: You will add a test that catches passwords and tokens being written to logs, so the same mistake cannot come back.
- Short task: run secret, dependency and static analysis scans on a small project
Containers and the pipeline
- No root in containers: You will learn why a container should run as an ordinary user instead of root, and how to set that in the image definition.
- CI token permissions and untrusted input: You will learn to give pipeline tokens only the permissions they need, and to keep untrusted outside input from reaching the pipeline.
- Release verification: checksums: You will learn to verify the checksum of a downloaded or published release to be sure the file was not altered on the way.
- Security gate: stopping a release when checks fail: You will make the build pipeline stop a release on its own when dependency or code scans fail.
- Short task: test a pipeline’s security gate with a deliberate flaw
Capstone
- Capstone: build a secure pipeline: For a fictional company's small project you will build, in the lab, a secure delivery pipeline with build, scan and verification steps.
Practice labs
- List the exposed endpoints of a sample service: Extract the ports the running service listens on and the URL paths that answer, and flag those that should not be public.
- Close the information leak on a debug page: Find the setting that shows stack traces and environment variables on error, turn it off and confirm users get only a generic message.
- Apply least privilege to the service’s files and prove it: Narrow ownership and permissions of config, log and upload directories to the service user and show the service account cannot modify code files.
- Run a secret scan on a small project: Scan the repository with gitleaks and state which file and commit hold the key it finds.
- Find the vulnerable dependency and upgrade to a safe version: Run the dependency scan, move the reported package to the fixed version and show the tests still pass.
- Clean a key buried in history and supply the new one safely: Treat the leaked key as void, load a new one from an environment file, rescan the repository and prove the old key works nowhere.
- Run a first Semgrep scan and read one finding: Scan the project with a stock ruleset and write the rule, file and line of the highest-severity finding.
- Turn a string-concatenated query into a parameterised one: Convert the query Semgrep flags into a parameterised query, rerun the scan and show with a test that behaviour is unchanged.
- Merge the findings of three scans into one priority list: Rank secret, dependency and static analysis results by severity and reachability, fix the top three and prove it by rescanning.
- Run the failing test for a security flaw: Run the ready regression test and read from the output which input makes it fail and why.
- Catch a password leaking into logs with a test: Write a test asserting the password never appears in log output after a login request, watch it fail and fix the logging.
- Write the test pack that keeps three fixed flaws from returning: Write one regression test each for the injection, authorisation and leak fixes, and show the tests break when a fix is reverted.
- Show the container runs as root and fix it: Check the user ID in the running container, add an unprivileged user to the Dockerfile and verify again.
- Verify a release file with its checksum: Compare the SHA-256 of a downloaded release with the published value, tell the tampered copy apart and add the check to the pipeline.
- Test the security gate with a deliberate flaw: Add a step that stops the release when a scan fails, introduce a known-vulnerable dependency to show the pipeline stops and passes once fixed.
About this course
Building security into the delivery pipeline.
What you will learn
- Foundations
- Code and dependencies
- Containers and the pipeline
- Capstone
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.