Scenario: Lale Pay’s first secure release pipeline
You join the fictional, fast-growing payments start-up Lale Pay as its first security engineer and build a release pipeline with secret, dependency and code scanning from scratch.
Level 201 · 15 lessons · 12 practice labs
Lessons
Week one
- Getting to know the company: team, product and pipeline
- Quick wins: secrets left in the open
- The first risk list
- Short task: write a one-page status brief for the founders
Setting up scanning
- Secret scanning and clean-up
- Dependency scanning and the first upgrades
- Static analysis and cutting the noise
- Securing the container image
- Short task: show every scan running on a pull request
Release
- The release gate and exception process
- Approval and signing for production deploys
- Developer feedback and tuning
- Short task: prepare the notes for the first month’s retrospective
Capstone
- Answering a customer’s security questionnaire
- Capstone: present Lale Pay’s secure release pipeline to an auditor
Practice labs
- Summarise the team, product and pipeline on one page: Write the repositories, pipeline stages and deploy environments into an inventory.
- Find the secrets left in the open and close them fast: Find three secrets exposed in repository history and CI variables, rotate them and move them to protected variables.
- Write the first risk list and the status brief for the founders: Rank the findings by likelihood and impact, choose five jobs for month one and prepare a non-technical one-page brief.
- Add secret scanning to the pipeline: Add a gitleaks job and show it fails on a sample leak.
- Set up dependency and static analysis scans and cut the noise: Add the scans, make the first upgrades, record a baseline and verify only new findings are reported.
- Secure the container image and show every scan on a pull request: Make the image unprivileged and pinned, add an image scan and prove the results of all four scans appear on one pull request.
- Define the release gate’s threshold: Write in the policy file which severity of new finding stops a release.
- Set up the exception process and deploy approval: Define a justified, time-limited exception record and put production deploys behind an authorised approval.
- Sign the release and tune the gate from developer feedback: Sign the artefact and verify at deploy, examine with data two false blocks developers complained about and correct the policy.
- Prepare the notes for the first month’s retrospective: Write what worked, what slowed things down and the next three jobs.
- Answer a customer’s security questionnaire with evidence: Answer fifteen questions from pipeline output, policy files and scan reports, and state honestly which cannot be answered.
- Present the secure release pipeline to an auditor: Prepare a walkthrough showing every control from code to production with its evidence and owner, and trace one release the auditor picks end to end.
About this course
You join the fictional, fast-growing payments start-up Lale Pay as its first security engineer and build a release pipeline with secret, dependency and code scanning from scratch.
What you will learn
- Week one
- Setting up scanning
- Release
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.