DevSecOps

32 courses, 525 lessons. A real Kali Linux lab in the browser.

Introduction to DevSecOps: Git, Semgrep, CI (Level 101, 19 lessons): Building security into the delivery pipeline.
The secure software development lifecycle (Level 101, 16 lessons): You learn which security work belongs to each step of software’s journey from idea to production and set up a practical secure development process for a small team.
Code repository security: Git, signed commits and access (Level 101, 17 lessons): You learn to check who can change a repository, whether a change really came from its author and what has leaked into its history.
Introduction to container security: Docker (Level 101, 16 lessons): You learn step by step how a container differs from a virtual machine, what its isolation rests on and the most common security mistakes in Docker images.
Linux security for DevSecOps (Level 201, 21 lessons): Hardening servers and images.
Docker security (Level 201, 20 lessons): Image, runtime and network security.
30 days of DevSecOps (Level 201, 13 lessons): A short security task every day.
Secrets management: scanning, rotation and leak response (Level 201, 20 lessons): You keep passwords, keys and tokens out of code, catch leaks with gitleaks, store them in Vault and revoke and replace a leaked key.
Threat modelling: STRIDE and data flow diagrams (Level 201, 18 lessons): You draw a system through an attacker’s eyes before any code is written, find threats with STRIDE and prioritise practical countermeasures for each.
Secure coding principles: Python and JavaScript (Level 201, 19 lessons): You find input validation, output encoding, authentication and authorisation mistakes in real code and write their safe versions in Python and JavaScript.
Static analysis (SAST): Semgrep and Bandit (Level 201, 18 lessons): You set up tools that find security flaws without running the code, interpret findings, weed out false alarms and fit scanning into the developer’s daily flow.
Dynamic testing (DAST): scanning with OWASP ZAP (Level 201, 17 lessons): You explore a running web app with OWASP ZAP, scan it passively and actively, verify the findings and write a report developers can act on.
Dependency security (SCA): pip-audit, npm audit, OSV-Scanner (Level 201, 17 lessons): You find known vulnerabilities in the open-source packages your projects use, work out whether you are really affected and automate updates in a controlled way.
CI/CD security: pipeline configuration, runners and tokens (Level 201, 18 lessons): You learn how a continuous integration pipeline works and where it carries secrets and privileges, and you set up pipeline files, runners and tokens safely.
Scenario: Lale Pay’s first secure release pipeline (Level 201, 15 lessons): You join the fictional, fast-growing payments start-up Lale Pay as its first security engineer and build a release pipeline with secret, dependency and code scanning from scratch.
Advanced threat modelling: attack trees and models as code (Level 301, 17 lessons): You model large systems with attack trees, risk scoring and threat models kept as code, and set up a process that keeps the model current with every change.
Writing your own SAST rules: Semgrep and data flow (Level 301, 18 lessons): You write Semgrep rules that catch your organisation’s own mistakes, trace injections with source-to-sink data flow analysis and protect your rules with tests.
DAST in the pipeline: ZAP automation and API scanning (Level 301, 16 lessons): You run ZAP headless, turn authenticated and API scans into an automation plan and add a pipeline step that scans the test environment on every deploy and stops on bad results.
Security testing in the pipeline: unit, integration and fuzzing (Level 301, 15 lessons): You turn security requirements into automated tests, catch authorisation and input mistakes with tests and use fuzzing to find code that breaks on unexpected input.
Software bill of materials (SBOM): Syft, CycloneDX, Grype (Level 301, 15 lessons): You produce SBOMs for your apps and images, use them to answer new vulnerabilities in seconds and document with VEX which ones don’t affect you.
Advanced secrets management with Vault (Level 301, 18 lessons): You run Vault with policies, dynamic database credentials, an internal certificate authority and audit logs, so that apps work with short-lived credentials.
Secure container images: minimal bases, Hadolint, Trivy (Level 301, 18 lessons): You build small, rootless images without known vulnerabilities, check Dockerfiles and images automatically and distribute signed images safely from a local registry.
Hardening CI/CD: isolation, OIDC and pinned dependencies (Level 301, 16 lessons): You isolate runners between jobs, replace long-lived keys with short-lived OIDC identities, pin third-party actions and protect the pipeline itself against tampering.
Security gates and findings management in the pipeline (Level 301, 15 lessons): You gather scanner results in one place, deduplicate findings, write rules for which findings stop a release and manage exceptions with expiry dates and approvals.
Scanning configuration files: Ansible, Dockerfile, Compose (Level 301, 15 lessons): You automatically find security mistakes in Ansible playbooks, Dockerfiles and Compose files, write your own checks and tie scanning to pull requests.
Software supply chain security: signing, provenance and SLSA (Level 401, 17 lessons): You examine every link from source to deployment as a threat, sign images with cosign, produce provenance and build a chain that accepts only verified artefacts.
Container runtime security: seccomp, AppArmor, Falco (Level 401, 16 lessons): You restrict running containers at kernel level, cut escape risk with rootless Docker and user namespaces, and catch suspicious behaviour instantly with Falco.
CI/CD attack paths and their defence (Level 401, 13 lessons): You watch attacks such as poisoned pipeline execution, cache poisoning and artefact tampering step by step in your own isolated lab and set up controls that detect and prevent each one.
Scenario: Pusula Software’s compromised build pipeline (Level 401, 13 lessons): A backdoor turns up in a release the fictional Pusula Software shipped to customers; you investigate the pipeline, scope the impact, inform customers and rebuild the chain securely.
Career capstone: application security engineer (Level 401, 12 lessons): You live through a real quarter of an application security engineer: design reviews, code reviews, scan results, an outside vulnerability report and working with developers.
Building a DevSecOps programme: maturity, metrics and champions (Level 501, 14 lessons): You measure an organisation’s secure development maturity, draw up a roadmap, build a security champions network and report progress to leadership with clear metrics.
Career capstone: DevSecOps engineer (Level 501, 13 lessons): You join the software unit of the fictional Atlas Logistics as a DevSecOps engineer, secure its pipelines, images, secrets and supply chain end to end and report to management.

Projects

Secure the repository: signed commits and a protected branch: In Göktaşı Yazılım’s new project repository you set up commit signing, protect the main branch, add rules that keep secret files out, and show an unsigned push is rejected.
Run a first code scan, triage and fix the findings: You scan Ayçiçeği Gıda’s order application with Semgrep, sort the findings into real problems and false alarms, fix the three most important, and add the scan to the pipeline so it runs on every push.
Remove excessive privileges from a container: You find a container running with more privileges than it needs, reduce them to the minimum, and show the application still works fine.
Permission and service review of an inherited Linux server: On an inherited application server you narrow needless open ports, loose file permissions and broad sudo rules, then report before and after.
Stop a release that fails security checks: You add dependency and secret checks to the build pipeline and show that a release with a known flaw is stopped before it ships.
Upgrade a vulnerable dependency to a safe version: You upgrade a flagged library, prove with tests that the app still works and with a fresh scan that the flaw is gone.
Build a container image with no secrets inside: You make sure build tokens do not stay in image layers and prove the image is clean by inspecting its history.
Fix a script injection in a CI pipeline: You find the flaw in an automated build pipeline script that lets outside input run as a command, fix it safely, and test the fix.
Keep a look-alike package out of a build: You set up checks that keep a package with a name close to a real one out of the build, and show they catch the fake package.
Accept a release only from its trusted publisher: You add a check that confirms with a signature that a software release comes only from its trusted publisher, and show an unsigned release is rejected.
Give a report job temporary database access: You give a report job database access only for the time and scope it needs, and show the access closes by itself when time runs out.
Security-review an inherited Docker Compose project: You review open ports, privileges and secrets in a multi-service Compose project handed over by another team and deliver it fixed.
Build a threat model for a payment API: You draw the data flow diagram of Yelkovan Bankası’s new payment API, list threats with STRIDE, keep the model as code in the repository, and assign a mitigation and owner to each threat.
Watch and confine a running container (seccomp, Falco): For Mercanköşk Otelcilik’s booking container you write a seccomp profile that closes unneeded system calls and Falco rules that report an unexpected shell or file write, and show the app works and the alerts arrive.
Produce a release evidence bundle: SBOM, signature, provenance: For the image of Kuzeyyıldızı Kargo’s shipment tracking service you generate an SBOM, scan components for known flaws, sign the image, and deliver a verifiable release evidence bundle with a provenance record.
Review the build pipeline against attack paths and close them: In Turnalı Perakende’s build pipeline configuration you find over-scoped tokens, shared runners and unpinned dependencies, fix each one, and report the findings in order of risk.
Assess DevSecOps maturity and write a one-year roadmap: From prepared data about Saklıvadi Üniversitesi’s software unit you produce a maturity assessment, choose the metrics to track, and prepare a twelve-month roadmap that includes a security champions network.
Build a secure release pipeline end to end: For Lavinya Klinikleri’s appointment service you combine code, dependency, secret, image and running-application scans in one pipeline, define pass thresholds, and show a signed release ships only after passing every check.