DevSecOps
Browse all articles, tutorials, and guides about DevSecOps
Guides
Security Gates
What security gates are and how to add them to CI/CD: policy as code, CVE gates with KEV and EPSS, compliance checks and admission control, with real runs.
Cryptography Essentials
Hands-on cryptography for DevOps engineers: AES-GCM and key management, hashes and signed releases, TLS 1.3 with post-quantum keys, and a private CA.
Static Application Security Testing (SAST)
Learn SAST with SonarQube, Semgrep and CodeQL: how static analysis finds vulnerabilities, custom rules and queries, and CI/CD quality gates.
Threat Modeling
Learn threat modeling on one worked example: data flow diagrams, STRIDE, risk rating beyond DREAD, attack trees, LINDDUN, LLM threats and exercises.
OWASP Top 10
The OWASP Top 10:2025 for developers and DevOps teams: what changed since 2021, each risk with vulnerable code and its fix, and tests and scanners for CI.
Security Principles
The CIA triad, defense in depth, least privilege and zero trust, each tested on a small app on Linux and Kubernetes with real commands and output.
Posts
SOC 2 Evidence From GitHub and Terraform, and the Part That Still Needs a Person
We pointed a small evidence collector at a repository whose main branch had a strict ruleset. The ruleset passed and three change-management controls failed. Here is which SOC 2 evidence you can pull from GitHub and Terraform, which still needs a person, and ten ways an evidence script can pass a control without evidence.
A Poisoned .git/config Runs Code on git status. We Tested Which Commands and Copies Carry It
On October 2 GitLab disclosed ConfigPoisoning: a repo that brings its own .git/config makes an AI coding tool run attacker commands when it shows a diff. We ran the same trick against plain git 2.39 and 2.55. A bare git status ran repo-supplied programs, the usual safe diff flags missed the clean filter, git 2.54 config hooks walked past core.hooksPath=/dev/null, a clone was clean but a cached workspace was not, and GitHub-hosted runners switch off the ownership check that would stop it.
GITHUB_TOKEN Is Now 377 Characters Long. We Tested Which Redaction Rules Still Catch It
GitHub finished moving App installation tokens, including the Actions GITHUB_TOKEN, to a new ghs_<app id>_<JWT> format on October 2. We ran 40 real tokens through the usual redaction regexes and one through gitleaks, trufflehog and detect-secrets. The latest gitleaks release found nothing, and the common patterns either missed the token or hid only its first 40 to 46 characters, which were the same in all 40 tokens.