Web Security & OWASP (50 Qs)•Part 5: API Security, DevSecOps & Enterprise Incident Handling (43 - 50)
DevSecOps & Shift-Left Security: Integrating SAST, DAST, SCA, and secret scanning into CI/CD pipelines.
Shift-Left Security Pipeline
"Shift-Left" means moving security checks from late-stage manual penetration testing directly into the developer's pull request workflow, catching vulnerabilities when they are cheapest to fix.
scss
+--------------------------------------------------------------------------+
| Automated DevSecOps Pipeline Hierarchy |
| |
| 1. Pre-Commit Hooks -> Gitleaks / TruffleHog (Blocks secret leaks) |
| 2. SAST (Static) -> Semgrep / SonarQube (Inspects source code) |
| 3. SCA (Dependencies) -> Trivy / Dependabot (Scans open-source CVEs) |
| 4. Container Scanning -> Trivy (Scans OS base layers for CVEs) |
| 5. DAST (Dynamic) -> OWASP ZAP (Probes running staging endpoints)|
+--------------------------------------------------------------------------+
Production GitHub Actions DevSecOps Blueprint
yaml
name: DevSecOps Gate
on: [pull_request]
jobs:
security-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
# Gate 1: Check for committed AWS keys, private certificates, API tokens
- name: Secret Scanning
uses: gitleaks/gitleaks-action@v2
# Gate 2: Static Application Security Testing (SAST)
- name: Semgrep SAST
uses: returntocorp/semgrep-action@v1
with:
config: >-
p/security-audit
p/owasp-top-ten
# Gate 3: Software Composition Analysis (SCA)
- name: Dependency & Container CVE Scan
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
severity: 'CRITICAL,HIGH'
exit-code: '1' # Fails PR if critical CVE exists!