Course · Intermediate

Building a DevSecOps pipeline

Put security checks where every change already passes, the CI/CD pipeline, so that secrets, vulnerable code, risky infrastructure and unsigned images are stopped before they ship, and every release leaves evidence an auditor can read.

Start the course See the syllabus

26 itemsLast updated October 2026

devsecops-pipeline / at a glance

  • 6modules
  • 14lessons
  • 6labs and projects
  • 270practice questions

Most security reviews happen too late: after the code is merged, after the image is built, sometimes after it is in production. This course moves those checks into the one place every change already has to pass, and makes them blocking.

What you will build

One public GitHub repository, devsecops-lab: a small Python web service and a single pipeline that grows module by module. Each lab adds a job and leaves the repository with a working workflow you can keep.

Module Jobs you add What they stop
1 smoke A broken build reaching review; the read-only baseline the rest builds on
2 secrets Credentials committed to the repository
3 sast, deps Injection bugs in your code and known-vulnerable libraries
4 iac Open security groups, public buckets, unencrypted storage
5 image Vulnerable base images, unknown contents, unsigned artifacts
6 test, dast, evidence Missing security headers, untested fixes, and no records for an assessor

By the end, every job is a required check on main, so a pull request that leaks a key, adds a vulnerable dependency, opens a storage bucket to the internet or ships an image with fixable serious vulnerabilities fails before anyone has to notice.

Tools

Everything is free and open source, run on GitHub Actions: pre-commit and Gitleaks for secrets; Semgrep, pip-audit and OSV-Scanner for code and dependencies; Trivy, Checkov, Conftest and OPA for infrastructure; Trivy, Syft and Cosign for images, SBOMs and signing; and OWASP ZAP for testing the running app. The ideas carry to GitLab CI, Bitbucket Pipelines, Jenkins and Azure DevOps; where a step differs, the lesson says so.

How it is organised

Every lesson ends with key takeaways and practice questions. Modules 1 to 5 each end with a hands-on lab and a checkpoint quiz; module 6 ends with a capstone project, in which you finish the pipeline and its evidence pack, and a final assessment across the whole course. Your progress is saved in your browser, so you can pick up where you left off.

This edition

What's new as of October 2026

  • Real supply-chain incidents from 2024 to 2025 used as case studies: the xz-utils backdoor, the tj-actions/changed-files compromise, the Ultralytics and Nx package compromises, and the Shai-Hulud npm worm
  • A new lesson on threat modelling the pipeline, built on the OWASP Top 10 CI/CD Security Risks
  • GitHub's 2025 changes: organization policies that block actions or require SHA pinning, and pull_request_target always running the default branch's workflow
  • Trusted publishing to npm and PyPI with OIDC, and dependency cooldowns in Dependabot and minimum release age in Renovate, against malicious package releases
  • OPA 1.0 Rego syntax, S3-native Terraform state locking, and OpenTofu
  • GitHub artifact attestations alongside Sigstore signing, and SLSA v1.2
  • Compliance mapping that tracks the draft SSDF revision (SP 800-218 Rev. 1), CMMC's phased rollout, and FedRAMP 20x

Outcomes

By the end, you can

  • Explain where each class of security check belongs in a pipeline, and why a check that does not block is only a report
  • Stop secrets from reaching a repository, and know what to do when one already has
  • Gate merges on static analysis and dependency scanning, with a triage process that keeps false positives from training people to ignore the gate
  • Scan Terraform before it is applied and enforce your own rules as policy as code
  • Build a minimal container image, scan it, produce an SBOM, and sign it without a long-lived key
  • Deploy with short-lived cloud credentials, run a baseline DAST scan, and map the pipeline's output to the controls an assessor will ask about

Syllabus

Modules, lessons and labs

Work through them in order: each one builds on the last, and each module ends with a checkpoint. Module 1 (5 items) is open to everyone. After that, sign in and pass each lesson's questions (70% or better) to unlock the next one. Your progress is saved to your account.

  1. Module 1

    Foundations and your lab repository

    Why the pipeline is where security is enforced, how attackers target pipelines, and the repository you build on for the rest of the course.

    1. Course orientation: how this course works, and why it matters nowLesson · 10 questions
    2. Why the pipeline is the control pointLesson · 10 questions
    3. Threat modelling the pipeline itselfLesson · 10 questions
    4. Lab: set up the course repository and its first pipelineLab · 10 questions
    5. Checkpoint: foundationsModule checkpoint · 10 questions

  2. Module 2

    Source control and secrets

    Lock down the repository, keep credentials out of Git, and know exactly what to do when one gets in.

    1. Securing the repositoryLesson · 10 questions
    2. Secrets and leak responseLesson · 10 questions
    3. Lab: block leaked secrets at every layerLab · 10 questions
    4. Checkpoint: source control and secretsModule checkpoint · 10 questions

  3. Module 3

    Code and dependency scanning

    Static analysis you can tune and trust, and dependency hygiene that holds up against both vulnerable and malicious packages.

    1. Static analysis that teams keep switched onLesson · 10 questions
    2. Dependency security, from known vulnerabilities to malicious packagesLesson · 10 questions
    3. Lab: a code and dependency gateLab · 10 questions
    4. Checkpoint: code and dependency securityModule checkpoint · 10 questions

  4. Module 4

    Infrastructure as code

    Catch risky Terraform before it is applied, and enforce your own rules as tested policy as code.

    1. Scanning infrastructure as codeLesson · 10 questions
    2. Policy as code with OPA and ConftestLesson · 10 questions
    3. Lab: scan Terraform and enforce your own policyLab · 10 questions
    4. Checkpoint: infrastructure as codeModule checkpoint · 10 questions

  5. Module 5

    Containers and the software supply chain

    Minimal images, SBOMs, keyless signing and build provenance that let you prove what you ship.

    1. Secure container imagesLesson · 10 questions
    2. SBOMs, signing and provenanceLesson · 10 questions
    3. Lab: build, scan, SBOM and sign the imageLab · 10 questions
    4. Checkpoint: containers and the supply chainModule checkpoint · 10 questions

  6. Module 6

    Deploy, test the running app, and prove it

    Short-lived deploy credentials, dynamic testing, compliance evidence, then a capstone project and the final assessment.

    1. Secure deploymentLesson · 10 questions
    2. Dynamic testing and runtime monitoringLesson · 10 questions
    3. Compliance evidence from the pipelineLesson · 10 questions
    4. Capstone: a gated pipeline with an evidence packCapstone project · 10 questions
    5. Final assessmentModule checkpoint · 20 questions

Standards

Taught against

  • NIST SP 800-218 Secure Software Development Framework (SSDF)
  • NIST SP 800-53 Rev. 5 (the controls behind FedRAMP)
  • NIST SP 800-171 (the requirements behind CMMC Level 2)
  • DoD Enterprise DevSecOps guidance and DISA STIGs
  • SLSA supply-chain levels
  • OWASP Top 10 and OWASP SAMM

Courses are taught against the frameworks they name. That is alignment, not certification: no course is certified, approved or endorsed by NIST, the DoD, DISA, FedRAMP, the CMMC program or any other agency or standards body, and completing one does not make a system compliant.

Want it taught live, or to your team?

The course is free: module 1 to anyone, the rest with a free account. We also run it with an instructor, for a cohort or against your own systems. Ask us for the format and price.

Ask about this course