Tag: DevSecOps
All the articles with the tag "DevSecOps".
- 3 min read
DAST with OWASP ZAP in CI/CD Pipelines
Dynamic Application Security Testing often gets skipped because it's hard to automate. Here's how to integrate OWASP ZAP into your pipeline without it becoming a blocker.
- 3 min read
EPSS: A Smarter Way to Prioritize CVEs
CVSS scores alone are a poor guide for prioritization. EPSS uses real exploit data to tell you what's actually being exploited in the wild — and that changes everything.
- 3 min read
Hardening GitHub Actions Workflows
GitHub Actions is powerful and widely trusted — which makes misconfigured workflows a high-value attack target. Here's how to lock them down.
- 3 min read
Software Supply Chain Security and SBOMs
What SBOMs actually are, why they matter after Log4Shell and SolarWinds, and how to generate and use them in practice.
- 3 min read
Secrets Management in CI/CD Pipelines
How to stop treating secrets as an afterthought in your pipelines — and what actually works in practice.
- 5 min read
Why I Started Building ScanDog
After a decade of security engineering and watching teams drown in vulnerability noise, I decided to build the tool I always wished existed.
- 4 min read
Comparing four popular Kubernetes policy engines
A comprehensive comparison of OPA Gatekeeper, Kyverno, Kubewarden, and jsPolicy for Kubernetes policy enforcement
- 2 min read
Scan entire a Terraform repository by Checkov
How to scan entire Terraform repository using Checkov with bash script solution
- 1 min read
Checkov as IaC scanner on Azure DevOps
Implementation and maintaining infrastructure is easy by using IaC solutions, but did you consider security when you write a code block?
- 3 min read
OWASP DevSecOps Guideline Project
An overview of the OWASP DevSecOps Guideline project — what it covers, why we built it, and how to get involved.