DevSecOps pipelines

— Secrets scan
— Code scan
— Dependency check (code libraries + image packages)
— DAST
— Exposures check

Pipelines:
https://gitlab.com/whitespots-public/pipelines

Security scanners:
https://gitlab.com/whitespots-public/security-images

Example project integration:
https://gitlab.com/whitespots-public/vulnerable-python-app

#appsec #devsecops #pipelines

🎁 Application Security Pipelines
(Now with guides)

Scan your code, infrastructure configs and domains with many open source scanners.

Currently supported: trufflehog, gitleaks, bandit, gosec, spotbugs, terrascan, hadolint, retirejs, eslint, phpcs, sonarqube integration, semgrep, arachni, zap, subfinder, nuclei..

All reports will be passed to defectdojo

Guides:
https://github.com/Whitespots-OU/DevSecOps-Pipelines

Integration examples:
https://gitlab.com/whitespots-public/vulnerable-apps

#appsec #devsecops #pipelines