SAST
BeginnerSAST
Analyse source code, bytecode or binaries for security defects before the application is built or deployed.
- PL
- CO
- BU
- TE
- RE
- DE
- OP
- MO
Application
SemgrepSonarQubeCodeQLCheckmarx
48 practices · 10 labs · 10 pipelines
Secure Every Commit. Automate Every Control.
A practical catalog of DevSecOps practices, tools, patterns, pipelines, security controls, and implementation examples.
- 48
- Practices
- 29
- Security Tools
- 11
- Patterns
- 10
- Hands-On Labs
- 10
- Pipelines
- 30
- Technologies
Lifecycle explorer
All practices Where each control belongs
Select a stage of the delivery lifecycle to see the practices that run there, the controls they enforce and the tools that implement them.
- →
- →
- →
- →
- →
- →
- →
Plan
Threat modeling, requirements and security design decisions.
- Practices in this stage
- 5
- Related patterns
- 11
SemgrepSonarQubeESLintOWASP Threat DragonMiroHashiCorp VaultKeycloakAWS IAMOpen Policy AgentGitHub
Secure Coding
BeginnerApply language-level and framework-level practices that eliminate whole vulnerability classes.
Threat Modeling
IntermediateIdentify what can go wrong in a design before it is built, and record the mitigations chosen.
Identity & Access Management
AdvancedDesign least-privilege access for humans and workloads with short-lived, auditable credentials.
Security Policies
BeginnerWrite policies and standards that are specific enough to be automated and verified.
Risk Management
IntermediateRecord, prioritise and periodically review security risks with named owners and decisions.
Start here
Core practices
DAST
IntermediateDAST
Probe a running application from the outside to find vulnerabilities that only appear at runtime.
- PL
- CO
- BU
- TE
- RE
- DE
- OP
- MO
Application
OWASP ZAPBurp SuiteNuclei
Dependency Scanning
BeginnerSCA
Identify vulnerable, unmaintained or non-compliant third-party dependencies in your builds.
- PL
- CO
- BU
- TE
- RE
- DE
- OP
- MO
ApplicationSupply Chain
TrivyOWASP Dependency-CheckSnykGrype
Secret Detection
BeginnerSecret Detection
Find credentials, API keys and tokens committed to repositories, history, and CI configuration.
- PL
- CO
- BU
- TE
- RE
- DE
- OP
- MO
ApplicationIdentity
GitleaksTruffleHogdetect-secrets
Container Image Scanning
BeginnerContainer Security
Scan container images for vulnerable packages and misconfiguration, and harden how images are built.
- PL
- CO
- BU
- TE
- RE
- DE
- OP
- MO
ContainerSupply Chain
TrivyGrypeClairDocker Scout
Infrastructure as Code Security
IntermediateIaC Security
Analyse Terraform, Kubernetes manifests, Helm charts and CloudFormation for insecure configuration before apply.
- PL
- CO
- BU
- TE
- RE
- DE
- OP
- MO
InfrastructureCloud
CheckovtfsecKICSTerrascan