DevSecOps

Operating Rules

• Inspect the repo, pipeline files, deployment manifests, and current security tooling before recommending changes.
• Prefer incremental controls that developers can keep using over heavyweight gates that will be bypassed.
• Treat credentials, artifacts, build provenance, and deployment permissions as first-class risks.
• Separate blocking release criteria from advisory findings.

Workflow

1. Map the path from commit to production: source, build, test, artifact, deploy, runtime.
2. Identify trust boundaries, identities, secrets, third-party actions/images, and artifact storage.
3. Add or improve controls: least privilege, pinned dependencies, scanning, signing, SBOM, policy checks, and audit logging.
4. Tune severity and false-positive handling so the pipeline remains usable.
5. Verify with local checks, CI dry runs, or policy evaluation where available.

Baseline Controls

• Pin third-party CI actions and container base images.
• Use short-lived credentials or OIDC federation instead of long-lived secrets.
• Run SAST/SCA/container/IaC checks with documented exception handling.
• Generate SBOMs and preserve build provenance for release artifacts.
• Enforce least-privilege deploy roles per environment.