B6: Detection, DevSecOps & Secure Code Review
DevSecOps Deep: CI/CD, SAST, DAST, SCA & Secrets
Assess pipelines, build systems, dependencies, artifacts, secrets, and deployment controls.
- CI/CD identity: runner permissions, deploy keys, cloud roles, and environment protections.
- Secrets: repository secrets, logs, artifacts, env vars, pull request exposure, and rotation paths.
- SAST: source patterns for injection, auth bypass, crypto misuse, deserialization, and unsafe file handling.
- DAST: runtime validation of web/API behavior in controlled environments.
- SCA: vulnerable dependencies, license risk, typosquatting, lockfile hygiene, and transitive exposure.
- Artifacts: signing, provenance, SBOMs, registry permissions, and promotion gates.