DevSecOps: Vulnerability Tests
I’m going to take you on an exciting journey of how I built a complete DevSecOps pipeline for a deliberately vulnerable banking application
Services
Security and Automation
Tools
SonarQube, Snyk, GitHub, Trivy, Checkov, OWASP ZAP, AWS
Value
Security and reliability
Timeline
1 week
Here’s what I've built:
A CI/CD pipeline with security superpowers
Static Application Security Testing (SAST) with SonarQube
Software Composition Analysis (SCA) with Snyk
Container scanning with Trivy
Infrastructure as Code scanning with Checkov
Dynamic Application Security Testing (DAST) with OWASP ZAP
Automatic deployment to AWS EC2
An HTML report showing all our security findings
Running the deployed application in from the EC2 terminal
