Security and DevSecOps
DevSecOps builds security checks into the same automated pipeline as tests, so problems are caught before they ship.
On this page · 5 min · Advanced
On this page
- Learning objectives
- Explanation
- Code example
- Step by step
- Real-world use
- Common mistakes
- Best practices
- Remember this
- Practice exercise
- Mini quiz
- Related topics
- My notes
- Reading time
- 5 min
- Difficulty
- Advanced
- Updated
- Oct 29, 2026
Related tutorials
Interview questions
Learning objectives#
- Add security scans to CI
- Scan dependencies and container images
- Apply least privilege to pipelines
- Understand SBOMs and supply chain risks
Explanation#
Dependency scanning (Dependabot, npm audit, dotnet list package --vulnerable) finds libraries with known vulnerabilities.
SAST (CodeQL) analyses source code for flaws like SQL injection. Secret scanning blocks leaked keys.
Container scanning (Trivy, Defender, ECR scanning) checks images for vulnerable OS packages.
Pipelines run with minimal permissions, pinned actions and signed artifacts; an SBOM lists everything inside a release.
Code example: Security checks in CI#
name: security
on: [pull_request]
permissions: { contents: read, security-events: write }
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with: { languages: csharp }
- uses: github/codeql-action/autobuild@v3
- uses: github/codeql-action/analyze@v3
- run: dotnet list package --vulnerable --include-transitive
- run: docker build -t shop-api:pr .
- uses: aquasecurity/trivy-action@0.28.0
with: { image-ref: 'shop-api:pr', severity: 'CRITICAL,HIGH', exit-code: '1' }
The PR fails if CodeQL finds a security issue, a dependency is vulnerable, or the image has critical/high CVEs.
This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.
Step-by-step explanation#
- Permissions are limited to what the job needs.
- CodeQL scans the C# source for vulnerabilities.
- dotnet list package reports vulnerable NuGet packages.
- Trivy fails the build on serious image vulnerabilities.
Real-world use case#
A vulnerable JSON library is flagged in a PR and updated before it ever reaches production.
Common mistakes#
Set clear thresholds that fail builds and assign owners.
A compromised action could steal secrets. Pin versions and restrict permissions.
Best practices#
- Dependabot + CodeQL + secret scanning
- Scan images before pushing
- Least-privilege pipeline permissions
- Generate SBOMs for releases
Remember this#
Security checks are pipeline steps.
Scan code, dependencies, secrets and images.
Least privilege for pipelines too.
Practice exercise#
Your task: Which command lists vulnerable npm dependencies?
Show solution
npm audit --audit-level=high
Mini quiz#
What does SAST analyse?
Want more? Practise all DevOps MCQs · DevOps interview questions
My notes#
Saved in this browser.