Security in the Pipeline

What you will be able to do

• You will be able to model the CI/CD pipeline as a control plane, identify where it can be attacked, and decide which security control belongs at each stage.
• You will be able to design release gates that break the build on real risk while keeping developer feedback fast and trustworthy.
• You will be able to integrate SAST, DAST, and SCA into a CI/CD pipeline and tune each one to cut false positives without hiding real risk.
• You will be able to generate and use a software bill of materials (SBOM) to track dependency and license risk across builds.
• You will be able to add secrets scanning across pre-commit hooks, CI, and git history, and respond correctly when a real secret is found.
• You will be able to scan container images for vulnerabilities and misconfigurations and enforce policy at the registry and at admission.
• You will be able to scan infrastructure-as-code for insecure configurations before any resource is provisioned.
• You will be able to express security requirements as policy as code and wire it into the pipeline so gates are automated, versioned, and testable.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   The Pipeline as a Security Control Plane

   Before you bolt scanners onto a pipeline, you need a model of what you are defending and where each control belongs. This module treats CI/CD as a control plane with its own threat model, then covers the operating decisions that make security automation succeed or fail. You will learn where gates belong, when it is right to break the build, and how to keep scanner signal trustworthy instead of noisy.

   2 lessons · 5 quiz questions

2. 02

   Testing Your Code and Dependencies

   Most of your risk lives in code you wrote and code you imported. This module covers the three scanner classes that inspect application security in CI: static analysis of your own source (SAST), software composition analysis of your dependencies (SCA), and dynamic analysis of the running application (DAST). You will learn what each one can and cannot see, and how to wire them in so results are trusted and actionable.

   2 lessons · 5 quiz questions · assignment

3. 03

   Securing Secrets and Container Images

   A pipeline can look clean at the source level and still ship a disaster: a hardcoded credential or a vulnerable base image is a failure no matter how tidy the code reads. This module builds two enforcement habits. First, you scan for secrets across the whole developer workflow and the full commit history, and you learn why an exposed secret must be rotated rather than merely deleted. Second, you scan container images from their base layers through the registry to admission, and you enforce a clean supply chain at the exact point of deployment. The goal is to catch these problems early and to make the cluster refuse anything it cannot verify.

   2 lessons · 5 quiz questions

4. 04

   Infrastructure as Code and Policy as Code

   Infrastructure is the last surface the pipeline provisions, and the rules that govern it are the pipeline's final gate. This module teaches you to scan infrastructure as code for insecure configurations before anything deploys, then to codify every security requirement as tested, versioned policy the pipeline enforces on its own across builds and environments.

   2 lessons · 5 quiz questions · assignment