shift-left-security

High-performance open-source security scanner combining SAST, SCA, Secret Detection, and IaC analysis, built for developers and CI/CD pipelines, using AI for recommendation!

Curated catalog of generally useful kpt functions

TrendAI Vision One Container Security Scan Action

Static analysis from configs → Kubernetes NetworkPolicies in seconds

Managing GitHub Advanced Security (GHAS) Controls at Scale

A complete DevSecOps CI/CD automation pipeline for a Node.js application using GitHub Actions, Docker, Trivy security scanning, and Kubernetes (Minikube), implementing shift-left security and cloud-native deployment practices.

Advanced Conftest GitHub Action for Terraform, Kubernetes, Helm & Dockerfile policy scanning with SARIF, GitHub Security, Slack, Teams and Google Chat notifications.

Pipeline DevSecOps experimental para TCC, medindo o impacto de SAST, SCA e DAST no lead time de CI/CD com FastAPI, Docker, Kubernetes, GitHub Actions e SonarQube.

Catch IaC security misconfigurations before production. 100+ rules across Terraform, CloudFormation & Ansible. 9 compliance frameworks.

Pre-cloud web application security assessment including vulnerability analysis, remediation, and cloud security controls.

Enterprise-style DevSecOps CI/CD pipeline demo using GitHub Actions, Semgrep, CodeQL, TruffleHog, pip-audit, and pre-commit.

Enterprise DevSecOps pipeline: GitHub Actions, Terraform, container security scanning, SAST/DAST, policy-as-code, and automated compliance validation

Servidor LSP para análise estática e conformidade contínua com a LGPD em pipelines DevSecOps (Compliance as Code).

A Java DevSecOps CI/CD pipeline integrating SonarCloud, Snyk and Trivy to evaluate shift-left security, vulnerability detection and delivery trade-offs.

DevSecOps Playground: a working comparison of an insecure and secure CI/CD pipeline running the same app. The insecure pipeline ships a SQL injection and hardcoded secret straight to production; the secure pipeline catches both with Semgrep, Trivy, CodeQL, and Cosign before deploy.

End-to-end DevSecOps CI/CD pipeline integrating SAST, SCA, Secrets Scanning, Container Security, and DAST with automated security gates and deployment blocking using GitHub Actions.

Git hooks for improving developer experience and security

Python CI/CD security pipeline using Pytest, Semgrep, pip-audit, GitHub Actions, artifacts, composite actions, and custom security gates.

A production-style DevSecOps CI/CD pipeline demonstrating shift-left security with open-source tools. It performs SAST, secrets detection, dependency and container scanning, SBOM generation, and image signing before deploying to Kubernetes. The pipeline can run locally or via GitHub Actions and generates security reports for validation.

Shift-Left IaC Subdomain Takeover Prevention Gate & Post-Apply Sentinel for Terraform