Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a blue-team setup for an app you run. (1) DETECTION: centralize logs and add alerts for suspicious events (repeated auth failures, privilege changes, unexpected egress). (2) INCIDENT RESPONSE: write a runbook following the lifecycle (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) for a concrete scenario (e.g. leaked credentials or ransomware), including tested, offline backups and a recovery path. (3) SHIFT LEFT: add a CI security pipeline — dependency/CVE scanning (SCA), SAST, and secret scanning — that fails the build on high-severity findings. Document how the pieces work together.
Centralized logging with meaningful alerts on real suspicious-activity signals; not just raw log collection.
A concrete PICERL runbook for a real scenario, with tested offline backups and a recovery path — not a generic template.
SCA + SAST + secret scanning wired into CI and failing the build on high-severity findings; results shown.
Can explain how detection, response, and prevention reinforce each other (defense in depth, assume breach).
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A detection, IR runbook & CI security pipeline ## Goal Build a blue-team setup for an app you run. (1) DETECTION: centralize logs and add alerts for suspicious events (repeated auth failures, privilege changes, unexpected egress). (2) INCIDENT RESPONSE: write a runbook following the lifecycle (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) for a concrete scenario (e.g. leaked credentials or ransomware), including tested, offline backups and a recovery path. (3) SHIFT LEFT: add a CI security pipeline — dependency/CVE scanning (SCA), SAST, and secret scanning — that fails the build on high-severity findings. Document how the pieces work together. ## Acceptance criteria - [ ] Detection & monitoring: Centralized logging with meaningful alerts on real suspicious-activity signals; not just raw log collection. - [ ] Incident response: A concrete PICERL runbook for a real scenario, with tested offline backups and a recovery path — not a generic template. - [ ] CI security pipeline: SCA + SAST + secret scanning wired into CI and failing the build on high-severity findings; results shown. - [ ] Coherence: Can explain how detection, response, and prevention reinforce each other (defense in depth, assume breach). ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.