Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a full DevSecOps pipeline for an app you own, with defense-in-depth across the lifecycle. Requirements: (1) a THREAT MODEL (STRIDE on a data flow diagram) that drives the controls; (2) an automated PIPELINE — secret scan + SAST + SCA + IaC scan + image scan + signing, with risk-based gating; (3) POLICY AS CODE (OPA/Rego or a Checkov custom policy) enforcing an org rule (e.g. no public buckets / must run non-root) as a guardrail that produces an audit trail; (4) SECRETS via a manager with short-lived credentials, and OIDC (not static keys) for cloud deploy; (5) a DETECTION + INCIDENT-RESPONSE plan — runtime monitoring/logging that alerts, plus a runbook and a blameless post-mortem template; (6) map your controls to a compliance framework (e.g. SOC 2 or a CIS benchmark). Document the shift-left + shift-right coverage and one incident you can now detect and respond to. Defensive only — securing systems you own.
A threat-model-driven automated pipeline (secret/SAST/SCA/IaC/image/sign, risk-gated) plus a policy-as-code guardrail with an audit trail.
A secrets manager with short-lived credentials; OIDC (not static keys) for deploy; least-privilege access.
Runtime monitoring/alerting + an incident-response runbook + a blameless post-mortem; controls mapped to a compliance framework.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# An end-to-end secure pipeline with policy & detection ## Goal Build a full DevSecOps pipeline for an app you own, with defense-in-depth across the lifecycle. Requirements: (1) a THREAT MODEL (STRIDE on a data flow diagram) that drives the controls; (2) an automated PIPELINE — secret scan + SAST + SCA + IaC scan + image scan + signing, with risk-based gating; (3) POLICY AS CODE (OPA/Rego or a Checkov custom policy) enforcing an org rule (e.g. no public buckets / must run non-root) as a guardrail that produces an audit trail; (4) SECRETS via a manager with short-lived credentials, and OIDC (not static keys) for cloud deploy; (5) a DETECTION + INCIDENT-RESPONSE plan — runtime monitoring/logging that alerts, plus a runbook and a blameless post-mortem template; (6) map your controls to a compliance framework (e.g. SOC 2 or a CIS benchmark). Document the shift-left + shift-right coverage and one incident you can now detect and respond to. Defensive only — securing systems you own. ## Acceptance criteria - [ ] Pipeline & policy: A threat-model-driven automated pipeline (secret/SAST/SCA/IaC/image/sign, risk-gated) plus a policy-as-code guardrail with an audit trail. - [ ] Secrets & access: A secrets manager with short-lived credentials; OIDC (not static keys) for deploy; least-privilege access. - [ ] Detection & IR: Runtime monitoring/alerting + an incident-response runbook + a blameless post-mortem; controls mapped to a compliance framework. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.