Results for “devsecops”

Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.

• Add automated security scans to .gitlab-ci.yml
• Check dependencies and container images for known vulnerabilities
• Detect credentials and API keys committed to source control

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.

The English summary is being prepared. Showing the original description.

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.

The English summary is being prepared. Showing the original description.

Expert en DevSecOps avancé (SAST, DAST, SCA, container scanning, policy-as-code, GitGuardian, supply chain security, SBOM)

The English summary is being prepared. Showing the original description.

DevSecOps IA — Expert en intégration sécurité dans les pipelines CI/CD (SAST, DAST, SCA, container scanning, compliance automation)

The English summary is being prepared. Showing the original description.

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret Tespit.

The English summary is being prepared. Showing the original description.

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.

The English summary is being prepared. Showing the original description.

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.

The English summary is being prepared. Showing the original description.

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.

The English summary is being prepared. Showing the original description.

Guide reviews of Linux Kernel patches for memory safety, Terraform plans for costly resource changes, and Kubernetes configurations for restricted permissions. A separately installed tool and configured AI model produce advisory findings and candidate manifests for validation.

• Review Linux Kernel patches for memory safety issues
• Check Terraform plans for potentially costly resource changes
• Draft Kubernetes permission settings from security requirements

Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.

• Adding automated security scans to CI/CD
• Creating security rules for project-specific code patterns
• Reducing false alarms and scan time

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.

• Combining findings from multiple security scanners
• Importing scan results automatically from CI/CD pipelines
• Connecting vulnerability findings to Jira tickets

/aegisops-ai — Autonomous Governance Orchestrator workflow skill. Use this skill when the user needs Autonomous DevSecOps & FinOps Guardrails. Orchestrates Gemini 3 Flash to audit Linux Kernel patches, Terraform cost drifts, and K8s compliance and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

The English summary is being prepared. Showing the original description.

/aegisops-ai — Autonomous Governance Orchestrator workflow skill. Use this skill when the user needs Autonomous DevSecOps & FinOps Guardrails. Orchestrates Gemini 3 Flash to audit Linux Kernel patches, Terraform cost drifts, and K8s compliance and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

The English summary is being prepared. Showing the original description.

DevOps 与站点可靠性工程 (SRE) — 平台 / 基础设施 / 可靠性工程师的认知操作系统, 覆盖软件交付 + 运维全生命周期 (CI/CD 与发布工程 trunk-based + 渐进式发布 canary/blue-green/feature flag + GitOps Argo CD/Flux / 基础设施即代码 Terraform/OpenTofu/Pulumi/Ansible + policy-as-code OPA / 容器与编排 Docker/Kubernetes + Helm/Kustomize + service mesh Istio/Linkerd / 可观测性 Prometheus + Loki + OpenTelemetry + Honeycomb + eBPF + RED/USE / SLO-SLI-error budget 与可靠性工程 Google SRE 学科 + 容量规划 + 优雅降级 / 事件管理与 on-call 事件指挥 + PagerDuty + runbook + 无指责复盘 + MTTR / 云平台与 FinOps AWS/GCP/Azure + 成本优化 + 弹性伸缩 / 平台工程与开发者体验 IDP + Backstage + golden path + Team Topologies / DevSecOps 与供应链安全 shift-left + SBOM + SLSA + sigstore + Vault / 韧性与混沌工程 fault injection + game day + 安全科学 / DORA 指标与工程效能 部署频率 + 变更前置时间 + 变更失败率 + Accelerate 研究 / 数据库与有状态运维 schema 迁移 + 备份容灾) — 不含 通用应用开发 / 纯云销售认证速成 / 'DevOps = 跑 Jenkins 的岗位' 窄化误解 / ITIL 工单文化传统运维 (旧范式仅做边界) / 把手工运维 ClickOps 当稳态 (是 toil, 本 skill 核心反模式) (DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, Helm / Kustomize, service mesh Istio / Linkerd), (d) observability (the three pillars + beyond — metrics Prometheus / VictoriaMetrics, logs Loki / ELK, traces OpenTelemetry / Jaeger / Tempo, high-cardinality observability Honeycomb, eBPF, RED / USE methods, SLO-based alerting), (e) SLO / SLI / error budgets & reliability engineering (Google SRE discipline — service level objectives, error budget policy, toil budgets, capacity planning, load shedding, graceful degradation), (f) incident management & on-call (incident command, PagerDuty / Opsgenie, runbooks, blameless postmortems, MTTR / MTTD, error budget burn), (g) cloud platforms & FinOps (AWS / GCP / Azure well-architected, multi-region, cost optimization, autoscaling), (h) platform engineering & developer experience (internal developer platforms, Backstage, golden paths, self-service, Team Topologies), (i) DevSecOps & supply-chain security (shift-left, SAST / DAST, SBOM, SLSA, sigstore / cosign, secrets management Vault), (j) resilience & chaos engineering (chaos experiments, fault injection, game days, resilience engineering / safety science), (k) DORA metrics & engineering effectiveness (deployment frequency, lead time, change failure rate, MTTR, the Accelerate research), (l) databases & stateful operations (schema migrations, backups / DR, replication); NOT generic software development / app feature coding (是 平行学科, DevOps/SRE 关注 delivery + operability 不是 product feature), NOT pure cloud sales / certification cram without operational depth, NOT 'DevOps = a job title that runs Jenkins' 的窄化误解 (DevOps 是 文化 + 实践, SRE 是 Google 对 reliability 的工程化具体实现), NOT ITIL-heavy 传统运维 工单文化 (是 被 DevOps 取代的旧范式, 仅做边界标注), NOT manual ops / ClickOps as a steady state (是 toil, 本 skill 的核心反模式).) Master OS — automated mastery of DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, He

The English summary is being prepared. Showing the original description.

DevSecOps skill for securing CI/CD pipelines, infrastructure as code, containers, Kubernetes, cloud deployments, secrets handling, dependency management, SAST/DAST/SCA, release gates, supply-chain controls, SBOMs, policy-as-code, and secure SDLC workflows. Use for pipeline hardening, deployment risk reviews, security automation, and remediation planning.

The English summary is being prepared. Showing the original description.

アプリケーションコードでの自動脆弱性検出のための静的アプリケーションセキュリティテスト（SAST）ツールを設定します。セキュリティスキャンの設定、DevSecOps実践の実装、またはコード脆弱性検出の自動化時に使用してください。

The English summary is being prepared. Showing the original description.

Plan reviews of AI-generated code before running or merging it. Define language-specific checks, tests in isolated environments, and evidence requirements, while recording coverage limits and gaps that prevent approval.

• Planning reviews of AI-generated code before merging
• Defining language-specific security checks
• Recording test evidence and unresolved gaps

Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.

• Auditing Git history for exposed AWS keys
• Adding credential checks before commits and in CI/CD
• Investigating credential exposure after a GuardDuty alert

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.

• Reviewing code for security vulnerabilities
• Checking dependencies and exposed credentials
• Auditing cloud and infrastructure security

DevOps 能力索引。Git、测试、DevSecOps、数据库。当用户提到 DevOps、CI/CD、Git、测试时路由到此。

The English summary is being prepared. Showing the original description.

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

The English summary is being prepared. Showing the original description.