DevSecOps and Security Fundamentals
What to know
DevSecOps shifts security left: controls are automated inside the pipeline rather than bolted on before release. Know SAST (static source analysis), DAST (running-app testing), SCA (dependency and license scanning), secret scanning, container image scanning, and IaC scanning. Understand supply chain security (signed artifacts, SBOMs, pinned and verified dependencies), least privilege, secrets management (vaults, rotation, no secrets in Git), and vulnerability management (CVSS severity, exploitability, patch SLAs). Know threat modeling at design time and compliance as code. Recognize the CIA triad and defense in depth.
Traps
A common distractor says scanning should only happen before production-shifting left means earlier and continuous. Another confuses SAST with DAST: SAST reads code without executing it; DAST probes a running application. Severity alone is not priority-exploitability and exposure matter (a critical CVE in an unreachable library may be lower risk than a medium one exposed publicly). Also, storing secrets in environment variables baked into images is not secure; use a secrets manager with runtime injection.
Rule of thumb
Automate the check, fail the build on high-severity findings with a documented exception path, and rotate any secret that touched version control.
Worked example
A dependency scan flags a critical vulnerability. Steps: confirm the library is actually reachable in the artifact, upgrade to a patched version, rebuild and rescan, and if no patch exists, apply compensating controls with a time-boxed exception. Ignoring it because "it's transitive" is the wrong answer-transitive dependencies are still your risk.