I85PREP
⌘ K
ECDE study materials
ECDE study resources

ECDE: DevSecOps Pipeline – Code Stage

ECDE · Work through your exam, one topic at a time.

All guide sections

DevSecOps Pipeline – Code Stage

The Code stage covers what happens between a developer's editor and the shared repository. This domain tests secure coding practice, peer review, secret prevention, source control hardening and the first automated checks.

Core rules

  • Secure coding standards are explicit and referenced by review checklists - OWASP Top 10, CWE/SANS Top 25, CERT coding standards for the language in use.
  • Peer review is the highest-yield manual control; small pull requests with a security-aware reviewer catch design flaws scanners cannot see. CODEOWNERS enforces the right reviewer for sensitive paths.
  • Pre-commit hooks run fast checks locally: secret scanning, linting, formatting, forbidden API detection. They fail early without consuming CI minutes.
  • Secret scanning must cover both the diff and full history; a key committed and deleted is still compromised and must be rotated.
  • Branch protection blocks direct pushes to main, requires review, requires passing status checks, and restricts who can force-push or bypass.
  • Least privilege on the SCM: scoped tokens, SSO, MFA, audit log streaming, no shared service accounts with admin rights.
  • Dependency hygiene starts here: pinned versions, lockfiles committed, and a dependency manifest that later feeds the SBOM.

Worked example

A developer commits aws_access_key_id and secret into a config file and pushes. Without a hook, the key lands in the remote and remains in history even after the next commit removes it. With a pre-commit secret scanner plus server-side push protection, the commit is blocked before it leaves the workstation. If it had already reached the remote, the correct sequence is: revoke/rotate the credential first, then purge history, then add the scanner, then check CloudTrail for use. Rotation first is the mark-earning step - removing the string from git does not un-leak it.

Traps that cost marks

  • Believing secret scanning replaces secret management; the fix is a vault or OIDC-based short-lived credentials.
  • Relying on local hooks alone - developers can skip them, so server-side enforcement is required.
  • Accepting 'we deleted the key in the next commit' as remediation.
  • Allowing branch protection exceptions that quietly become the normal path.
  • Reviewing 2,000-line pull requests and calling it peer review.
  • Ignoring transitive dependencies because the direct dependency looks fine.