Most small companies do not have a security team, and many still ship code every week. DevSecOps means the pipeline checks for the common mistakes automatically, so security does not depend on someone remembering. The good news: the essential tools are free.
1. Stop secrets before they are committed
Leaked API keys are the most common and most expensive mistake. Enable GitHub secret scanning and push protection, and run a scanner such as Gitleaks in the pipeline. If a secret was ever committed, rotate it; deleting the commit is not enough.
2. Watch your dependencies
Turn on Dependabot alerts and updates. Add npm audit, composer audit or pip-audit to the build. Most real-world vulnerabilities come from third-party packages, not from your own code.
3. Scan containers and infrastructure
Trivy scans Docker images, filesystems and IaC files in one command. Run it on every image you build:
- name: Scan image
uses: aquasecurity/trivy-action@master
with:
image-ref: ghcr.io/acme/app:${{ github.sha }}
severity: CRITICAL,HIGH
exit-code: "1"4. Static analysis
Semgrep or CodeQL finds injection, unsafe deserialization and missing validation. Start with the default rule sets and tune them; a noisy scanner gets ignored.
5. Least privilege in CI
- Give every workflow an explicit
permissions:block with read-only defaults. - Deploy with dedicated keys that can only do the deployment, not everything.
- Protect the main branch: required reviews and passing checks before merge.
6. Test the running app
An OWASP ZAP baseline scan against staging catches missing security headers, insecure cookies and obvious misconfigurations without any setup.
Fail on what matters
Block the build only on critical and high findings, and track the rest as tasks. A pipeline that fails on everything is quickly switched off; one that fails on what matters becomes part of the culture.
