DevSecOps: Security as an Integral Part of the CI/CD Pipeline

Shift Left: Security from the Start

The traditional model — develop first, then test, then security audit — is too slow and too expensive. DevSecOps integrates security checks directly into the development process.

SAST: Static Application Security Testing

SAST tools analyze source code without executing it. They detect SQL injection, XSS, insecure deserialization, and other vulnerabilities directly in the code.

• Tools: Semgrep, SonarQube, PHPStan with security rules.
• Integration: As a pipeline stage after unit tests — blocks the merge on critical findings.
• False Positives: Maintain an exception list for known false positives to avoid alert fatigue.

Dependency Scanning

Over 80% of the code in modern applications comes from dependencies. A vulnerable package can compromise the entire application.

• Composer Audit: composer audit checks PHP dependencies against known CVEs.
• npm Audit: npm audit for JavaScript dependencies — automatable in the pipeline.
• Container Scanning: Trivy or Grype scan Docker images for vulnerable OS packages.

DAST: Dynamic Application Security Testing

DAST tools test the running application from the outside — like an automated penetration tester. Ideal as the last stage before production deployment.

Practical Setup

In our pipelines, SAST runs on every commit, dependency scanning runs daily, and DAST runs on the staging environment before every release. This way, we find vulnerabilities before they reach production.