Questions tagged [devsecops]
Use this tag for questions about DevOps and Security
27 questions
0 votes
0 answers
17 views
IaC way to allow GitHub actions to create PRs?
In a GitHub repo's settings under actions -> general, there are the options as seen in the image. I have a workflow that needs to be able to create PRs, and now I run it on my own GitHub account, ...
0 votes
1 answer
71 views
How can I decide which security checks should block CI/CD pipelines in a DevSecOps workflow?
I am integrating DevSecOps practices into a CI/CD pipeline and want to apply "shift-left" security testing (e.g., static code analysis, dependency scans, secrets detection, IaC checks). The ...
0 votes
1 answer
116 views
How do I configure trivy on an airgapped network
I'm trying to do some dev/secops intel gathering using trivy, and I can't directly reach the trivy networks or use a proxy, is there a way to copy the databases directly to a machine with trivy ...
0 votes
1 answer
75 views
How is design documentation or modeling done in a DevOps environment?
I try searching for things like documentation, modeling, SysML, or UML in the context of DevOps and I have not gotten much information if at all. I finished reading the Phoenix Project and have the ...
0 votes
2 answers
127 views
security risk with reusing the same UID:GID for users when creating docker containers all deployed to the same cluster
Thanks for taking the time to read my question. I am having trouble understanding the risks with using the same UID and GID for multiple containers deployed in the same kubernetes cluster. Lets say ...
2 votes
2 answers
205 views
Need to understand the career path for DevOps
I am a frontend developer, planning to gain hands on experience in DevOps. However, I'm not sure of if only DevOps or DevSecOps. Recently I tried learning Jenkins while last year took an Udemy course ...
0 votes
1 answer
749 views
Why is detect-secrets-hook ignoring my audit selections?
detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline. I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11. To ...
0 votes
1 answer
46 views
I activated all three API Keys on my Etherscan.io account, was I only suppose activate one (1), not three (3)? [closed]
I am new to web3, cloud, C++, CLI, Meta and Stack. This is all a new world a new platform for me. I have no one on one teacher I started off being a service (gig) worker to Content Creator-to-...
-1 votes
1 answer
331 views
How do I install BlackDuck on mac?
I am trying to scan container images using the blackdock scanning tool. Unfortunately, I couldn't find any free version to play around with; please provide guidance and the simplest way to scan the ...
1 vote
1 answer
409 views
How to avoid disclosing account ID in AWS ARN
I'm new to the AWS ecosystem and have what might be a naive question. While trying to create a GlueRunner Lambda stack with CloudFormation (using pynt), from the Cloud9 shell of an account with all ...
0 votes
1 answer
78 views
Collaboration tools recommendations like Slack
I started my graduation internship two weeks ago. My assignment is to look for a Slack alternative that'll be able to deploy on-premise. A lot of things need to be automated. I already did some ...
2 votes
1 answer
87 views
Continuous deployment strategies vs DevSecOps
How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here? Security requirements may differ, let's assume this simple level of ...
0 votes
0 answers
28 views
Fuzz testing web service in development environment
I would like to fuzz test our web services in our development environment but I do not want to pollute the database with data from the fuzz test. We do not currently have an automated way of creating ...
0 votes
1 answer
68 views
Is there a limitation in AWS to open an IPSec VPN connection?
Consider the following situation (for test purposes): there is a public IPSec VPN endpoint (StrongSwan); a machine with either Ubuntu (Strong Swan client) or Windows OS (native client) running in the ...
1 vote
2 answers
154 views
How securely to keep google cloud service account key?
How securely to keep google cloud service account key? I want to ask about how we should securely keep service account key. The scenario looks like: Our product is connecting to BigQuery. We have ...