DevSecOps Pipeline Hardening

An organization was building and shipping container images without any security scanning. Known CVEs, hardcoded secrets, and misconfigurations were going undetected until production — and sometimes until a post-incident audit. Developers had no visibility into the security posture of their code and no way to catch issues early.

A multi-stage Jenkins pipeline runs security gates at every phase: source, dependency, build, image, and infrastructure-as-code. Each gate produces structured findings that are aggregated and displayed directly in the pull request. A final policy gate blocks deployment if critical issues are unresolved. All images are signed with Cosign and stored in a registry with signature verification at deploy time.

The pipeline was built as a shared Jenkins library so every team inherited the same security stages. SonarQube handles SAST, Trivy handles dependency and container scanning, Checkov scans Terraform, and Gitleaks detects secrets in code. Findings are normalized into SARIF and posted to the PR via a bot. OPA policies define pass/fail thresholds per severity. Developers can run the same scans locally via a pre-commit hook for instant feedback.

The pipeline itself runs in an isolated Jenkins agent with scoped credentials. Secrets are injected via Vault with short-lived tokens. Registry credentials are rotated automatically. Image signatures are verified by a Kyverno admission controller before any pod starts. A bill of materials (SBOM) is generated for each image and stored for supply-chain traceability.

Pipeline scan results are exported to a Grafana dashboard tracking vulnerability trends, mean time to remediate, and policy compliance over time. Critical findings trigger immediate Slack alerts to the owning team. A weekly security report summarizes open findings by severity and team.

Vulnerable images are now blocked before reaching production. Developers receive actionable security feedback in their pull requests within minutes, shifting remediation left. The organization gained a clear view of its security posture and a measurable reduction in critical vulnerabilities shipped to production.