DevSecOps Pipeline Hardening

An organization shipped container images without security scanning, leaving known CVEs and misconfigurations undetected until production.

Implemented a multi-stage security pipeline with SAST, dependency scanning, container image scanning, IaC scanning, and policy-as-code gates.

Source → SAST (SonarQube) → SCA (Trivy) → Build → Container Scan (Trivy) → IaC Scan (Checkov) → OPA Policy Gate → Sign (Cosign) → Registry.

Blocked vulnerable images from reaching production and gave developers actionable security feedback directly in pull requests.

• Multi-stage pipeline: SAST, SCA, container scan, IaC scan, policy gate
• All images signed with Cosign and verified at admission time
• Findings normalized into SARIF and posted to PRs automatically
• SBOM generated per image for supply-chain traceability