DevSecOps Pipeline Hardening

An organization shipped container images without security scanning, leaving known CVEs and misconfigurations undetected until production.

Implemented a multi-stage security pipeline with SAST, dependency scanning, container image scanning, IaC scanning, and policy-as-code gates.

Source → SAST (SonarQube) → SCA (Trivy) → Build → Container Scan (Trivy) → IaC Scan (Checkov) → OPA Policy Gate → Sign (Cosign) → Registry.

Blocked vulnerable images from reaching production and gave developers actionable security feedback directly in pull requests.