What DevSecOps and "shift left" are: and why moving security into the pipeline (vs a final gate) matters at high release cadence

# GitHub Actions pipeline with security stages at every step
name: bank-transfer-service-ci
on: [push, pull_request]
jobs:
  security-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Secret scanning -- catches hardcoded credentials
      - name: Scan for secrets
        uses: trufflesecurity/trufflehog@v3
        with:
          path: ./

      # SAST -- static analysis of source code
      - name: Static analysis
        run: semgrep scan --config=auto --error

      # SCA -- dependency vulnerability scanning
      - name: Dependency scan
        run: mvn org.owasp:dependency-check-maven:check

      # Container image scanning
      - name: Image scan
        run: trivy image bank/transfer-service:${{ github.sha }}

# Pre-commit hook -- catches secrets before they enter the repo
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

package com.bank.service;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

public class AccountService {

    // WRONG: SQL injection -- SAST catches this at build time
    public ResultSet findAccountBad(Connection conn, String accountId) throws Exception {
        String sql = "SELECT * FROM accounts WHERE id = '" + accountId + "'";
        return conn.createStatement().executeQuery(sql);
    }

    // CORRECT: parameterized query -- safe from injection
    public ResultSet findAccountGood(Connection conn, String accountId) throws Exception {
        String sql = "SELECT * FROM accounts WHERE id = ?";
        PreparedStatement ps = conn.prepareStatement(sql);
        ps.setString(1, accountId);
        return ps.executeQuery();
    }
}

 Release cadence vs. security gate:

 Quarterly releases + manual audit     = workable (audit has weeks)
 Daily releases + manual audit          = bottleneck (audit has hours)
 Multiple daily releases + manual audit = impossible (gate is skipped)

 Solution: automate security INTO the pipeline
 Every commit triggers: secret scan + SAST + SCA + container scan
 Build fails fast on critical findings
 Security team curates rules, not reviews every change

package com.bank.config;

public class DatabaseConfig {

    // WRONG: hardcoded credential -- caught by secret scanner in seconds
    // If this reaches production and leaks, remediation + fines + reputation damage
    private static final String DB_PASSWORD = "NBI_prod_2024!";

    // CORRECT: read from environment variable or secrets manager
    private static final String DB_PASSWORD = System.getenv("DB_PASSWORD");
}

# Complete DevSecOps pipeline stages
name: bank-devsecops-pipeline
on:
  push:
    branches: [main]
  pull_request:

jobs:
  secrets:
    name: Secret Scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: gitleaks detect --source . --verbose

  sast:
    name: Static Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: semgrep scan --config=p/java --error

  sca:
    name: Dependency Scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: mvn org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=9

  build-and-test:
    name: Build and Test
    needs: [secrets, sast, sca]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: mvn clean verify

  image-scan:
    name: Container Image Scan
    needs: [build-and-test]
    runs-on: ubuntu-latest
    steps:
      - run: trivy image --exit-code 1 --severity CRITICAL bank/transfer-service

  deploy:
    name: Deploy
    needs: [image-scan]
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploy only if all security gates passed"

# WRONG: blocking on EVERY finding including low-severity and non-reachable
- run: mvn dependency-check:check -DfailBuildOnCVSS=1
# Result: every build fails, developers bypass the gate entirely

# CORRECT: block on critical/high reachable, track the rest
- run: mvn dependency-check:check -DfailBuildOnCVSS=9
# Critical findings block. Medium/Low become tracked tickets with SLAs.

# WRONG: security team as a bottleneck gatekeeper
"All PRs must be reviewed by the security team before merge."
# Result: 3-day queue, developers route around it

# CORRECT: security team as enablers
Security team defines policies and tunes rules in the pipeline.
Automated scans give instant feedback to the developer.
Security team handles the genuinely hard cases and policy exceptions.