DevSecOps
This repository is an information library that includes open-source tools and methodologies for cloud-based cybersecurity and DevSecOps processes. Software development offers tools that provide security automation and control at different stages of the life cycle by categorizing them.
sottlmarek · DevOps / Build / Infra
Common commercial products in this category: GitHub Actions, CircleCI, Atlassian Bamboo
- You can explore open-source tools suitable for cloud infrastructure and container security.
- You can review SAST and DAST solutions that can be integrated into software development processes.
- You can learn about methodologies used in infrastructure and code security processes.
- • No published release
- ↑ PositiveHacker News
When DevSecOps goes wrong: a short lesson from Huawei's source code
“it's even worse than that. semgrep wouldn't even discover the earlier mentioned problems in Huawei code, which purpose explicitly was to evade static analysis tools. They could pack all their calls to strlcpy (wrapping strcpy & friends) into a separate lib that is outside the…”
- • NeutralHacker News
When DevSecOps goes wrong: a short lesson from Huawei's source code
“So, I really dislike the word, and I would love it if the industry would ditch it because it sounds so dumb... but also, I 100% support the DevSecOps manifesto[0]. Security being extremely manual, extremely 'tool' driven, being policy based, being dictatorial, is awful and not…”