General
Repositories
- awesome-devsecops: Curating the best DevSecOps resources and tooling ๐ (Recommended)
- dynamic-analysis: A curated list of dynamic analysis tools and linters
- static-analysis: A curated list of static analysis (SAST) tools and linters ๐ (Recommended)
- awesome-iam: ๐ค Identity and Access Management knowledge for cloud platforms ๐ (Recommended)
Technique
- Deepfactor - Security Scanning Tools Defined: SAST, IaC, SCA, DAST, IAST/RASP, Container Runtime Security and Runtime SCA ๐ (Recommended)
- Outpost24 - What is best for application security testing: SAST, DAST, or SCA
- Microsoft - Zero Trust DevSecOps
Technology
- OWASP - DevSecOps Guideline ๐ (Recommended)
- Medium - Building end-to-end DevSecOps for AWS Migration: Security at Entry Level with open source SCA, SAST and DAST tools
- Medium - Establishing an Enterprise-Ready DevSecOps CI/CD Pipeline on GitHub Actions on Google Cloud
- AWS - Building an end-to-end Kubernetes-based DevSecOps software factory on AWS ๐ (Recommended)
Stories
DevSecOps Tools
SAST
-
Sonarqube: An on-premise analysis tool designed to detect coding issues ๐ (Recommended)
-
trivy: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more ๐ (Recommended)
-
GitGuardian ggshield: a CLI application that runs in your local environment or in a CI environment to help you detect more than 500+ types of secrets. ๐ (Recommended)