DevSecOps Pipeline for Dummies: Stages, Tools & the SSDLC

What is DevSecOps?
DevSecOps builds security checks into every step of the software pipeline, so flaws are caught while code is being written rather than after it ships. This is called shifting left: the earlier a bug is found, the cheaper it is to fix. The pipeline automates this as part of the Secure Software Development Lifecycle (SSDLC), so every commit gets the same checks without anyone remembering to run them.
The flow, left to right: Code → Commit → Build → Test → Package → Sign → Deploy → Run → Respond. Each stage below shows what it does, why it matters, and common tools.

Stages 1–4: Secure the code

1. Source control. The single home for code, history and review. Branch protection, mandatory pull-request reviews, signed commits and least-privilege access make it the first gate: nothing enters the pipeline unreviewed. Tools: GitHub Enterprise, GitLab, Bitbucket.
2. Secret scanning. Finds passwords, API keys and tokens accidentally committed to code. A leaked key is the easiest way into a company, so this runs on every commit and blocks the push. Tools: git-secrets (pre-commit), TruffleHog, Gitleaks, GitHub Secret Scanning.
3. CI orchestration. The automation engine that runs every check on each commit and decides pass or fail. It enforces that security gates cannot be skipped, and should use short-lived credentials (OIDC), not stored secrets. Tools: GitHub Actions (Enterprise), GitLab CI, Jenkins, Azure DevOps.
4. SAST and IaC scanning. Static Application Security Testing reads source code for flaws like SQL injection without running it. IaC scanning checks Terraform, Kubernetes YAML and Dockerfiles for misconfigurations (open storage buckets, root containers) before they are deployed. Tools: Veracode, Snyk Code and Snyk IaC, SonarQube, Semgrep, Checkmarx, Checkov, tfsec.

Stages 5–7: Secure what you build

1. SCA (Software Composition Analysis). Modern apps are mostly open-source libraries. SCA lists them, flags known vulnerabilities (CVEs) and risky licences, and suggests fixes. It also produces an SBOM, the "ingredients list" of your software. Tools: Mend, Snyk Open Source, Dependabot, OWASP Dependency-Check, Black Duck.
2. Container scanning. Checks images for vulnerable OS packages and bad settings at build time (Trivy), watches containers for suspicious behaviour while they run (Falco), and covers cloud-hosted registries and clusters (Microsoft Defender for Containers). Tools: Trivy, Grype, Falco, Defender for Containers, Anchore, Aqua, Prisma Cloud.
3. Signing and provenance. Proves an artifact is genuine and untampered. Cosign signs images; SLSA ("salsa") is a framework with levels that record who built what, from which source, on which system. Clusters then refuse to run anything unsigned, which stops supply-chain attacks. Tools: Cosign and Sigstore, SLSA GitHub generator, in-toto, Notation, Kyverno or Gatekeeper for verification.

Stages 8–10: Deploy, run and respond

1. GitOps CD. Git is the source of truth for what runs in production. A tool such as Argo CD continuously compares the cluster to the repo and corrects any drift, so every change is reviewed, auditable and reversible. Tools: Argo CD, Flux, Spinnaker, Harness.
2. Runtime (Kubernetes and orchestration). Where containers actually live. Security here means RBAC, network policies, pod security standards, admission control, secrets management and runtime threat detection. Tools: Kubernetes (AKS, EKS, GKE), OPA Gatekeeper, Kyverno, HashiCorp Vault, Falco, Cilium, Wiz.
3. Incident response. No pipeline catches everything. Logs and alerts flow into a SIEM, on-call engineers are paged, and incidents are tracked and reviewed so lessons feed back into earlier stages. Tools: incident.io, PagerDuty, Splunk, Microsoft Sentinel, Elastic Security, Datadog.

Extra stages worth adding:
DAST (dynamic testing): attacks the running test app like a hacker would. OWASP ZAP, Burp Suite, StackHawk.
Policy as code: automated rules for what may deploy. Open Policy Agent, Conftest, Kyverno.
Secrets management: keeps credentials out of code. HashiCorp Vault, AWS Secrets Manager, Azure Key Vault.
SBOM and dependency tracking: Syft, CycloneDX, Dependency-Track.
Cloud posture (CSPM): Wiz, Prisma Cloud, Microsoft Defender for Cloud.
Getting started checklist
Start small and tighten over time: report-only first, then block builds on critical findings.
☐ Protect main branches and require reviews
☐ Turn on secret scanning and a pre-commit hook
☐ Add SAST, SCA and IaC scans to every pull request
☐ Scan and sign container images; enforce signature checks in the cluster
☐ Deploy only through GitOps, with no manual kubectl changes
☐ Send runtime alerts to a SIEM and rehearse incident response