The Problem

The Problem
Deploy happens at 3 PM.
Breach discovered at 3:17 PM.
Root cause: Vulnerability deployed 17 minutes ago.
Traditional security: "We'll catch it in next month's pentest."

Too late.

The Solution: Security in CI/CD
Shift security left.
Catch vulnerabilities before they reach production.

Here's how.

Step 1: Pre-Commit Hook

#!/bin/bash
# .git/hooks/pre-commit
echo "Running security scan..."
# Run HuntShield quick scan
huntshield scan --staged --fail-on-critical
if [ $? -ne 0 ]; then
    echo "❌ Security issues found. Commit blocked."
    exit 1
fi
echo "✅ Security check passed."

---

Step 2: CI Pipeline

# .github/workflows/security.yml
name: Security Scan
on:
  pull_request:
    branches: [main]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: HuntShield Scan
        run: |
          npx huntshield scan \
            --target ${{ env.DEPLOY_PREVIEW_URL }} \
            --fail-on-high \
            --report security-report.json
      - name: Upload Report
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security-report.json

---

Step 3: Staging Deployment

# Deploy to staging first
- name: Deploy to Staging
  run: ./deploy.sh staging
# Run comprehensive scan
- name: HuntShield Full Scan
  run: |
    huntshield scan \
      --target ${{ env.STAGING_URL }} \
      --comprehensive \
      --wait
# Only deploy to production if clean
- name: Deploy to Production
  if: success()
  run: ./deploy.sh production

---

Step 4: Production Monitoring

# Continuous scanning in production
- name: Schedule Production Scan
  run: |
    huntshield scan \
      --target ${{ env.PRODUCTION_URL }} \
      --continuous \
      --alert-on-critical

---

Results
Before:

• Vulnerabilities found: Post-breach
• Time to discover: 207 days (average)
• Remediation: Emergency hotfixes
• Team: Stressed,