DevSecOps › Module 1 › Lesson 3
No Stranger Pipelines
No stranger pipelines means refuse scanning stranger orgs, tampering with CI/CD you do not own, and unauthorized secrets harvesting — write the refusal habit into YOUR $DEVSEC_LAB ethics card.
Visual · t36_no_stranger_pipelines
Stranger-pipeline refusal. $DEVSEC_LAB only. Original Cyberlium.
Opening
Stranger GitHub orgs, third-party production URLs, and unauthorized workflow tampering — all stop outside YOUR repo scope. Literacy names the risk; scanners stay on code you own.
Unauthorized DevSec actions include running SAST against stranger org repos without legal authorization, pointing ZAP at third-party production sites, exfiltrating secrets from pipelines you do not operate, and modifying stranger workflow files without contract. Org scope follows ownership: employer pipelines require written authorization — stranger orgs stay off limits. Cyberlium practices refusal sentences on YOUR $DEVSEC_LAB — 'I practice DevSecOps on MY repos and name risks for pipeline context' — never copy workflows that aim scanners at orgs you do not operate. Next: Lab Setup.
1. Stranger pipeline patterns refused (named, literacy only)
Stranger-org scanning: pointing SAST or secrets tools at GitHub orgs you do not own — named for literacy, NOT executed on Cyberlium. Third-party URL DAST: running ZAP against production sites without contract — defender fix is lab URL exercises, not student replication.
On $DEVSEC_LAB, write three refusal triggers — e.g., stranger-org scan request, third-party production URL DAST, unauthorized workflow tampering.
Command guide
Try these commands — Stranger pipeline patterns refused (named, literacy only)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: Gitleaks (https://gitleaks.io/); OWASP ZAP (https://www.zaproxy.org/); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why refusal protects you and others
Unauthorized scanning violates laws, platform terms, and employer policy — skill without scope is career and legal risk. Victim harm: scanning stranger repos or tampering with pipelines hurts real people and services you must not enable.
Defenders exercise through authorized change control, repo ownership, and org-owned lab pipelines — students practice naming these channels for DevSec notes on lab scenarios only.
3. Ethics card habit
Forbidden: sharing stranger-org scan tutorials in class chat, importing live credential dumps, tampering with unauthorized workflow files. Allowed: ethics card — allowed repo sources, NEVER list, refusal sentence you will say aloud.
Ship: DevSec ethics card with NEVER list and one refusal sentence. Next: Lab Setup.
4. What you ship: DevSec ethics card for $DEVSEC_LAB
Allowed repo sources, NEVER list, refusal sentence. $DEVSEC_LAB named. NO stranger pipelines. chmod 600.
5. What you record before the next lesson
Date. Ethics card. $DEVSEC_LAB named. File t36-m01-l03-no-stranger-pipelines.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Follow stranger-org scan tutorial 'for DevSec practice.' Share live credential dump in Discord.
Right
Write DevSec ethics card for YOUR $DEVSEC_LAB. Next: Lab Setup.
Mission: write YOUR stranger-pipeline refusal habit
1) List three NEVER targets (stranger-org scans, third-party URL DAST, unauthorized workflow tampering). 2) Write one refusal sentence for unauthorized scan requests. 3) Name allowed $DEVSEC_LAB repo sources. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Name risks for pipeline context — never replicate scans against orgs you do not own.
Knowledge Check
APPLY: No stranger pipelines on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Scanners are taught on YOUR repos only — not stranger orgs.
True or False
Knowledge Check
APPLY: Discord link to stranger-org scan guide — you:
Multiple choice