Pipeline Sketch

Draw secure SDLC pipeline — SAST, gitleaks, deps, DAST on YOUR $REPO CI.

15 min+39 XP3 quiz

Module progress3 of 5

Visual · t17_pipeline_sketch

Pipeline sketch = shift-left controls on code you ship. Original Cyberlium.

Opening

One diagram beats ten slides if it shows where security actually runs in YOUR workflow.

Sketch CI/CD pipeline for $REPO: commit → lint/unit → SAST → gitleaks → dependency audit → build → deploy to $LAB_URL → optional DAST baseline against lab deploy. Mark manual gates: code review, triage, rotation on leak. Note what runs on PR vs main vs nightly. Paper or Mermaid in private notes — no copying employer pipeline internals without permission. Gap paragraph: what fails open if you skip gitleaks or deps.

1. Stages

PR: fast SAST + gitleaks + tests. Main: build + deploy lab. Nightly: DAST baseline + deep audit.

Block merge on critical SAST/leak per policy from Module 7.

Command guide

Try these commands — Stages

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: grep, curl. Reference sites: DevSecOps (https://owasp.org/www-project-developer-guide/); NIST SSDF (https://csrc.nist.gov/publications/detail/sp/800-218/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Human gates

Review for auth/session changes; triage new SAST rules; rotation drill quarterly.

OAuth app registrations listed with revoke on teardown.

3. Gap honesty

Mark N/A stages honestly — gap plan on YOUR bench, not stranger targets.

No filler with unauthorized scans.

4. What you ship: pipeline sketch

Diagram with SAST/gitleaks/deps/DAST stages + gap paragraph.

5. What you record before the next lesson

Pipeline sketch path.

6. Wrong vs right: stranger apps vs YOUR repo

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Sketch includes 'DAST prod stranger nightly.'
Right
Pipeline sketch done. Next: capstone lab.

Mission: pipeline sketch

1) Draw stages from commit to lab deploy. 2) Mark PR vs nightly jobs. 3) One paragraph gaps if steps skipped.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “DAST pre-prod vs lab URL?”

Knowledge Check

APPLY: Pipeline sketch shows:

Multiple choice

Knowledge Check

APPLY: True or False: Stranger prod DAST in sketch is OK.

True or False

Knowledge Check

APPLY: Gap paragraph names:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP