OWASP / OWASP/DevSecOpsGuideline
Add open source solution
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.1k
- Forks
- 262
- PR merge metrics
- No merged PRs in 30d
Description
Gitlab security pipelines
Can be found: https://gitlab.com/whitespots-public/pipelines
With Security stage integrated into your team's pipelines, on, let's say, every release, Security stage is run and trigger Security pipelines to do the job. Security stage itself doesn't affect your time-to-market.
Security pipelines combine different types of security scanners in one "Security" stage.
Scans reports are sent to DefectDojo, where triage begins.
Pipelines integration instructions: https://www.youtube.com/watch?v=DLN1kNh_Ha0
SSDLC based approach is described here: https://www.youtube.com/watch?v=6FGV4OcrIB8
How to work with DefectDojo tutorial: https://www.youtube.com/watch?v=_uFOIf1BUwU
We are contributing to this project for about 2 years and are ready to share. Hope it worth being added here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the linked GitLab security pipelines and the DefectDojo and SSDLC tutorial links, then compare them with the OWASP DevSecOpsGuideline. Clarify where this contribution belongs and what material should be added; it is done when the proposed solution has a defined, accepted place in the guideline.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab
- Domain
- devops, documentation, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100