DevSecOps (Development, Security, and Operations)

Practice of adding Automated Security checks into every single stage(Code Writing> Build > SecurityAudit > Deploy) of the software development lifecycle, rather than waiting until the software is completely built, tested and then Security Audit Team finds leaked secrets
What would be checked:
- API Keys, secrets, Credit Cards, Bank Details, Internal Documents Shift-Left Philosophy
  Old Approach(Traditional): Code Writing > Testing > Security Auditing(Find security issues) > Code(Now it becomes difficult to add patches for security)
  New Approach(DevSecOps): Moving security audits from the final phase of delivery to the beginning of the development cycle. Security is enforced at every stage.

Scanning Secret at different Stages

1. Coding Stage (Writing code in vscode)

1. VS Code Extensions
  a. GitGurdian: key pattern(AWS keys, OpenAI API tokens, database URIs) scanner
  b. TruffleHog: Regex scanner for hardcoded secrets

2 .gitignore: Add files which need not to be committed to git

git pre commit hooks: On git commit check the secrets

2. In transit / git push

When developer does git push, code travels on wire
SSE/SASE solutions will check TSS/DLP/PCI (Payment Card Industry) content
Block the content

3. Build Stage(GitHub Actions, GitLab CI, Azure Pipelines, or Jenkins)

Server-Side Git Hooks (github, gitlab):
  Server side credentials checks

Automated Secret Detection Jobs:
  gitleaks detect --verbose to evaluate modified files

Static Application Security Testing (SAST)
  Tools like(SonarQube, Semgrep, CodeQL) inspect source ASTs (Abstract Syntax Trees)
  Finds issues like password = "abc", api_key = "123", insecure hardcoded connection strings, or unencrypted local configuration files.

Dependency & Supply Chain Security (SCA):
  During build steps (e.g., npm install or pip install), Software Composition Analysis (SCA) tools evaluate third-party dependencies

Build Output & Artifact Sanitization
  Build systems enforce guardrails to prevent secrets from leaking in compiler outputs or logs. Replace secret values with ***

Container Image Scanning
  Scanners like Trivy, Grype, or Docker Scout inspect produced container images that developers didn't accidentally copy private SSH keys, .env files, or .pem certificates into the final runtime image

4. Artifact Repository (JFrog Artifactory, AWS ECR, Docker hub)

At this stage, we are protecting binaries, container images, .jar/.tar archives, and dependency packages