Shift-Left Security in Practice with Gitlab
summary
Shows a concrete CI/CD pipeline built on GitLab CI/CD that runs SAST, Semgrep, secret detection, dependency scanning and Trivy container scans (plus optional OWASP ZAP for runtime testing) against a Node.js demo app. Demonstrates how open-source scanners plug into GitLab’s reports, how the pipeline keeps feedback fast, and that fixing a bug in development costs ~$1 versus ~$100 in production. Includes the actual .gitlab-ci.yml and Dockerfile used, plus notes on where scans run and how results appear in merge request reports.
AI-written summary · about
chapters (8)
- 0:00Shift-left security with GitLab
- 1:46Fix-it-later security model
- 3:12Costs of late breaches
- 6:22What shift-left means
- 7:48Practical shift-left pipeline
- 9:11Demo of security scanners
- 12:02Key takeaways
- 14:32Q&A on scanning
related talks
11mRealizing DevSecOps with GitLab and Infrastructure as Code
43mSponsored Session: Application Security is a Community Effort
23mTrue DevSecOps with People, Processes, and Technologies
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
49m"The SAST and the furious"
19mApplication Security at High Velocity
46mGitLab CI/CD under attack