DevSecOps Pipeline — SAST, SCA, IaC Scanning & Keyless AWS Auth Built a security-first CI/CD pipeline with GitHub Actions — security scanning at every stage, zero stored AWS credentials, and automated vulnerability detection before anything reaches production.

Security layers included:

Semgrep SAST for source code vulnerability scanning SonarQube quality gates with custom rule sets npm audit SCA for dependency vulnerabilities Checkov for Terraform and Kubernetes manifest scanning Dockerfile hardening with non-root user enforcement Kubernetes NetworkPolicy for pod-level traffic isolation GitHub Actions OIDC — zero stored AWS access keys Sealed Secrets for encrypted Kubernetes secret management