90% coverage with actionable steps
Security at every stage: Code → Build → Test → Deploy → Run → Monitor
Catch vulnerabilities during development, not production. Automate security checks in CI/CD.
Scan dependencies, containers, IaC, and runtime continuously. New CVEs emerge daily.
Every service, user, and container gets only the permissions it needs. Nothing more.
Multiple layers: network isolation, secrets encryption, runtime protection, audit logging.
Scan for known vulnerabilities in third-party libraries before they enter your codebase.
cargo audit
cargo install cargo-auditcargo audit --deny warningscargo audit fix (updates Cargo.lock)npm audit or yarn audit
npm audit --audit-level=moderatenpm audit fixsnyk test (more comprehensive)pip-audit or safety
pip install pip-auditpip-audit -r requirements.txtgovulncheck
go install golang.org/x/vuln/cmd/govulncheck@latestgovulncheck ./...Never commit secrets. Use environment variables, secret managers, or encrypted vaults.
git-secrets or gitleaks in pre-commit hooks.env files (gitignored) for local devkubectl create secret or External Secrets OperatorAnalyze source code for security issues without executing it.
# GitHub Actions example
- name: Semgrep
uses: returntocorp/semgrep-action@v1
with:
config: p/security-audit
Scan Docker images for vulnerabilities before pushing to registry.
brew install trivy or download binarytrivy image myapp:latesttrivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latesttrivy config ./terraformtrivy fs .snyk container test myapp:latestsnyk container monitor myapp:latestSmaller attack surface = fewer vulnerabilities.
alpine (5 MB) over ubuntu (77 MB)distroless (Google) - no shell, no package managerscratch for static binaries (Go, Rust)# Build stage (large) FROM rust:1.75 AS builder WORKDIR /app COPY . . RUN cargo build --release # Runtime stage (minimal) FROM gcr.io/distroless/cc-debian12 COPY --from=builder /app/target/release/myapp / CMD ["/myapp"]
cis-docker-benchmark).
Check: CIS Docker Benchmark
Generate a manifest of all components in your software. Required for compliance (e.g., Executive Order 14028).
syft packages myapp:latest -o spdx-json > sbom.jsontrivy image --format cyclonedx myapp:latest > sbom.jsonValidate Terraform, CloudFormation, Kubernetes manifests for misconfigurations.
trivy config ./terraformtrivy config ./k8strivy config --severity HIGH,CRITICAL --exit-code 1 .tfsec - Terraform-specific scannercheckov - Multi-cloud IaC scanner (Python)kube-score - Kubernetes manifest validationHarden K8s clusters and workloads.
restricted pod security policydrop: ["ALL"]runAsNonRoot: truereadOnlyRootFilesystem: trueprivileged: falseNetworkPolicy resourcesDetect anomalous behavior in production.
gVisor or Kata Containers for additional isolationseccomp to restrict syscallsRunning containers accumulate new CVEs. Scan regularly.
Centralize logs, enable audit trails.
Focus on these high-impact practices first:
USER in Dockerfile)All-in-one scanner: containers, IaC, filesystems, repos. Fast, comprehensive, easy to integrate.
Secrets management. Centralized, encrypted, audited. Dynamic secrets, key rotation.
Policy enforcement for K8s. Define and enforce security policies as code.
GitHub Actions workflow with security checks:
name: Security Scan
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
# Dependency scanning
- name: Run npm audit
run: npm audit --audit-level=moderate
# SAST
- name: Semgrep
uses: returntocorp/semgrep-action@v1
with:
config: p/security-audit
# Secrets detection
- name: Gitleaks
uses: gitleaks/gitleaks-action@v2
# Build image
- name: Build Docker image
run: docker build -t myapp:${{ github.sha }} .
# Container scanning
- name: Trivy scan
uses: aquasecurity/trivy-action@master
with:
image-ref: myapp:${{ github.sha }}
severity: HIGH,CRITICAL
exit-code: 1
# IaC scanning
- name: Trivy IaC scan
run: trivy config --severity HIGH,CRITICAL --exit-code 1 ./terraform