Blog
- · 2 min read
Free DevSecOps on a private repo: the short version
The whole series in one screen: what the pipeline is, what it found, what I got wrong, and what I would keep.
- · 7 min read
The month the free minutes ran out
DAST was cheap to build and expensive to run: how two ZAP scans per change emptied a private repo's Actions quota on 28 September, what it took to move the pipeline to a box of my own, and what the pipeline does now. Fourth of four.
- · 9 min read
DAST coverage is counted at the server, not in the scanner's report
What the scan does not cover, and the two days it took to find out how little it reached: an HttpOnly cookie, a spider that will not click, an API-definition scan from 10 requests to 3,010, and an SBOM that took three releases to attach. Third of four.
- · 10 min read
Three weeks with the gates: what they blocked, what they got wrong, and what they made me fix
Three weeks living with a free DevSecOps pipeline on a private repo: the ZAP gate goes on, Trivy blocks main again, two fences I never set turn up, and a green step turns out to have never worked. Second of four.
- · 9 min read
The decision that made DAST cheap was made three months earlier, and it had nothing to do with security
Building a full DevSecOps pipeline for free on a private repo: the decision that made the expensive part cheap, what the first run found and what the first merge blocked. First of four.
- · 1 min read
Hello World
A small introduction to my little corner of the internet.
