Iraide Díaz OruetaSenior Software Engineer based in Bilbao. Over a decade building for the web: frontend, backend, DevOps and infrastructure.https://idiaz.info/esFree DevSecOps on a private repo: the short versionhttps://idiaz.info/blog/free-devsecops-on-a-private-repo-the-short-version/https://idiaz.info/blog/free-devsecops-on-a-private-repo-the-short-version/The whole series in one screen: what the pipeline is, what it found, what I got wrong, and what I would keep.Tue, 20 Oct 2026 00:00:00 GMTendevsecopsgithub-actionsci-cdsecurityhi@idiaz.info (Iraide Díaz Orueta)The month the free minutes ran outhttps://idiaz.info/blog/the-month-the-free-minutes-ran-out/https://idiaz.info/blog/the-month-the-free-minutes-ran-out/DAST was cheap to build and expensive to run: how two ZAP scans per change emptied a private repo's Actions quota on 28 September, what it took to move the pipeline to a box of my own, and what the pipeline does now. Fourth of four.Sat, 10 Oct 2026 00:00:00 GMTendevsecopsgithub-actionsci-cdsecurityhi@idiaz.info (Iraide Díaz Orueta)DAST coverage is counted at the server, not in the scanner's reporthttps://idiaz.info/blog/dast-coverage-is-counted-at-the-server/https://idiaz.info/blog/dast-coverage-is-counted-at-the-server/What the scan does not cover, and the two days it took to find out how little it reached: an HttpOnly cookie, a spider that will not click, an API-definition scan from 10 requests to 3,010, and an SBOM that took three releases to attach. Third of four.Tue, 29 Sep 2026 00:00:00 GMTendevsecopsgithub-actionsci-cdsecurityhi@idiaz.info (Iraide Díaz Orueta)Three weeks with the gates: what they blocked, what they got wrong, and what they made me fixhttps://idiaz.info/blog/three-weeks-with-the-gates/https://idiaz.info/blog/three-weeks-with-the-gates/Three weeks living with a free DevSecOps pipeline on a private repo: the ZAP gate goes on, Trivy blocks main again, two fences I never set turn up, and a green step turns out to have never worked. Second of four.Fri, 25 Sep 2026 00:00:00 GMTendevsecopsgithub-actionsci-cdsecurityhi@idiaz.info (Iraide Díaz Orueta)The decision that made DAST cheap was made three months earlier, and it had nothing to do with securityhttps://idiaz.info/blog/the-decision-that-made-dast-cheap/https://idiaz.info/blog/the-decision-that-made-dast-cheap/Building a full DevSecOps pipeline for free on a private repo: the decision that made the expensive part cheap, what the first run found and what the first merge blocked. First of four.Sun, 20 Sep 2026 00:00:00 GMTendevsecopsgithub-actionshexagonal-architectureci-cdsecurityhi@idiaz.info (Iraide Díaz Orueta)Hello Worldhttps://idiaz.info/blog/hello-world/https://idiaz.info/blog/hello-world/A small introduction to my little corner of the internet.Fri, 04 Sep 2026 00:00:00 GMTenpersonalintroductionhi@idiaz.info (Iraide Díaz Orueta)