Day 81: Shift-left: secrets scanning & SAST
The "Sec" in DevSecOps: catching problems as early as possible
"Shift-left" means moving security checks as early in the pipeline as possible — ideally before a commit even merges — rather than finding problems in a post-deployment audit. Today: the first two gates.
Secrets scanning (gitleaks)
Committing an API key or password to Git is a common, costly mistake — even if you delete it in a later commit, it's still in the Git history. gitleaks scans commits for patterns matching known secret formats (AWS keys, private keys, generic high-entropy strings) and fails the build before a secret-bearing commit can merge.
secrets-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: gitleaks/gitleaks-action@v2SAST (Semgrep/CodeQL)
Static Application Security Testing analyzes source code itself (without running it) for known vulnerability patterns — SQL built via string concatenation, unsanitized input reaching a dangerous sink, insecure deserialization. Semgrep uses simple, fast pattern rules; CodeQL treats code as queryable data, enabling deeper structural analysis.
sast:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: semgrep/semgrep-action@v1
with:
config: p/owasp-top-tenKey terms
- Shift-left security
- Moving security checks as early in the development lifecycle as possible.
- SAST
- Analyzing source code statically for known vulnerability patterns, without executing it.
A developer commits an API key, then deletes it in the very next commit before merging. Why is this still a security incident?
