tutorial · applied security pipeline
Three gates, three real blocks, one intentionally vulnerable app.
This lab builds a secure code review pipeline — secrets, source code, and runtime behavior, each covered by a different tool — and runs it end to end against the OWASP Juice Shop, an intentionally vulnerable application. Every gate below blocked something real, and chapter 03 shows the actual evidence for each block.
Written from a real implementation, done live, including the configuration mistakes that showed up along the way — a badly indented YAML file, a textbook example key that Gitleaks itself deliberately ignores, a terminal that silently masked text. They get their own chapter (04), because they are exactly the kind of thing anyone building this pipeline will also run into.
What you'll see
A small but complete pipeline, where each gate covers a different layer of the problem: Gitleaks stops a secret from leaking into Git history; SonarCloud analyzes the new code in each PR and blocks it if quality/security drops below a threshold; OWASP ZAP attacks the running application from the outside in, the way a real attacker would. All three have already blocked something real in this implementation — nothing here is simulated.
- Vulnerable target
- OWASP Juice Shop
- CI/CD
- GitHub Actions
- Secret scanning
- Gitleaks
- SAST / Quality Gate
- SonarCloud
- DAST
- OWASP ZAP baseline scan
- Hosting
- none, 24/7 — everything runs on demand via Actions
Who this guide is for
For anyone already comfortable with Git, GitHub Actions, and the command line, who wants to see — not just read about — an AppSec pipeline working against a real target. The full code, workflows, and evidence are public at github.com/RootKaito/secure-pipeline-poc.
Chapters
Architecture & Threat Model
Why three gates, what each one solves — and what none of them solve alone.
02Setting Up
Forking the target, GitHub Actions, a SonarCloud account, Gitleaks and ZAP config.
03Gates in Action
The heart of the lab: the three real blocks, with evidence.
04Troubleshooting
The real mistakes found in this implementation, and how each was fixed.
05Lessons Learned
What's left after the project, and where to take it from here.