The DevSecOps Pipeline Checklist Every Team Should Follow

Why DevSecOps?

Security added at the end of development is expensive and disruptive. Security built into the pipeline from day one is nearly free and invisible to developers. This checklist covers everything I embed into every pipeline I build.

Source Control Security

Enable branch protection rules with no direct pushes to the main branch. Require at least one code review before any merge. Enable secret scanning on all repositories to catch accidentally committed credentials. Sign commits where possible to verify author identity.

CI Pipeline Security Gates

Every pipeline must pass through these gates before deploying. Run lint and type checks to catch obvious errors. Execute unit tests to verify functionality. Run SAST scanning with Semgrep or Snyk to detect security vulnerabilities in code. Scan all dependencies for known vulnerabilities. Scan container images with Trivy and block deployments if high or critical vulnerabilities are found. Use OIDC-based cloud authentication with no static keys anywhere in the pipeline.

IAM and Secrets Management

Store all secrets in AWS Secrets Manager or GCP Secret Manager, never in environment files or code repositories. Create least-privilege service accounts scoped to each specific workload. Rotate credentials regularly and audit access logs monthly.

Environment Isolation

Maintain strict separation between development, staging, and production environments. Each environment should have its own cloud accounts or projects, its own service accounts, and its own secrets. Never allow production access from CI pipelines without an explicit approval gate.

Monitoring and Incident Response

Enable audit logging on all cloud accounts and retain logs for at least 90 days. Set up anomaly alerts for unexpected IAM changes or unusual API call patterns. Document and test your incident response runbook before you need it.

Result

Security becomes invisible to developers. It runs automatically in the pipeline, catches issues before they reach production, and leaves a clear audit trail for compliance requirements.

Want DevSecOps embedded in your pipelines? Schedule a meeting.