India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
DevSecOps: Security Gates for SAST, SCA, IaC and Supply Chain
DevSecOps here means building security controls into existing CI/CD pipelines: static code analysis, dependency and secret scanning, infrastructure-as-code checks, SBOM generation, artefact signing and deploy-time policy gates. NTSPL adds these controls to GitHub, GitLab, Azure DevOps or cloud-native pipelines, tuned so they block real risk without slowing Indian product teams' release cadence.
Delivered on
In scope
Pipelines That Build Fast but Check Nothing
Most pipelines we review build and deploy well but check almost nothing. A scanner may have been bolted on once, produced 4,000 warnings, and been set to never fail the build. Dependencies with known critical CVEs ship weekly, Terraform plans that open storage to the public sail through review, CI runners hold long-lived cloud admin keys, and nothing proves that the image running in production is the one that was built and tested. Security reviews happen after release, when fixing costs ten times more.
NTSPL works inside the pipelines your teams already run rather than replacing them. We add a small set of scanners at the right stage, baseline existing findings so teams are judged only on new risk, and set break-the-build rules narrowly: new critical vulnerabilities with a fix available, live secrets and high-risk IaC misconfigurations. Pipelines authenticate to cloud through OIDC federation, every artefact gets an SBOM and signature, and the cluster or deploy step verifies both before release.
Signals That Security Has Not Reached Your Delivery Pipeline
Signals you need DevSecOps
- Builds have no failing security checks, or existing scanners are set to warn-only with thousands of findings
- CI/CD runners use long-lived cloud access keys or service principal secrets
- Terraform, Bicep or CloudFormation changes reach production without automated misconfiguration checks
- Customers or auditors ask for SBOMs or proof of build provenance
- Critical dependency vulnerabilities take more than 30 days to fix after disclosure
When to choose something else
- Your pipelines themselves need building: environments, test automation and deployment strategies come first under DevSecOps & CI/CD in Application Modernization.
- The backlog is CVEs on long-running servers, not in code and images; that sits with Vulnerability Management.
Scanners, Gates, SBOMs and Signing We Add to Your Pipelines
Code and dependency scanning
Add SAST such as Semgrep or CodeQL and SCA such as OSV-Scanner, Trivy or Dependabot to pull requests, with baselines so only new findings block.
Secret scanning
Run pre-commit hooks and pipeline secret detection, plus platform push protection where the repository host supports it.
Infrastructure-as-code checks
Scan Terraform, Bicep, CloudFormation and Kubernetes manifests with Checkov, Trivy or PSRule, and enforce organisation policies with OPA or Conftest.
SBOM and signing
Generate SPDX or CycloneDX SBOMs with Syft for every image, sign images and attestations with Cosign, Notation or AWS Signer.
Deploy-time policy gates
Verify signatures, scan status and policy compliance at deployment through Binary Authorization, Kyverno or admission controls.
Keyless pipeline identity
Replace stored cloud credentials in CI with OIDC federation to AWS, Azure and Google Cloud, scoped per repository and environment.
Commit to Cluster: Where Each Security Gate Sits
Pipeline Security Gates from Pull Request to Admission
Developers get fast feedback on code, dependencies, secrets and IaC at pull request, while builds produce signed images with SBOMs and scan attestations. Deployment only proceeds when admission policy verifies the signature and attestations, and pipelines reach cloud through short-lived federated credentials.
Select any component
Pipeline Security Gates from Pull Request to Admission: click any of its 8 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Pipeline Security on CodeBuild, Azure DevOps, GitHub and Cloud Build
IAM roles trusting GitHub or GitLab OIDC remove CI access keys; AWS Signer with Notation signs ECR images for verification at EKS admission.
Workload identity federation for Azure DevOps service connections and GitHub Actions removes service principal secrets; Defender for Cloud surfaces code and IaC findings from connected repositories.
Binary Authorization enforces attestations at GKE and Cloud Run deploy time; Artifact Analysis provides vulnerability results that attestors can check.
Break-the-Build Rules, Baselines and Tool Consolidation
What breaks the build
Block only on new critical and high vulnerabilities with an available fix, any verified live secret, and IaC misconfigurations on a short list of 20-30 high-risk checks such as public storage or open management ports. Report everything else. Teams accept gates that fail under 5% of builds for real reasons; gates failing 30% get bypassed within a month.
Baselining existing findings
Snapshot existing findings on day one and exclude them from gating, so a team is not blocked by five-year-old debt on the first pull request. Give the baseline a burn-down target, for example 25% per quarter, tracked separately. Without a baseline, the first week of enforcement usually ends with security gates disabled.
Open-source or commercial scanners
Semgrep, OSV-Scanner, Trivy, Checkov, Gitleaks and Syft cover most needs at no licence cost. Commercial platforms, or GitHub Code Security and Secret Protection, add better triage, reachability analysis and dashboards. Choose commercial when you exceed about 100 repositories or need central reporting for auditors; below that, a curated open-source set with good defaults works well.
Signing and admission scope
Start signature enforcement in production clusters only, in audit mode for two weeks, then enforce. Exempt system namespaces and vendor images through a reviewed allowlist. Require SBOM and scan attestations for internet-facing services first. Enforcing everywhere on day one breaks third-party charts and drives teams to request blanket exemptions. Review allowlists monthly.
Rolling Security Gates Across Teams Without Stalling Releases
Pipeline inventory and baseline scan
List repositories, pipelines and runners and capture baseline findings for every repository.
Keyless CI identity
Replace stored cloud credentials with OIDC federation scoped per repository and environment.
Pull request gates for pilot teams
Enable SAST, SCA, secret and IaC checks in warn mode, tune rules, then enforce for two pilot teams.
SBOM, signing and admission audit mode
Generate SBOMs, sign images and run admission policies in audit mode in production.
Organisation rollout and enforcement
Roll gates to all teams through shared pipeline templates and switch admission to enforce.
What you receive
Fix Time, Gate Precision and Supply Chain Coverage
| KPI | Typical target |
|---|---|
| Pipelines using shared secure templates | 90% or more |
| Median time to fix new critical dependency CVEs | Under 7 days |
| Builds failing security gates for false positives | Under 2% |
| Production images signed with SBOM attached | 100% |
Pipeline Slowdowns, Bypassed Gates and Noisy Scanners
| Risk | How NTSPL prevents it |
|---|---|
| Security stages add 10-15 minutes and developers bypass them | Diff-aware scanning at pull request, full scans nightly, with a three-minute budget per stage. |
| Teams copy pipelines and drop security steps | Shared templates are required by branch protection, and drift is reported weekly. |
| Admission enforcement blocks an urgent production fix | A logged break-glass override with security approval and automatic follow-up ticket. |
DevSecOps tools in the pipeline or a separate application security team review?
Put automated controls in the pipeline first; keep human review for what tools cannot judge. Scanners catch known-vulnerable dependencies, leaked secrets, IaC misconfigurations and common code flaws in minutes on every change, which no review team can match at weekly release cadence. Human application security effort is better spent on threat modelling new features, reviewing authentication and payment flows, and penetration testing before major launches. Teams that rely only on periodic reviews find issues months after release; teams that rely only on tools miss business logic flaws. Use both, in that order.
Key facts: DevSecOps
DevSecOps in Practice
2 DevSecOps scenarios, from Travel technology (hotel booking and channel management) and Non-profit (child education NGO), plus related platform case studies.
Hotel booking platform cuts critical dependency fix time from 41 days to 6
Child-education NGO removes deploy secrets and gates agency code on donor platform
Logistics SaaS scales shipment tracking to 9 crore events a day on EKS with Karpenter
Health TPA meets 1-hour cashless pre-auth target with AKS and KEDA-scaled adjudication
DevSecOps: Frequently Asked Questions
What does adding security to our pipelines cost?
For 20-80 repositories on one CI platform, NTSPL's engagement typically costs INR 9-18 lakh over 12 weeks. Open-source scanners add no licence cost; commercial code security platforms are licensed per committer, so for 50 developers expect several lakh a year.
Will security scanning slow down our releases?
Not noticeably if designed well. Pull request scans are diff-aware and budgeted at about three minutes per stage, heavier full scans run nightly, and only a narrow set of high-confidence issues blocks a merge. Most teams see total pipeline time rise by two to four minutes.
Do we need SBOMs?
Increasingly, yes. Banks and large enterprises in India now ask software vendors for SBOMs in procurement and audits, and SBOMs let you answer within minutes whether a newly disclosed vulnerable library is in any production image. We generate SPDX or CycloneDX for every image automatically.
How do pipelines access the cloud without stored keys?
GitHub Actions, GitLab CI and Azure DevOps can present OIDC tokens that AWS IAM, Microsoft Entra workload identity federation and Google Cloud Workload Identity Federation trust. Each repository and environment receives a narrowly scoped role, and tokens last minutes, so there is no key to leak.
What if a legitimate release is blocked by a false positive?
Developers can mark a finding as a false positive or request an exception through a documented flow, reviewed by security within one business day. For urgent production fixes there is a logged break-glass override that creates a follow-up ticket automatically.
Does DevSecOps help with RBI or SEBI audits?
Yes. Regulators expect secure software development practices, including code review, vulnerability testing before release and change control. Pipeline logs showing scans, approvals, signed artefacts and exceptions give auditors continuous evidence across every release instead of samples. CERT-In and DPDP investigations also benefit from this trail.