CyberSecurity Deep Dive
by Sergey Okinchuk
Post-Incident ReviewSecure Coding Principles

Chapter Twelve · Closing the Doors the Code Left Open

Securing the Build

The intruder got in through Sam's code and the pipeline that shipped it. This chapter closes those doors — secure coding, the dependencies Meridian pulls in, secrets in the CI/CD system, and the tooling that catches flaws before release. It stays at the "shift security left" level and hands the full pipeline depth to a future DevSecOps course.

5 topics

The cheapest vulnerability to fix is the one that never ships. This chapter moves security earlier — into the code Sam writes, the dependencies Meridian pulls in, the secrets the pipeline holds, and the automated checks that run before release — so the flaws the intruder exploited in Chapter 6 are caught at build time instead of in production. It is the same cost curve from Chapter 1, applied to security: a flaw caught in code costs a fraction of the same flaw caught in a breach.

Five topics: secure coding principles, dependency and supply-chain risk, secrets in code and CI/CD, the SAST/DAST/SCA tooling map, and shifting left. This chapter deliberately stops at the AppSec foundation and hands the full pipeline, infrastructure-as-code, and supply-chain depth to a dedicated DevSecOps course, keeping the scopes distinct.

Security moved left — caught at build, not in the breach
1
Write it safe
secure coding
2
Manage inputs
dependencies · secrets
3
Check it
SAST · DAST · SCA
4
Shift left
→ DevSecOps

Topics in This Chapter

Topic 62
Secure Coding Principles
Most web flaws trace to a handful of coding habits, so the cheapest security is code that doesn't create them. Validate input, encode output, least privilege, fail securely — as a working discipline.
Secure Coding
Topic 63
Dependency and Supply-Chain Risk
Modern software is mostly other people's code. A vulnerable dependency (Log4Shell) or a malicious package becomes your vulnerability. Know what you depend on, catch known-bad and malicious, verify integrity.
Supply Chain
Topic 64
Secrets in Code and CI/CD
The CI/CD pipeline holds the keys to everything — deploy credentials, cloud access — making it one of the highest-value targets. Hardcoded secrets, secrets in build logs, and over-privileged pipelines are the failures.
CI/CD Secrets
Topic 65
SAST, DAST, and SCA
You can't manually review every line, so automated testing fills the gap. SAST reads source, DAST attacks the running app, SCA checks dependencies — complementary, none complete alone.
SAST/DAST/SCA
Topic 66
Shifting Left
Moving security earlier in the lifecycle, because a flaw caught in design costs a fraction of one caught in production. The theme tying the chapter together — and the clean handoff to DevSecOps.
Shift Left