DevSecOps · zero to on-call
Security as part
of the build.
Secrets, dependencies, images, infrastructure and supply chain, scanned and fixed in the pipeline. Practise on a simulated repository that breaks the way real ones do.
Learning DevSecOps?
Start from zero, step by step.
Levels in order, each with a hands-on finding to fix on a simulated repository.
Something broken right now?
Paste the finding, get the fix.
What the error means, each cause with the check that proves it, and the fix for that cause, for common scanner findings and pipeline errors.
Everything you need, from the first scan to the 3 a.m. incident.
Fix the pipeline. Right here.
Practice data: advisory IDs such as PRACTICE-2026-0001, and every key, token and password in the simulator, are invented. Nothing here touches a real system.
Status
Last pipeline run
Repository: select a file to edit it
Your path
Fourteen levels from first principles to incident response. Each says what you learn, which of this repository's workflows shows it, a hands-on lab, and the scenarios to practise.
The standards behind it
Cited by name throughout the site. Each link goes to the official page.
Quiz
Scenario questions for every level. You see right or wrong as soon as you answer, with the reasoning.
Pipeline X-ray
Paste a GitHub Actions workflow, a Dockerfile, Terraform or a Kubernetes manifest. Every line is explained, security issues are flagged by category (secrets, supply chain, least privilege, image hardening, IaC misconfiguration), and missing essentials are listed.
Stuck on a finding?
Paste the scanner finding or error text, or type a tool or symptom. Each answer says what the error means, then each possible cause with a check that proves it and the fix for it, and how to prevent it, then gives you a safe scenario to break and fix it yourself, so you recognise it next time. Each entry has its own link.
Also as a plain page without JavaScript: every problem on one page.
Cheat sheet
The commands people use to scan, sign and fix. Try runs one in the playground, in the scenario it belongs to. Lab marks those that need your own machine or cluster.
The secure development life cycle
The secure software development life cycle: where each control sits, what it catches, how it fails, and which standard it answers to. Select a control for details.