Secure Every Commit: Automating AppSec Tests in CI/CD

By Barbara Capasso · LevelAct

In today’s high-speed software world, security testing can’t be an afterthought. The longer it takes to detect vulnerabilities, the higher the risk—and the higher the cost. That’s why the most mature DevOps teams are automating security testing directly into their CI/CD pipelines, integrating with platforms like GitHub, GitLab, and Azure DevOps (ADO) to shift security left and tighten feedback loops.

This article explores how modern engineering teams are embedding security into the development lifecycle—from commit to deploy—without slowing down velocity.

---

🔁 Why Automate Security in CI/CD Pipelines?

Manual security reviews and out-of-band testing aren’t scalable anymore. With modern release cycles measured in hours—not weeks—teams need continuous security coverage to catch risks early.

Automated security testing offers:

• 🚨 Early detection of vulnerabilities (before code hits staging)
• ⏱️ Faster feedback loops for developers
• 🔒 Increased coverage across code, dependencies, containers, and infrastructure
• 📉 Reduced remediation costs (up to 100x cheaper to fix issues pre-prod)

---

🔧 Integration Basics: GitHub, GitLab, and Azure DevOps

Each DevOps platform offers built-in extensibility to plug security checks directly into the build and deployment pipeline.

✅ GitHub Actions

• Supports YAML-defined workflows triggered on push, pull request, or schedule
• Easily integrate open-source scanners or commercial tools as reusable actions
• Example:

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master

✅ GitLab CI/CD

• .gitlab-ci.yml defines build stages and security scans
• Native support for SAST, DAST, Dependency Scanning, Container Scanning
• Results surface directly in Merge Request Security Tab

✅ Azure DevOps (ADO)

• Use Pipelines YAML or classic release pipelines
• Integrate scanners via Azure Marketplace extensions or inline PowerShell scripts
• Supports approval gates based on scan results

---

🔍 What Security Tests Can You Automate?

1. SAST (Static Application Security Testing)

• Scans source code for common coding flaws (e.g., SQLi, XSS)
• Recommended tools:
  • ✅ Semgrep (open source, customizable)
  • ✅ CodeQL (GitHub-native)
  • 🔒 Checkmarx, Veracode

2. DAST (Dynamic Application Security Testing)

• Scans running applications for real-world vulnerabilities
• Example tools:
  • ✅ OWASP ZAP (great for GitHub/GitLab)
  • 🔒 Burp Suite Pro (via ADO or GitLab integrations)

3. Dependency Scanning / SBOM

• Detects vulnerable open source libraries
• Tools:
  • ✅ Snyk, OWASP Dependency-Check
  • GitHub’s native Dependabot
  • GitLab’s Dependency Scanning feature

4. Secrets Scanning

• Prevents API keys, tokens, and credentials from being committed
• Tools:
  • ✅ Gitleaks
  • ✅ GitHub Advanced Security’s native secret scanning
  • ✅ GitLab’s integrated secret detection

5. Container + IaC Security

• Tools like:
  • ✅ Trivy for container scans
  • ✅ Checkov for Terraform, CloudFormation, and Kubernetes
  • ✅ KICS for infrastructure as code

---

🧠 Real-World Pipeline Example (GitHub)

name: CI Pipeline

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: "p/ci"
      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:latest'

This pipeline:

• Runs SAST on every PR
• Scans containers before build
• Flags issues right in the GitHub PR comments

---

⚡ Best Practices for DevSecOps Success

• ✅ Fail fast, fix fast: Don’t just report issues—fail the build if they’re critical.
• ✅ Use baseline policies: Triage high-priority vulns, ignore noise.
• ✅ Surface results where devs live: PR comments, Slack, Jira, etc.
• ✅ Scan on every PR + nightly: One-time scans miss real risks.
• ✅ Collaborate across roles: Dev, security, platform all need visibility.

---

📈 Metrics That Matter

Track these KPIs to show value:

• 🕒 Time to remediate (TTR)
• 🚨 Vulnerabilities per release
• 🔁 Security feedback loop latency
• 🧪 Test coverage (code, deps, containers, IaC)

---

💬 Conclusion: Security That Moves as Fast as Your Code

Automated security testing isn’t a luxury anymore—it’s survival. When your AppSec tools live inside your DevOps platform, you gain the power to detect and fix issues earlier, with less friction, and with far greater scale.

GitHub, GitLab, and Azure DevOps now offer a rich ecosystem of integrations, open-source tools, and vendor plugins to make security continuous. Start small, automate what matters, and build a pipeline where security and speed aren’t in conflict—they’re in sync.