Skip to content
sec/atlas
knowledge base · devsecops

Software security, mapped.

An interactive map of the concepts that protect a pipeline: SAST, DAST, SCA, secrets scanning, SBOM and CI/CD: what each one does, where it fits and how they connect.

$ click a card for details · ctrl+k to search

learning map

Topics are laid out by level, from foundations to advanced. Arrows point from a prerequisite to what builds on it. Select a topic to preview it, or follow the highlighted next step.

Your next step

0 of 9 studied
start this topic

01 Foundations

The ideas everything else builds on.

02 Practitioner

Apply the controls and make them work in practice.

03 Advanced

Design, scale and operate at depth.

  • studied
  • ready to study
  • prerequisites missing

end-to-end pipeline

The path of a commit to production, and the check that lives at each step. Each chip opens the matching topic.

  1. 01source

    a push or PR triggers the pipeline

    secrets scanningpre-commit hooksPR checksfeature threat model

    gate: no secrets in the diff

  2. 02build

    compiles and resolves dependencies

    SASTSCA

    gate: no new critical findings

  3. 03test

    unit, integration and security tests

    pipeline orchestrationunit testsintegration testsquality gate

    gate: green suite + policies ok

  4. 04package

    final artifact: binary or image

    SBOMimage scansigning + provenance

    gate: signed, intact artifact

  5. 05deploy

    staging first, production later

    DAST in stagingsmoke testsproduction gate

    gate: DAST with no criticals + approval

  6. 06monitor

    production is observed, continuous feedback

    observability and alertscontinuous SCArollback

    gate: a new CVE becomes an automatic PR

loop: A new CVE in a dependency already in use → continuous SCA opens a PR → the pipeline starts again at 01

topics

CI/CD
The backbone of modern software: every commit becomes a build, a test run and a deploy with no manual intervention.
practice· stage: source → prod
SAST
An X-ray of the code without running anything: it finds vulnerable patterns before the first deploy.
testing technique· stage: build / PR
DAST
Attacks the running application the way a malicious user would, without seeing the code.
testing technique· stage: staging
SCA
Watches the code you did not write: third-party libraries, versions and known vulnerabilities.
testing technique· stage: build
Secrets Scanning
Hunts tokens, API keys and passwords before they become an incident, including in git history.
testing technique· stage: source
SBOM
A formal inventory of everything that makes up the artifact: dependencies, versions, licenses and hashes.
concept
Shift-left
The further left in the lifecycle a flaw is found, the cheaper it is to fix.
concept
DevSecOps
Turns the pipeline into a series of automated security gates, without slowing the team down.
practice· stage: todas as fases
Threat modeling: think like the attacker before coding
Threat modeling is the structured conversation that discovers what can go wrong while it is still cheap to fix: in the design, not in the pentest.
practice· stage: source