DevSecOps in 30 Minutes: Drop-In Security for Any Repo, Durrell Gemuh

Most teams bolt security on after the first audit finding lands. By then you're triaging hundreds of issues across months of commits, arguing about who owns what, and praying nothing critical shipped to production. I've been there, it's miserable.

The alternative is shift-left: catch problems the moment code is written, not after it's deployed. I built a starter kit that drops DevSecOps into any repository in about 30 minutes. No custom tooling, no vendor lock-in, just open-source scanners wired together with pre-commit hooks and a single GitHub Actions pipeline.

What the Kit Includes

Tool	What It Catches	Layer
gitleaks	Hardcoded secrets, API keys, tokens	Secrets
Trivy	Container image CVEs, OS package vulnerabilities	Container
tfsec	Terraform misconfigurations (public S3 buckets, open security groups)	IaC
checkov	IaC policy violations across Terraform, CloudFormation, Kubernetes	IaC
hadolint	Dockerfile anti-patterns (running as root, unpinned base images)	Container
pre-commit	Orchestrates all local hooks before code even reaches remote	Local

Every tool is free, open-source, and actively maintained. Together they cover secrets, infrastructure-as-code, and container security, the three layers where most preventable vulnerabilities live.

How to Set It Up

Two files. That's it.

Copy .pre-commit-config.yaml into your repo root.
Copy .github/workflows/security.yml into your workflows directory.
Run pre-commit install so hooks fire locally on every commit.

Developers get instant feedback before push. CI catches anything that slips through (or runs on repos where not everyone has hooks installed).

The Pre-Commit Config

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks

  - repo: https://github.com/hadolint/hadolint
    rev: v2.12.0
    hooks:
      - id: hadolint
        args: ["--ignore", "DL3008"]

  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.96.1
    hooks:
      - id: terraform_tfsec
      - id: terraform_checkov
        args: ["--args=--quiet"]

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.6.0
    hooks:
      - id: check-added-large-files
      - id: detect-private-key
      - id: trailing-whitespace
      - id: end-of-file-fixer

Run pre-commit install once and every git commit triggers these checks locally. If gitleaks finds an AWS key you accidentally pasted, the commit is blocked before it ever hits your branch.

The CI Pipeline

# .github/workflows/security.yml
name: Security Scan

on:
  pull_request:
  push:
    branches: [main]

jobs:
  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  iac:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: tfsec
        uses: aquasecurity/tfsec-action@v1.0.3
        with:
          soft_fail: false
      - name: checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: .
          quiet: true
          framework: terraform

  container:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Hadolint
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
      - name: Build image
        run: docker build -t app:${{ github.sha }} .
      - name: Trivy scan
        uses: aquasecurity/trivy-action@0.24.0
        with:
          image-ref: app:${{ github.sha }}
          severity: CRITICAL,HIGH
          exit-code: 1

Three parallel jobs: secrets, IaC, and container scanning. PRs won't merge if any job fails. The whole pipeline adds about 2 minutes to CI.

What Each Tool Actually Catches

gitleaks: finds secrets that should never be in version control:

Finding: AWS Access Key ID
File: deploy/env.sh
Line: 3
Secret: AKIA...EXAMPLE

tfsec: flags Terraform misconfigurations before terraform apply:

Result: aws-s3-bucket-no-public-access
Impact: Public access to S3 bucket exposes data to the internet
Resolution: Add aws_s3_bucket_public_access_block resource

checkov: policy-as-code for IaC, catches things tfsec might miss (and vice versa: I run both):

Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
FAILED for resource: aws_s3_bucket.data

Trivy: scans your built container image for known CVEs:

libcurl4 (CVE-2024-XXXX)
Severity: CRITICAL
Fixed Version: 7.88.1-10+deb12u5

hadolint: lints Dockerfiles against best practices:

DL3007 warning: Using latest is prone to errors
DL3002 warning: Last USER should not be root

Running tfsec and checkov isn't redundant, they have different rule sets and catch different issues. The overlap is small and the combined coverage is significantly better.

Why Shift-Left Works

The economics are simple. A secret caught at commit time costs 5 minutes to fix. The same secret found in production costs an incident response, key rotation, audit trail review, and possibly a customer notification. I've seen teams spend entire sprints on remediation that would have been a one-line fix if caught early.

Shift-left also changes developer behavior. When you get immediate feedback that your Terraform opens port 22 to the world, you learn the secure pattern once and stop making that mistake. Security becomes muscle memory, not a quarterly lecture.

The key insight: security tooling needs to be zero-friction. If it's slow, noisy, or hard to configure, developers disable it. This kit is designed to be silent when things are fine and loud only when something actually needs attention. No 200-line config files, no false-positive storms.

Getting Started

# Clone and copy the configs into your repo
git clone https://github.com/durrello/devsecops-starter-kit.git
cp devsecops-starter-kit/.pre-commit-config.yaml your-repo/
cp -r devsecops-starter-kit/.github your-repo/

# Install hooks
cd your-repo
pre-commit install

# Test it works
pre-commit run --all-files

That's 30 minutes from zero to a repo that scans for secrets, audits your Terraform, lints your Dockerfiles, and checks container images for CVEs, locally on every commit and in CI on every PR.

Adapt it to your stack. Don't use Terraform? Remove the tfsec/checkov hooks. No containers? Drop Trivy and hadolint. The kit is modular, take what you need.

The full starter kit with configs, documentation, and example outputs is on GitHub: durrello/devsecops-starter-kit

DevSecOps in 30 Minutes: Drop-In Security for Any Repo