Checklist

Topic 36 capstone checklist — DevSec mindset, pipeline security, SAST/secrets, DAST, IaC, containers, runtime/supply chain, findings/governance on `$DEVSEC_LAB`.

Checklist• Audio Walkthrough

00:00/02:58

Visual · t36_capstone_checklist

Checklist consolidates DevSecOps literacy pillars. $DEVSEC_LAB only. Original Cyberlium.

Capstone proves DevSecOps literacy on YOUR authorized `$DEVSEC_LAB` repos — not stranger org pipelines or sabotage recipes.

Assemble checklist covering Modules 1–9: DevSec mindset and lab scope, DevSecOps fundamentals, pipeline security, SAST and secrets, DAST literacy, IaC security, containers in pipeline, runtime and supply chain, findings and governance. Use on capstone walk of YOUR `$DEVSEC_LAB` — never stranger org pipeline scans, never pipeline sabotage recipes, never unauthorized prod deploy or merge bypass, never malicious image or package recipes. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t36-devsec/. Integrity rows: `$DEVSEC_LAB` only, YOUR repos authorized, no sabotage recipes, limitations documented.

1. Scope and ethics

$DEVSEC_LAB named with repo inventory reference. NEVER stranger org pipeline scans, NEVER sabotage recipes, NEVER unauthorized prod deploy, NEVER malicious image/package guides.

Checkov/Trivy modules = scan YOUR stubs and images — not weaponized CI abuse.

Command guide

Try these commands — Scope and ethics

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.