Evidence Pack

Bundle Topic 36 literacy evidence from `$DEVSEC_LAB` — pipeline, SAST/secrets, DAST, IaC, containers, runtime/supply, findings/governance; no sabotage refs.

Evidence Pack• Audio Walkthrough

00:00/02:57

Visual · t36_evidence_pack

Evidence pack = mentor handoff from $DEVSEC_LAB literacy. Original Cyberlium.

One indexed pack beats scattered DevSec notes — and never includes sabotage recipes or stranger org pipeline refs.

Assemble evidence pack: `$DEVSEC_LAB` repo inventory, lab setup proof, pipeline and SAST/secrets labs if brief assigned, DAST lab, IaC lab, container lab, supply lab, governance lab, integrity statement (YOUR repos only, no sabotage recipes, no stranger org scans, no unauthorized prod access, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + scan stubs + diagrams, not sabotage cookbooks. Gap paragraph for Topic 37 GRC & Compliance — separate authorized track. Scan folder for sabotage refs, stranger org pipeline notes, prod keys — zero tolerance.

1. Pack contents

Minimum: repo inventory, pipeline, SAST/secrets, DAST, IaC, containers, supply, findings/governance, integrity index.

Optional: module labs per brief — no refused technique files.

Command guide

Try these commands — Pack contents

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

NIST SSDF — https://csrc.nist.gov/Projects/ssdf GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions CISA Secure by Design — https://www.cisa.gov/securebydesign

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
python3 - <<'PY'
import os
lab = os.environ.get('DEVSEC_LAB', os.path.expanduser('~/cyberlium-lab/t36-devsec'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
  'CAPSTONE EVIDENCE INDEX — YOUR t36-devsec lab only',
  'Ethics: roe.txt, no-stranger-scans.txt',
  'Concepts: devsecops-shift-left, ssdf-practices, pipeline-security-stages',
  'Secrets: FAKE .env.example + gitleaks detect on sample-repo',
  'IaC: iac/main.tf misconfig + checkov scan',
  'Container: container/Dockerfile + trivy fs/image',
  'CI: sample-repo/.github/workflows/security.yml stub',
  'DAST: dast/baseline-plan.md — 127.0.0.1:8080 only',
  'SBOM: sbom/checklist.md (+ sbom.cyclonedx.json if syft)',
  'Findings: backlog.csv + pipeline-gate-policy.md',
  'Refusals: no stranger GitHub scans / real secrets / DAST stranger sites',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'gitleaks|checkov|trivy|Refusals' "$DEVSEC_LAB/notes/capstone-evidence-index.txt"

Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.