Lab — Capstone
Execute capstone on `$DEVSEC_LAB` — checklist, lab path, evidence pack sealed; zero sabotage refs.
Visual · t36_capstone_lab
Capstone: checklist × $DEVSEC_LAB literacy evidence. Original Cyberlium.
Close the DevSecOps literacy loop — scans run, findings triaged, gates documented — without stranger org pipeline abuse or sabotage recipes.
Walk Topic 36 checklist on YOUR `$DEVSEC_LAB`: verify repo inventory, lab path current, pipeline through governance packs indexed, scan for sabotage refs and stranger org pipeline notes (must be zero). Update index with capstone UTC completion. Integrity paragraph: repo discipline and IaC/container scan key insight from YOUR path. No stranger org pipeline scans, no sabotage recipes, no unauthorized prod deploy or merge bypass, no malicious image/package guides. Optional mentor review — three clarity questions. Secure notes chmod 600 after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero sabotage refs in any file.
Scan sealed pack for unauthorized prod URLs — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF — https://csrc.nist.gov/Projects/ssdf GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Gitleaks — https://gitleaks.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
grep NEVER "$DEVSEC_LAB/notes/no-stranger-scans.txt"
grep -E 'never|stranger' "$DEVSEC_LAB/roe.txt"
echo '=== Capstone: gitleaks → checkov → trivy → security.yml → ZAP localhost → SBOM → backlog ==='
grep FAKE "$DEVSEC_REPO/.env.example" | head -2
grep MISCONFIG "$DEVSEC_IAC/main.tf" | head -2
grep -E 'gitleaks|checkov|trivy' "$DEVSEC_REPO/.github/workflows/security.yml"
grep DEVSEC-FND "$DEVSEC_LAB/findings/backlog.csv" | head -3
grep '\[ \]' "$DEVSEC_LAB/notes/capstone-checklist.txt" | head -5
python3 - <<'PY'
import os
lab = os.environ.get('DEVSEC_LAB', os.path.expanduser('~/cyberlium-lab/t36-devsec'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'DevSecOps Capstone',
'scope: YOUR $HOME/cyberlium-lab/t36-devsec/ + localhost DAST only',
'secrets: FAKE .env.example + gitleaks on YOUR sample-repo',
'iac: main.tf misconfig + checkov scan',
'container: Dockerfile + trivy fs/image',
'ci: security.yml gitleaks/checkov/trivy stub jobs',
'dast: ZAP baseline 127.0.0.1:8080 optional docker',
'sbom: checklist.md (+ syft cyclonedx optional)',
'findings: backlog.csv + pipeline-gate-policy.md',
'never: stranger GitHub scans / real secrets / DAST stranger sites',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|gitleaks|checkov|trivy' "$DEVSEC_LAB/notes/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/notes/no-stranger-scans.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t36-devsec/notes/capstone-summary.txt | Select-String never Get-Content $HOME/cyberlium-lab/t36-devsec/findings/backlog.csv | Select-String DEVSEC-FND
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks (https://gitleaks.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
Repo inventory + scan discipline + findings/triage key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or scan stranger org pipelines — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 37 GRC & Compliance on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero sabotage scan.
5. What you record before the next lesson
Capstone pack path. $DEVSEC_LAB quiet.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Capstone includes pipeline sabotage walkthrough as bonus exhibit.
- Right: Capstone complete on $DEVSEC_LAB with full teardown. Next: topic quiz.
Mission: Topic 36 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero sabotage refs. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
APPLY: Capstone target:
APPLY: True or False: Sabotage recipes earn capstone credit.
APPLY: Capstone teardown includes: