DevSecOps › Module 10 › Lesson 1
Checklist
Topic 36 capstone checklist — DevSec mindset, pipeline security, SAST/secrets, DAST, IaC, containers, runtime/supply chain, findings/governance on `$DEVSEC_LAB`.
Visual · t36_capstone_checklist
Checklist consolidates DevSecOps literacy pillars. $DEVSEC_LAB only. Original Cyberlium.
Opening
Capstone proves DevSecOps literacy on YOUR authorized `$DEVSEC_LAB` repos — not stranger org pipelines or sabotage recipes.
Assemble checklist covering Modules 1–9: DevSec mindset and lab scope, DevSecOps fundamentals, pipeline security, SAST and secrets, DAST literacy, IaC security, containers in pipeline, runtime and supply chain, findings and governance. Use on capstone walk of YOUR `$DEVSEC_LAB` — never stranger org pipeline scans, never pipeline sabotage recipes, never unauthorized prod deploy or merge bypass, never malicious image or package recipes. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t36-devsec/. Integrity rows: `$DEVSEC_LAB` only, YOUR repos authorized, no sabotage recipes, limitations documented.
1. Scope and ethics
$DEVSEC_LAB named with repo inventory reference. NEVER stranger org pipeline scans, NEVER sabotage recipes, NEVER unauthorized prod deploy, NEVER malicious image/package guides.
Checkov/Trivy modules = scan YOUR stubs and images — not weaponized CI abuse.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF — https://csrc.nist.gov/Projects/ssdf GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/capstone-checklist.txt" <<'EOF'
[ ] lab.env + sample-repo/ iac/ container/ dast/ sbom/ findings/
[ ] roe.txt + no-stranger-scans.txt reviewed
[ ] Concepts: shift-left + SSDF + pipeline stages
[ ] FAKE .env.example + gitleaks detect on YOUR tree
[ ] main.tf intentional misconfig + checkov scan
[ ] Dockerfile stub + trivy fs (optional trivy image)
[ ] security.yml stub: gitleaks + checkov + trivy jobs
[ ] ZAP baseline plan — YOUR 127.0.0.1:8080 only
[ ] SBOM checklist (syft optional)
[ ] findings backlog.csv + pipeline-gate-policy.md
[ ] never: stranger GitHub scans / real secrets / DAST stranger sites
EOFCommand — copy this
grep '\[ \]' "$DEVSEC_LAB/notes/capstone-checklist.txt"
python3 -c "print('Capstone: DevSecOps — YOUR t36-devsec lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Pipeline, SAST/secrets, DAST, IaC, containers, runtime/supply chain, findings/governance — linked rows.
Cross-link Topic 35 Purple Teaming as upstream context — separate authorized track.
3. Teardown
Notes secured chmod 600, evidence pack ready, lab stubs archived per brief.
Retention note for mentor handoff.
4. What you ship: Topic 36 capstone checklist
One-page DevSecOps literacy capstone checklist for $DEVSEC_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'pipeline sabotage recipe for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Pipeline sabotage recipes required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice