DevSecOps › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 36 literacy evidence from `$DEVSEC_LAB` — pipeline, SAST/secrets, DAST, IaC, containers, runtime/supply, findings/governance; no sabotage refs.
Visual · t36_evidence_pack
Evidence pack = mentor handoff from $DEVSEC_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered DevSec notes — and never includes sabotage recipes or stranger org pipeline refs.
Assemble evidence pack: `$DEVSEC_LAB` repo inventory, lab setup proof, pipeline and SAST/secrets labs if brief assigned, DAST lab, IaC lab, container lab, supply lab, governance lab, integrity statement (YOUR repos only, no sabotage recipes, no stranger org scans, no unauthorized prod access, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + scan stubs + diagrams, not sabotage cookbooks. Gap paragraph for Topic 37 GRC & Compliance — separate authorized track. Scan folder for sabotage refs, stranger org pipeline notes, prod keys — zero tolerance.
1. Pack contents
Minimum: repo inventory, pipeline, SAST/secrets, DAST, IaC, containers, supply, findings/governance, integrity index.
Optional: module labs per brief — no refused technique files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF — https://csrc.nist.gov/Projects/ssdf GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
python3 - <<'PY'
import os
lab = os.environ.get('DEVSEC_LAB', os.path.expanduser('~/cyberlium-lab/t36-devsec'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR t36-devsec lab only',
'Ethics: roe.txt, no-stranger-scans.txt',
'Concepts: devsecops-shift-left, ssdf-practices, pipeline-security-stages',
'Secrets: FAKE .env.example + gitleaks detect on sample-repo',
'IaC: iac/main.tf misconfig + checkov scan',
'Container: container/Dockerfile + trivy fs/image',
'CI: sample-repo/.github/workflows/security.yml stub',
'DAST: dast/baseline-plan.md — 127.0.0.1:8080 only',
'SBOM: sbom/checklist.md (+ sbom.cyclonedx.json if syft)',
'Findings: backlog.csv + pipeline-gate-policy.md',
'Refusals: no stranger GitHub scans / real secrets / DAST stranger sites',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'gitleaks|checkov|trivy|Refusals' "$DEVSEC_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$DEVSEC_LAB only, repo discipline, no sabotage refs, share-safe export.
Scan before seal — remove accidental prod keys or stranger org pipeline notes.
4. What you ship: DevSecOps evidence pack
Bundled deliverables + index + integrity — chmod 600, report not sabotage guides default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes pipeline sabotage recipe and stranger org scan guide.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle pipeline through governance index. 2) Integrity statements. 3) Confirm zero sabotage refs. 4) Gap note for Topic 37 GRC.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Sabotage cookbooks OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice