DevSecOps › Module 10 › Lesson 2
Lab Path
DevSecOps literacy path on `$DEVSEC_LAB` — lab setup to mentor handoff with ethics gates at every station.
Visual · t36_lab_path
Lab path = visual DevSec chain on YOUR $DEVSEC_LAB. Original Cyberlium.
Opening
Draw the path from lab setup to mentor handoff — with stop signs at every stranger-org pipeline shortcut and sabotage recipe lane.
Document literacy path: `$DEVSEC_LAB` setup → DevSec fundamentals → pipeline security → SAST/secrets → DAST → IaC → containers → runtime/supply chain → findings/governance → capstone. Ethics gates: stranger org pipeline scans, sabotage recipes, unauthorized prod deploy, merge check bypass, malicious image/package guides — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live repo — labeled. Defender breakpoint: where repo scope discipline prevented out-of-scope pipeline action.
1. Path stations
Setup, fundamentals, pipeline, SAST/secrets, DAST, IaC, containers, runtime/supply, findings, handoff — ten minimum stations.
Each station links evidence index row and module lesson ID.
Command guide
Try these commands — Path stations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Gitleaks — https://gitleaks.io/ Bridgecrew Checkov — https://www.checkov.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/ OWASP ZAP — https://www.zaproxy.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
echo '=== Capstone path: concepts → secrets → IaC → container → CI → DAST → SBOM → findings ==='
grep -E 'FAKE|gitleaks' "$DEVSEC_REPO/.env.example" "$DEVSEC_LAB/notes/gitleaks-named.txt"
grep -E 'MISCONFIG|checkov' "$DEVSEC_IAC/main.tf" "$DEVSEC_LAB/notes/checkov-named.txt"
grep -E 'trivy|Dockerfile' "$DEVSEC_CONTAINER/Dockerfile" "$DEVSEC_REPO/.github/workflows/security.yml"
curl -sS https://gitleaks.io/ | head -3
curl -sS https://www.checkov.io/ | head -3
curl -sS https://aquasecurity.github.io/trivy/ | head -3Primary tools to practice this lesson: curl, grep. Reference sites: Gitleaks (https://gitleaks.io/); Bridgecrew Checkov (https://www.checkov.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/); OWASP ZAP (https://www.zaproxy.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics overlay
Red stops: stranger org scans, sabotage recipes, unauthorized prod deploy, merge bypass, malicious packages.
Repo scope branch always green start — `$DEVSEC_LAB` on separate labeled branch.
3. Integrity breakpoint
Mark where scope check prevented out-of-repo scan or prod access.
One paragraph uplift from YOUR `$DEVSEC_LAB` path.
4. What you ship: lab path diagram
DevSec chain with ethics gates + UTC milestones — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Lab path includes stranger org pipeline sabotage shortcut lane.
Right
Lab path documented for $DEVSEC_LAB. Next: Evidence Pack.
Mission: lab path diagram
1) Map ten stations. 2) Add six ethics gates. 3) UTC milestones per station. 4) Link evidence index IDs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger org scan shortcut OK on path.
True or False
Knowledge Check
APPLY: Path ends at:
Multiple choice