DevSecOps › Module 1 › Lesson 4
Lab — Setup
Pack DevSec scope, repo inventory, and ethics card — lab setup file only, dest $DEVSEC_LAB.
Visual · t36_lab_setup
Lab: write DevSec setup pack. $DEVSEC_LAB only. Original Cyberlium.
Opening
Lab setup before DevSec exercises — scope paperwork pipeline mentors expect.
Lessons 1–3 defined why DevSecOps matters, your repos only, and stranger-pipeline refusal. This lab ships the combined artifact: topic scope paragraph, repo inventory row, and ethics card for $DEVSEC_LAB under $HOME/cyberlium-lab/t36-devsec/. No stranger-org scans or third-party URL work required — scope and repo paperwork first. Next: Quiz — DevSec Mindset and Lab.
1. Lab contract: write the setup pack
Create $HOME/cyberlium-lab/t36-m01-l04-lab-setup.txt with date, operator, $DEVSEC_LAB placeholder, literacy vs unauthorized scanning paragraph, repo inventory row, and ethics card.
Optional: one-line proof your t36-devsec folder exists — still no stranger-org scan or third-party URL work required in this lab.
Command guide
Try these commands — Lab contract: write the setup pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Bridgecrew Checkov — https://www.checkov.io/ NIST SSDF — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/roe.txt" <<'EOF'
DEVSEC_LAB=$HOME/cyberlium-lab/t36-devsec
targets: YOUR sample-repo, YOUR iac/, YOUR container/, YOUR localhost DAST
never: scanning stranger GitHub orgs; dumping real secrets; DAST stranger sites
never: probe unauthorized infrastructure; exfiltrate findings from third parties
allowed: FAKE .env.example; gitleaks detect on YOUR tree; checkov on YOUR main.tf
allowed: trivy fs/image on YOUR Dockerfile; ZAP baseline 127.0.0.1 only; SBOM checklist
allowed: .github/workflows/security.yml stub with gitleaks/checkov/trivy steps
output: scan reports, findings backlog, CI stub in lab folder
EOFCommand — copy this
chmod 600 "$DEVSEC_LAB/roe.txt" grep -E 'DEVSEC_LAB|never|allowed|YOUR' "$DEVSEC_LAB/roe.txt" command -v gitleaks >/dev/null && gitleaks version || echo 'gitleaks optional — install for secret scan lab' command -v checkov >/dev/null && checkov --version || echo 'checkov optional — install for IaC lab' command -v trivy >/dev/null && trivy --version || echo 'trivy optional — install for container lab' ls -la "$DEVSEC_LAB/sample-repo" "$DEVSEC_LAB/iac" "$DEVSEC_LAB/container"
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t36-devsec/sample-repo, $HOME/cyberlium-lab/t36-devsec/iac
Primary tools to practice this lesson: grep, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Bridgecrew Checkov (https://www.checkov.io/); NIST SSDF (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'stranger-org scan,' third-party URL DAST steps, live credential dumps — redact or delete. Rewrite forum habits to $DEVSEC_LAB placeholders before you copy workflows.
Classmates build their own setup packs for their $DEVSEC_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then What is DevSecOps.
DevSec mentors archive lab setup before first pipeline exercise; you are practicing that habit early.
4. What you ship: DevSec lab setup pack for $DEVSEC_LAB
Setup pack: scope, repo row, ethics card. $DEVSEC_LAB named. NEVER stranger pipelines. chmod 600.
5. What you record before the next lesson
Date. Setup pack path. $DEVSEC_LAB scope note. File t36-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and import live credential dump. Add stranger-org scan to approved list.
Right
Write YOUR lab setup pack for $DEVSEC_LAB. chmod 600. Next: Quiz — DevSec Mindset and Lab.
Mission: freeze YOUR DevSec lab setup pack on disk
1) Merge scope, repo inventory, ethics sections. 2) Name $DEVSEC_LAB. 3) chmod 600. Never list stranger-org scans as approved practice.
Stuck? Ask Cyberlium AI Mentor
Setup packs are boring on purpose — boring keeps DevSec work defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on DevSec lab notes.
True or False
Knowledge Check
APPLY: A tutorial scans stranger orgs without scope. You:
Multiple choice