DevSecOps › Module 1 › Lesson 3
No Stranger Pipelines
No stranger pipelines means refuse scanning stranger orgs, tampering with CI/CD you do not own, and unauthorized secrets harvesting — write the refusal habit into YOUR $DEVSEC_LAB ethics card.
Visual · t36_no_stranger_pipelines
Stranger-pipeline refusal. $DEVSEC_LAB only. Original Cyberlium.
Opening
Stranger GitHub orgs, third-party production URLs, and unauthorized workflow tampering — all stop outside YOUR repo scope. Literacy names the risk; scanners stay on code you own.
Unauthorized DevSec actions include running SAST against stranger org repos without legal authorization, pointing ZAP at third-party production sites, exfiltrating secrets from pipelines you do not operate, and modifying stranger workflow files without contract. Org scope follows ownership: employer pipelines require written authorization — stranger orgs stay off limits. Cyberlium practices refusal sentences on YOUR $DEVSEC_LAB — 'I practice DevSecOps on MY repos and name risks for pipeline context' — never copy workflows that aim scanners at orgs you do not operate. Next: Lab Setup.
1. Stranger pipeline patterns refused (named, literacy only)
Stranger-org scanning: pointing SAST or secrets tools at GitHub orgs you do not own — named for literacy, NOT executed on Cyberlium. Third-party URL DAST: running ZAP against production sites without contract — defender fix is lab URL exercises, not student replication.
On $DEVSEC_LAB, write three refusal triggers — e.g., stranger-org scan request, third-party production URL DAST, unauthorized workflow tampering.
Command guide
Try these commands — Stranger pipeline patterns refused (named, literacy only)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Gitleaks — https://gitleaks.io/ OWASP ZAP — https://www.zaproxy.org/ CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/no-stranger-scans.txt" <<'EOF'
SCOPE: YOUR lab folder $HOME/cyberlium-lab/t36-devsec/ — sample repo, stubs, localhost only
NEVER: scanning stranger GitHub orgs or repos without authorization
NEVER: dumping real secrets; committing live API keys, passwords, or tokens
NEVER: DAST against stranger sites, production apps, or unauthorized hosts
ALLOWED: FAKE .env.example labeled FAKE; gitleaks on YOUR tree; checkov on YOUR main.tf
ALLOWED: trivy fs/image on YOUR Dockerfile; ZAP baseline on YOUR 127.0.0.1:PORT only
ALLOWED: security.yml CI stub; SBOM checklist markdown; curl public tool docs
PURPOSE: DevSecOps literacy — secure YOUR lab artifacts — not offensive recon
EOFCommand — copy this
grep -E 'SCOPE|NEVER|ALLOWED' "$DEVSEC_LAB/notes/no-stranger-scans.txt"
python3 -c "print('Ethics: stranger scans = legal/ops risk — YOUR lab repo + localhost only')"Primary tools to practice this lesson: grep, python3. Reference sites: Gitleaks (https://gitleaks.io/); OWASP ZAP (https://www.zaproxy.org/); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why refusal protects you and others
Unauthorized scanning violates laws, platform terms, and employer policy — skill without scope is career and legal risk. Victim harm: scanning stranger repos or tampering with pipelines hurts real people and services you must not enable.
Defenders exercise through authorized change control, repo ownership, and org-owned lab pipelines — students practice naming these channels for DevSec notes on lab scenarios only.
3. Ethics card habit
Forbidden: sharing stranger-org scan tutorials in class chat, importing live credential dumps, tampering with unauthorized workflow files. Allowed: ethics card — allowed repo sources, NEVER list, refusal sentence you will say aloud.
Ship: DevSec ethics card with NEVER list and one refusal sentence. Next: Lab Setup.
4. What you ship: DevSec ethics card for $DEVSEC_LAB
Allowed repo sources, NEVER list, refusal sentence. $DEVSEC_LAB named. NO stranger pipelines. chmod 600.
5. What you record before the next lesson
Date. Ethics card. $DEVSEC_LAB named. File t36-m01-l03-no-stranger-pipelines.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Follow stranger-org scan tutorial 'for DevSec practice.' Share live credential dump in Discord.
Right
Write DevSec ethics card for YOUR $DEVSEC_LAB. Next: Lab Setup.
Mission: write YOUR stranger-pipeline refusal habit
1) List three NEVER targets (stranger-org scans, third-party URL DAST, unauthorized workflow tampering). 2) Write one refusal sentence for unauthorized scan requests. 3) Name allowed $DEVSEC_LAB repo sources. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Name risks for pipeline context — never replicate scans against orgs you do not own.
Knowledge Check
APPLY: No stranger pipelines on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Scanners are taught on YOUR repos only — not stranger orgs.
True or False
Knowledge Check
APPLY: Discord link to stranger-org scan guide — you:
Multiple choice