DevSecOps › Module 1 › Lesson 2
Your Repos Only
Your repos only means YOUR authorized Git repositories and lab apps under $DEVSEC_LAB — labeled courseware targets, self-authored repo inventory — document repo scope in notes before any scanner run.
Visual · t36_your_repos_only
Repo scope. $DEVSEC_LAB only. Original Cyberlium.
Opening
The repo owner is part of scope — Cyberlium refuses SAST, secrets, or DAST runs against stranger org codebases or apps you do not have authorization to test.
Your DevSec lab repos are Git remotes YOU operate — cyberlium-lab-app, cyberlium-lab-api, labeled courseware sample repos on example.local deploy targets. Scanners run on $DEVSEC_LAB only — never copied from live breach dumps or aimed at stranger cloud subscriptions. Cyberlium maps allowed repo inventory on YOUR $DEVSEC_LAB — repo name, default branch, lab app URL, fictional org label — never 'borrowed' employer production repos or scraped stranger GitHub orgs. Next: No Stranger Pipelines.
1. Allowed repo surfaces (named)
Self-authored lab repos with fictional org names. Courseware DevSec packs with explicit training labels. Isolated lab deploy URLs on example.local or localhost. Workflow files in YOUR GitHub fork or personal org only.
On $DEVSEC_LAB, list repo inventory row — repo name, default branch, lab app URL, fictional org label — never paste stranger org URLs from public lists.
Command guide
Try these commands — Allowed repo surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Gitleaks — https://gitleaks.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t36-devsec/notes" "$HOME/cyberlium-lab/t36-devsec/sample-repo" "$HOME/cyberlium-lab/t36-devsec/sample-repo/.github/workflows" "$HOME/cyberlium-lab/t36-devsec/iac" "$HOME/cyberlium-lab/t36-devsec/container" "$HOME/cyberlium-lab/t36-devsec/dast" "$HOME/cyberlium-lab/t36-devsec/sbom" "$HOME/cyberlium-lab/t36-devsec/findings" cat > "$HOME/cyberlium-lab/t36-devsec/lab.env" <<'EOF' export DEVSEC_LAB=$HOME/cyberlium-lab/t36-devsec export DEVSEC_REPO=$HOME/cyberlium-lab/t36-devsec/sample-repo export DEVSEC_IAC=$HOME/cyberlium-lab/t36-devsec/iac export DEVSEC_CONTAINER=$HOME/cyberlium-lab/t36-devsec/container export DEVSEC_DAST=$HOME/cyberlium-lab/t36-devsec/dast export DEVSEC_SBOM=$HOME/cyberlium-lab/t36-devsec/sbom EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t36-devsec/lab.env" grep -E 'DEVSEC_' "$HOME/cyberlium-lab/t36-devsec/lab.env" curl -sS https://aquasecurity.github.io/trivy/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks (https://gitleaks.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why repo scope matters before scanners
SAST, secrets, and DAST tools are powerful on any codebase or URL. Scope is what keeps practice legal and ethical. Employer production repos, stranger GitHub orgs, and third-party live sites are out of scope.
If you cannot answer 'who owns this repo and is it labeled lab-only?', pause and fix scope notes before running the scanner.
3. Repo inventory habit
Forbidden: importing stranger org repos because they 'look like training.' Allowed: repo inventory row — name, branch, lab URL, source = $DEVSEC_LAB self-authored.
Ship: repo inventory row for three fictional lab repos. Next: No Stranger Pipelines.
4. What you ship: repo inventory row for $DEVSEC_LAB
Three fictional lab repos with URL labels. $DEVSEC_LAB named. NEVER stranger org repos. chmod 600.
5. What you record before the next lesson
Date. Repo inventory row. $DEVSEC_LAB named. File t36-m01-l02-your-repos-only.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Clone stranger org repo because lab repos are boring. Skip repo label because 'it's just a scan.'
Right
Write repo inventory row for YOUR $DEVSEC_LAB. Next: No Stranger Pipelines.
Mission: document YOUR repo inventory
1) Write three fictional lab repos. 2) Label each as lab-only with deploy URL. 3) Confirm zero stranger org repos. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Repo inventory exists for scope — use it instead of stranger org clones.
Knowledge Check
APPLY: Your repos only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Scanners on $DEVSEC_LAB use YOUR repos with explicit lab labels.
True or False
Knowledge Check
APPLY: Before running SAST or DAST you should:
Multiple choice