DevSecOps: Injecting Security into Android CI/CD Pipelines
summary
Shows how to inject automated security checks into an Android CI/CD pipeline using a Bitrise CI workflow that builds, runs static analysis, uploads the APK via curl to scanners, signs the APK and deploys to Play Store or Firebase. Demonstrates open source and commercial tools, notably MobSF and AppSweep, plus examples like DataTheorem and Oversecured, and live results: a scan finds 62 libraries and 3 critical issues and reports 7 OWASP violations, with build comparison and API-driven results that return cleanable findings.
AI-written summary · about
chapters (11)
- 0:00Introduction to DevSecOps
- 1:30Shift Left in Security
- 4:19DevSecOps in CI/CD
- 7:11Security in Mobile Apps
- 9:37Automated Security Testing
- 12:23Security Testing Tools
- 15:38Demo Open Source Tool
- 20:21Demo Third Party Tool
- 25:17Integrating Security in Pipeline
- 27:46Benefits of DevSecOps
- 28:50Security as a Journey
related talks
28mDevSecOps: Balancing development and security
59mSecurity as Code: A DevSecOps Approach
34mDevSecOps: Balancing development and security
42mContinuous Security: Integrate security tools into your DevOps Pipeline
37mA Secure Continuous Delivery Pipeline
29mSecuring Your Web Application Pipeline From Intruders
39mContinuous Security at the Next Level
45mDevSecOps : add Security to your DevOps!