Reducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle
summary
Claims concrete fixes: a GitLab‑flavored CI/CD pipeline that adds secret detection, dependency scanning and SAST as gates and runs them in parallel; use git leaks to catch the ~10 million secrets leaked in 2023 and require revocation not just deletion; use pip audit to block vulnerable packages and note NVD growth ~25% Y/Y and studies finding ~70% of web apps have severe gaps; add Bandit for pattern-based SAST, consider DAST (OWASP ZAP or Burp tools) and self‑hosted runners for pipeline hardening.
AI-written summary · about
chapters (10)
- 0:00Welcome
- 1:04Security risks challenge
- 5:16Swiss cheese security model
- 6:22Secret detection with GitLeaks
- 12:06Dependency scanning with pip-audit
- 18:28Static analysis with Bandit
- 24:05Pipeline efficiency
- 24:45Dynamic analysis testing
- 25:28Human role in security
- 27:19Q&A
related talks
20mMinimum Viable Security for Python Applications
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
38mSecuring your CI/CD Pipeline
37mA Secure Continuous Delivery Pipeline
34mSecure Python Development: Tips, Tricks, and Tools
18mContinuous Security - Building Security into your Pipelines
29mSecuring Your Web Application Pipeline From Intruders- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines