Minimum Viable Security for Python Applications
summary
Minimum Viable Security installs five concrete CI/CD controls — Bandit for Python SAST, Gitleaks for secret scanning (including commit history), Python dependency SCA, IaC checks and ZAP for DAST — into a FastAPI repo via GitHub Actions. A demo pipeline runs seven checks on every PR, fails when it finds exposed secrets, SQL injection patterns and public buckets, and returns immediate remediation lines in the PR. Maintenance tradeoffs appear (tool choice can take ~three weeks) but orchestration reduces integration pain.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 0:51What is Minimum Viable Security
- 2:36Why security matters to developers
- 4:00Protecting your app like a house
- 6:52Demo setup and tools overview
- 9:21GitHub Actions and security checks
- 12:51Eight-point security plan
- 14:54Maintaining security tools
- 15:39Jit's role in security orchestration
- 16:23Q&A on GitHub Actions and shift left
- 17:48Trust in external tools and security
- 19:54Closing remarks and Q&A
related talks
33mMinimum Viable Security
30mMinimum Viable Security for Cloud Native Stacks
29mReducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle
34mSecure Python Development: Tips, Tricks, and Tools
39mSecurity Tooling in Your DevOps Pipeline
29mSecuring Your Web Application Pipeline From Intruders
44mSecurity Practices Useful in Agile Development
46mBuilding An AppSec Pipeline: Keeping Your Program, And Your Life, Sane