What is security in DevOps?

Question

Accepted Answer

**DevSecOps** — security in DevOps.

```yaml
# GitHub Actions Security Scanning
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

# SAST (Static Application Security Testing)
    - name: Run Snyk
      uses: snyk/actions/node@master
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

# Container scanning
    - name: Scan Docker image
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: myapp:latest
        format: sarif
        output: trivy-results.sarif

# Secret scanning
    - name: Scan for secrets
      uses: trufflesecurity/trufflehog@main
      with:
        path: .

# License compliance
    - name: Check licenses
      run: npx license-checker --failOn "GPL-3.0"
```

**Tools:**
- Snyk: dependency vulnerabilities.
- Trivy: container scanning.
- TruffleHog: secrets.
- OWASP ZAP: DAST.
- SonarQube: code review.

DevOps: What is security in DevOps?