SecOps Baseline for CI/CD Pipelines
A triage checklist and starter script to find common CI/CD pipeline risks before the next release.
SecOps checklist for CI/CD in SMBs
The baseline covers controls that appear early in any AppSec journey: dependencies, secrets, containers, IaC and auditable evidence.
Vulnerable dependencies
Sets a failure criterion for high and critical CVEs before publishing artifacts.
Secrets in repositories
Adds gitleaks triage to reduce token and key leakage.
Logs for audits
Turns scans into traceable artifacts for AppSec and compliance.
What the SecOps baseline checks
Supply chain
SCA, lockfiles, critical packages and risk signals in the build flow.
Secrets and credentials
Finds tokens, keys and credentials before they enter a release.
Containers and filesystem
Flags high and critical issues in images, project files and local dependencies.
IaC and permissions
Creates a path to review Terraform, Kubernetes and sensitive permissions.
AppSec evidence
Guides storage of SARIF, JSON and logs for OWASP SAMM, ISO 27001 and audits.
Next control
Shows where the pipeline needs ongoing consulting with ownership and metrics.
How to use the script in CI/CD
Start as a non-blocking job for a few cycles. Then tune severity, exceptions and ownership per service.
#!/usr/bin/env bash
# Okami SecOps Baseline — github.com/OkamiOps/secops-baseline
set -uo pipefail
npm audit --audit-level=high # 1. SCA
gitleaks detect --no-banner \
--report-format sarif \
--report-path secops-evidence/secrets.sarif # 2. secrets
trivy fs --severity HIGH,CRITICAL --exit-code 1 . # 3. containers/fs
trivy config --severity HIGH,CRITICAL --exit-code 1 . # 4. IaC
semgrep scan --config auto --sarif \
--output secops-evidence/semgrep.sarif # 5. SAST + evidenceWhen to call the consulting team
If the baseline becomes noise, recurring risk appears or nobody owns remediation, the problem is no longer tooling. It is AppSec maturity, Secure SDLC and OWASP SAMM.