So what I'm going to do is I'm going to create a basic dev sec ops pipeline.
I'm going to leverage GitHub actions to actually do the build and the test.
And then it's going to fail because I'm going to do something stupid, like hard
code, a security password directly in the code and then run the test to
actually break it saying, wait, you've detected a password directly in your
code.
So to do this, we're going to use GitHub. So I'm going to create a new empty WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to do this, we're going to use GitHub. So I'm going to create a new empty
GitHub repository.
I'll call this score dev sec ops or something basic like this.
And I'll say the description, which is optional dev sec ops example pipeline
with security flaws.
We'll leave this public so anyone who wants to can follow along and I'll go
ahead and I'll create this repository.
Now, I have to do some things to get my local computer synced up with this
GitHub repository. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
GitHub repository.
So on my local computer, I'm going to move into my code folder, which is where
I keep all of my projects, and I'm going to make a new directory.
We'll call this dev sec ops, something like that.
Now I'm going to move into dev sec ops.
And if I type ls, we see nothing is in there right now.
So I can initialize this whole repository by basically copying this whole block
right here, and then pasting it in all as one command. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here, and then pasting it in all as one command.
Now it uses in my case, SSH keys from one password to authenticate to GitHub.
In your case, it'll probably just work because that's how, you know, the basic
environment doesn't worry about SSH keys.
So now that I've got this up and running, if I jump back here and refresh, we
should see now it has a read me file in place.
Great.
So what I'm going to do here in this folder is I'm going to open my code editor
, which it's 2025.
We use cursor now. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We use cursor now.
So I'll say cursor dot and that opens cursor in this folder.
So I'll press enter here and it launches it right here.
And I notice right here, I am in the dev sec ops folder.
So there's some things that I need to do in order to turn this into my project.
The first thing I'm going to do is I am going to create my new application.
This is going to be a basic Python file. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is going to be a basic Python file.
I'll call it app.
Oh, got to click up in here.
Let's try to get new file.
There we go app dot py.
So now that I've got app dot py brought up here on the screen.
Oh, jump back to cursor.
I'm just going to paste in my block of code.
You can see it's very basic.
We're hard coding a password called hard coded password and our function
returns that password to whatever calls it.
This is the big problem.
Obviously hard coding a secret is never okay. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Obviously hard coding a secret is never okay.
So how do we detect this?
Python has a library called bandit.
You don't need to know this for the exam, but you should know that every
programming language has security libraries that you can run against your code
that detects security flaws.
This is what bandit does.
We say bandit inspect this file and find security flaws and bandit will find WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We say bandit inspect this file and find security flaws and bandit will find
this hard coded password and fail my DevOps pipeline.
So that's the idea.
So with this right here, we've now got a application, even if it's the world's
most basic application, that has a security flaw.
So now what I need to do is I need to tell GitHub, hey, you're going to run a
Python application and you need to install bandit and check the bandit results WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Python application and you need to install bandit and check the bandit results
against this application when you go to run the pipeline.
So to do this over here on the right hand side, we create a new folder called
dot get hub.
Then inside that folder, we create a new folder called workflows.
This is where we define our CI CD pipelines.
Then lastly, we put any YAML file in here and automatically GitHub is going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then lastly, we put any YAML file in here and automatically GitHub is going to
look for YAML files in that folder and perform whatever actions we tell it to.
So I'll call this bandit test dot YAML.
I'm going to go ahead and paste in my code here like this and you'll be able to
see exactly what this does.
We give it a name called bandit security scan.
Whenever we push new code into this repository, in particular on the main
branch, or whenever there's a pull request that's targeting the main branch, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
branch, or whenever there's a pull request that's targeting the main branch,
these jobs will run.
The jobs name, we give it an arbitrary name like bandit scan, and we say this
is going to run on the latest VM of Ubuntu.
So when you run, make sure you're deploying, we're telling GitHub to run this
on a new Ubuntu VM.
It'll copy the code.
It'll make sure it has Python version three dot 10 installed in it.
And then it'll make sure it installs bandit in it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then it'll make sure it installs bandit in it.
Finally, it runs the bandit command.
R means look in recursive folders or sub directories.
LL means only look for high level security problems.
I don't want to be alerted on small problems.
I only want to know medium or high severity.
And II means really only tell me if you're of a very high confidence that these
detected problems are big time problems.
At this point, whenever I push this new code into the main branch, GitHub will WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
At this point, whenever I push this new code into the main branch, GitHub will
automatically kick off the CI CD pipeline, and then we'll be able to see the
results if it passed or failed this bandit run.
So at this point, I'm going to stop.
And in the next video, we'll explore what happens when I actually make the push
.