D

devsecops

Probably the most modern and sophisticated insecure web application!

Clone of OWASP Juice Shop with GitLab branding and more.

Learn more by seeing our DevSecOps Tutorial

This project sets up Static Application Security Testing (SAST) in a GitLab CI/CD pipeline using two tools:

NJSScan → A security scanner specialized for JavaScript applications. It analyzes source code and flags insecure coding patterns and vulnerabilities.

Semgrep → A lightweight, multi-language static analysis tool that uses rulesets (such as p/javascript) to detect vulnerabilities, insecure practices, and style issues across different programming languages.

This project demonstrates how to integrate GitLeaks for secrets scanning into a GitLab CI pipeline, along with a Git pre-commit hook.

Damn Vulnerable NodeJS Application used as a POC for upcoming DevSecOps pipeline.