Secure coding

DevSecOps Tools of the trade

Nitesh Malviya
January 17, 2023 by
Nitesh Malviya

In the previous post, we walked through the different stages of the DevSecOps pipeline and looked at the security controls introduced at each stage, their necessity, and the security concerns they address.

The many tools used at various stages of the pipeline shown below will be covered in this post.

Below is the sample pipeline we referred to in the last post.

A diagram of a sample DevSecOps pipeline with descriptive boxes. From left to right: git, Secret Scanning, SCA, SAST, IAC Scanning, Container Scanning, DAST, Infra Scanning, Compliance Check/PaC, checkmark of completion

Let’s run through the various DevSecOps tools that we can use at different stages in the pipeline.

Learn Secure Coding

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

DevSecOps tool categories

A) Pre-push/pre-commit hooks

There have been numerous instances of sensitive information like passwords, AWS Keys, Access tokens and SSH keys getting leaked via public source code repositories due to git commits. This can be avoided by using pre-push or pre-commit hooks. This pre-push or pre-commit hook checks for sensitive information before any push or commit is made to the repository.

 The following tools can be used:

  1. Truffle Hog -
  2. Talisman -
  3. Git Hooks -
  4. Git Secrets -
  5. Pre-Commit -
  6. Git Hound -

B) Secret scanning

The following tools are widely used for scanning the secrets present in the code:

  1. GitLeaks -
  2. Whispers -
  3. Gittyleaks -
  4. Detect-Secrets -
  5. DSpectralops -

Apart from the above tools, a few of the tools mentioned in the pre-push or pre-commit hooks can also be used for scanning secrets in the repositories. 

C) Secret storage and management

To avoid leaking secrets from the repo, one can use the following tools for storing and managing the secrets.

  1. Hashicorp Vault -
  2. AWS Secrets Manager -
  3. Cloud KMS -
  4. Azure Key Vault -
  5. Confidant -
  6. Keywhiz -
  7. Knox -

D) Source composition analysis (SCA)

SCA identifies vulnerabilities in open-source software (OSS) being used by the application. The following tools are widely used:

  1. OWASP Dependency Check -
  2. SonaType -
  3. Snyk -
  4. Mend (Formerly WhiteSource) -  
  5. BlackDuck -
  6. Veracode -
  7. JFrog XRay -

E) Static analysis security testing (SAST)

SAST tools analyze and assist in the identification of vulnerabilities present in the source code.

Though many SAST tools are available, the most used are as follows:

  1. SonarQube -
  2. Semgrep -
  3. Snyk -
  4. CloudDefense -
  5. Fortify -
  7. Veracode -

If you are looking specifically for any programming language, this link serves as a good reference point:

F) Infrastructure as code (IaC) and container scanning

IaC and container scans are performed to avoid misconfiguration like unnecessarily exposing network interfaces, privilege escalation, compliance violation, and so on.

One can use the following tools for scanning:

  1. Checkov -
  2. Trivy and TFsec by aqua -
  3. TFLint and Terrafirma - Specifically for Terraform.
  4. Dockle and Dockscan - Specifically for Docker.
  5. Cloudsploit - For CloudFormation.

G) Dynamic application security testing (DAST)

The following are prominent tools for performing DAST scans.

  1. OWASP ZAP -
  2. Burpsuite -
  3. Acunetix -
  4. Qualys -
  5. Arachni -
  6. Nikto -

H) Infrastructure scanning

The following tools can be used for scanning the infrastructure.

  1. OpenVAS -
  2. Nessus -
  3. Qualys -

I) Compliance scanning

To clear regulations like PCI DSS, HIPAA etc., organizations can use the following tools:

  1. Inspec -
  2. Serverspec -
  3. DevSec Hardening Framework -
  4. Kitchen CI -

J) Vulnerability management

The following tools can be used to manage and track vulnerabilities discovered in the pipeline:

  1. ArcherySec -
  2. DefectDojo -  
  3. Qualys -
  4. Rapid7 insightVM -

Learn Secure Coding

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

DevSecOps Tools

We have gone through various tools one can use to integrate security into the DevOps pipeline. Some tools are open source, while others are paid; depending on the budget, environment and setup, selecting the right tool is paramount.



Nitesh Malviya
Nitesh Malviya

Nitesh Malviya is a Security Consultant. He has prior experience in Web Appsec, Mobile Appsec and VAPT. At present he works on IoT, Radio and Cloud Security and open to explore various domains of CyberSecurity. He can be reached on his personal blog - and Linkedin -