Shift-Left Security in CI/CD Pipelines — Julian Johannes Umbhau Jensen

Moved security checks from a pre-release gate to every pull request, without slowing teams down.

Context

As the DevOps engineer for an organization running 30+ repositories through GitHub Actions (with Prefect for scheduled/data workflows), there was little to no automated security or quality checking anywhere in the pipeline.

Problem

Vulnerabilities and misconfigurations were mostly discovered after the fact — via customer-reported issues — happening on a near-daily basis, with fixes landing far more expensively than if they’d been caught before merge.

Approach

Added tfsec/Checkov scanning on every Terraform PR, failing the build on high/critical findings
Integrated Trivy for container image scanning in the build stage, before images could be pushed to the registry
Introduced SAST scanning (e.g. Sonarcloud) on application code with a curated ruleset
Set up a triage process so findings had a clear owner and risk indicator

Tools

Trivy tfsec Semgrep GitHub Actions OPA/Gatekeeper

Outcome

Customer-reported issues dropped from a near-daily occurrence to roughly monthly. Security scanning was standardized across all production repositories, with immediate detection, automated issue creation, and automated fixes applied where possible.