DevSecOps · threat, detect, defend
Understand the threat.
Then make it impossible.
Security checklists are forgettable; seeing your own AWS key come out of your own Docker image is not. Each of these labs starts from a real class of weakness in a setup you run yourself, shows the tool or alert that catches it, hardens the configuration side by side, and verifies the fix with the same checks.
Every lab, four phases
Threat
How the weakness is abused in the real world, what it exposes, and the incidents that made it famous.
Detect
The scanner, CI check, or runtime alert that would have caught it, and its real output.
Defend
The vulnerable config and the hardened one, side by side, with why each line matters.
Verify
Run the same scanners and checks again. A fix you haven't verified is a fix you're only hoping works.
Everything in this course targets a lab on your own machine or account. Using these techniques against systems you aren't authorised to test is illegal, and the course never asks you to.
Chapters
Secrets
CRITCRITHIGHHIGHThe most common way real systems get breached: a credential that ended up somewhere it shouldn't — git history, an image layer, a CI log — and was found by someone else first.
Supply Chain
CRITCRITHIGHHIGHMost of the code you ship, you didn't write. Four labs on securing everything between the package registry and the image your cluster runs.
Containers & Infrastructure
HIGHCRITMEDCRITWhere your code runs decides how bad a bug can get. Four labs on shrinking the blast radius of containers and catching insecure infrastructure before it's applied.
Pipeline & Runtime
CRITCRITCRITHIGHThe last four gaps: a CI trigger that hands secrets to strangers, injection bugs a scanner could have caught, a URL feature that reaches cloud credentials, and noticing an intruder inside a running container.