How praneeth-gande/devsecops-pipeline-demo works
This repository is a deliberately vulnerable Flask demo paired with a GitHub Actions security-scanning pipeline. A push starts the workflow, which scans the code and dependencies, applies a HIGH/CRITICAL dependency gate, uploads findings for GitHub code scanning, and generates an SBOM artifact. The app also demonstrates SQL injection, command injection, and debug-mode risks; its planted credentials and vulnerable dependency pins provide scan targets. Pipeline details are based on the README; the workflow source was not sampled, so internal step wiring is shown only where documented.
Main entry points: security-scan.yml Scan workflow · app.py Flask app · config.py Planted credentials · requirements.txt Pinned dependencies
Components 14
Demo application
- Flask app
app.py - Planted credentials
config.py - Pinned dependencies
requirements.txt
Security pipeline
- Scan workflow
.github/workflows/security-scan.yml - Gitleaks
- Semgrep
- Trivy
- Syft
- Severity gate
.github/workflows/security-scan.yml
Findings and inventory
- SARIF findings
- GitHub Security tab
- CycloneDX SBOM
- Workflow artifact
Other components
- Contributor
Connections 18
- Contributor → Scan workflow: pushes to
- Scan workflow → Gitleaks: runs scan
- Scan workflow → Semgrep: runs scan
- Scan workflow → Trivy: runs scan
- Scan workflow → Syft: generates SBOM
- Gitleaks → Planted credentials: scans
- Semgrep → Flask app: scans
- Trivy → Pinned dependencies: scans
- Trivy → Severity gate: reports severity
- Scan workflow → Severity gate: enforces
- Scan workflow → SARIF findings: uploads findings
- Gitleaks → SARIF findings: provides findings
- Semgrep → SARIF findings: provides findings
- Trivy → SARIF findings: provides findings
- SARIF findings → GitHub Security tab: appears in
- Syft → CycloneDX SBOM: produces
- Scan workflow → Workflow artifact: saves SBOM
- CycloneDX SBOM → Workflow artifact: stored as