D

devsecops

Toolchain image for the Coroboros security gates.

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

DevSecOps health check for GitLab Self-Managed instances.

Deterministic, format-preserving dependency remediation for GitLab CI — Maven first. A hundred eyes on your dependency graph.

The evidence line and the published CI/CD Catalog. Governed, reusable pipeline components every workload builds from.

Landing page for the Evidence Factory group. Start here for the guided walk through the six projects.

The driver. One tool that provisions the group, applies the NIST 800-53 framework, pushes control evidence, and exports OSCAL artifacts.

Skaledheim (SKM) is a modular platform designed to orchestrate distributed services inside a cohesive DevSecOps cluster oriented ecosystem.

The policy plane. Pipeline Execution Policy, security policies, and external compliance controls that assess and gate every consumer.

Consumer workload: a reusable CI/CD Catalog component. Adoption phase enforce, so an off-catalog include is blocked.

Consumer workload: a container image. Adoption phase cutover, so the regulatory baseline blocks an unsigned image.

Consumer workload: a Go binary. Adoption phase report, so conformance runs advisory and merge requests stay green.

Probably the most modern and sophisticated insecure web application!

Clone of OWASP Juice Shop with GitLab branding and more.

Learn more by seeing our DevSecOps Tutorial

Medium-interaction SSH/Telnet honeypot built with Cowrie, Loki, Promtail, and Grafana - provisioned on DigitalOcean via Terraform with a GitLab CI validation pipeline.

Cheatsheet / IT toolbox

AI-powered security orchestration for GitLab CI/CD. Automated vulnerability patching, threat modeling, and compliance scoring with GPT-4 and Claude AI agents.

Static security scanner for MCP and AI-agent configurations ? secrets, excessive permissions, unsafe shells and supply-chain risk.

D3FENDer is a security assessment and gap detection tool developed by Michael Favvas for his thesis titled "Development of a security assessment and gap detection system using the MITRE ATT&CK and D3FEND Frameworks". It uses a rule based system to grade an organization's defenses based on the input. It then detects possible gaps and suggests mitigations based on the MITRE ATT&CK and D3FEND Knowledge Bases. The tool can be used in SOC work flows.