Workshop: From Security-as-Afterthought to Security-as-Code — A Hands-On Lab

Event Overview

This half-day hands-on workshop, delivered by The SamurAI's DevSecOps engineering team, walks participants through implementing automated security controls in modern CI/CD pipelines. Participants will work through real-world scenarios using GitHub Actions, Terraform, and open-source security scanning tools.

Lab Exercises

1. Secrets Detection — Configure pre-commit hooks and CI checks that prevent credential leaks before they reach version control
2. Container Security — Build a pipeline stage that scans Docker images for vulnerabilities and blocks deployment of non-compliant images
3. Infrastructure-as-Code Policy — Write and enforce OPA/Rego policies that prevent common cloud misconfigurations in Terraform
4. SAST Integration — Add static analysis to pull request workflows with automated code review comments