Training
Secure Development Training
Integrate security into the software development lifecycle: SAST, DAST, code review, DevSecOps and vulnerable dependency management.
Duration
8h
Level
Intermediate
Category
Training
Prerequisites
Software development experience (minimum 1 year) and basic knowledge of a CI/CD tool (GitLab CI, GitHub Actions, Jenkins).
What you will learn
- Integrate security practices from the design phase (Security by Design)
- Use SAST and DAST tools in a CI/CD pipeline
- Identify and fix OWASP Top 10 vulnerabilities in code review
- Manage vulnerable open-source dependencies with SCA (Software Composition Analysis)
- Implement a DevSecOps approach in an existing development team
Program
Security by Design and threat modeling
STRIDE, attack trees, threat modeling applied to REST API design.
Static code analysis (SAST)
Integrating SonarQube, Semgrep and Bandit into the CI pipeline — interpreting results and reducing false positives.
Dynamic security testing (DAST)
OWASP ZAP in automatic and manual mode, GitLab CI integration, report analysis.
SCA and dependency management
CVE detection in npm/pip/maven dependencies with Dependabot, Snyk and OWASP Dependency-Check.
Secrets, logs and errors
Preventing secret leaks in code (git-secrets, truffleHog), secure log management and error messages.
Who is this for?
Why on CyberAct?
Practical exercises are performed on real vulnerable applications deployed on VMs, not simulators. Each developer works on their own environment and can compare their fixed code against best practices recommended by CyberAct's AI.
Related content
Ready to train your teams?
Access the full CyberAct catalog on your dedicated platform.