# OWASP/DevSecOpsGuideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

Repository: https://github.com/OWASP/DevSecOpsGuideline
Canonical: https://ross.abutalabs.com/products/devsecopsguideline
Homepage: https://owasp.org/www-project-devsecops-guideline/
Language: Python
License: NOASSERTION
License Family: other
Topics: devsecops, owasp, shift-left, security
Last push: 2026-07-11T16:46:23+00:00

## Health v2 (maintenance only)
Score: 74/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 92, release rhythm 35, longevity 100
- inputs: {"age_days": 2301, "days_push": 53, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1098, forks 262 (observed 2026-08-28T04:03:34.957480+00:00)

## What it is
An OWASP project providing a guideline for embedding security into DevOps/CI-CD pipelines, covering practices like SAST, DAST, SCA, IaC scanning, and supply-chain security. It is primarily documentation and best-practice guidance rather than a runnable tool.

## Use cases
- how to add security scanning to my CI/CD pipeline
- shift-left security best practices
- what is SAST vs DAST vs SCA
- scan terraform and helm charts for misconfigurations
- prevent credentials leaking in git repositories
- software supply chain security with SBOM and artifact signing
- secure devops pipeline checklist
- compliance checks in the development pipeline

## When to choose
- designing or improving a secure CI/CD pipeline
- introducing shift-left security culture in an engineering team
- selecting tools for SAST, DAST, SCA, or IaC scanning
- training developers on DevSecOps practices

## When to avoid
- you need a runnable scanner or tool rather than guidance
- you need runtime security enforcement rather than documentation
- you need OWASP Top 10 application controls specifically (see Proactive Controls)

## Facets
- artifact type: learning-resource
- maturity: active
- function: security, developer-tools, documentation, ci-cd
- domain: security, developer-tools, documentation
- platform: cross-platform, cli
- tags: devsecops, shift-left, owasp, sast, dast, sca, iac-scanning, supply-chain-security, guideline, devops, docker

## Member repositories
- OWASP/DevSecOpsGuideline (main) score 74

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:34.957480+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:46:13.093780+00:00, confidence not recorded.
  - readme: https://github.com/OWASP/DevSecOpsGuideline (fetched 2026-08-28T04:03:34.957480+00:00, sha 771ecc7dee86)
  - homepage: https://owasp.org/www-project-devsecops-guideline/ (fetched 2026-08-29T12:49:42.731515+00:00, sha aca8435eec21)
  - site_page: https://owasp.org/about (fetched 2026-08-29T12:49:42.776286+00:00, sha b21a48297b2d)
- Data as of 2026-08-30T08:39:29.467469+00:00.