1import{c as r,d as c,o as g,x as m,q as l,e as t,k as n,l as s,s as y,i,aw as v,ax as f,_ as h}from"./BUueJ4M7.js";import{_ as w}from"./Cqm8k-8h.js";import{A as o}from"./M4XEKhX0.js";import{R as b}from"./Dtg79qcY.js";import{C as a}from"./_alz4jpP.js";import{C as S}from"./DlmBrGKe.js";import{S as C}from"./oAGPGJs9.js";import{R as k}from"./DNWIKF1u.js";import{I as T}from"./CSQHPslD.js";import{L as I}from"./DJdp9J0Z.js";import{F as A}from"./Di02N3lL.js";import{Z as u}from"./Cq9hXB6I.js";import{D}from"./CyHPHH1T.js";import{G as P}from"./CormAwfV.js";import{C as z}from"./p8_mUy_J.js";import{G as x}from"./B2ytpO__.js";import{E as M}from"./NMAOueVw.js";import"./Bp92JTvC.js";import"./D0Bsq4j1.js";import"./IG94cuJ-.js";import"./BoTVjilV.js";import"./D76j_-LL.js";import"./BBc00AJ1.js";import"./CiddWC9K.js";const B=r("BarChart3Icon",[["path",{d:"M3 3v18h18",key:"1s2lah"}],["path",{d:"M18 17V9",key:"2bz60n"}],["path",{d:"M13 17V5",key:"1frdt8"}],["path",{d:"M8 17v-3",key:"17ska0"}]]);const R=r("BellIcon",[["path",{d:"M6 8a6 6 0 0 1 12 0c0 7 3 9 3 9H3s3-2 3-9",key:"1qo2s2"}],["path",{d:"M10.3 21a1.94 1.94 0 0 0 3.4 0",key:"qgo35s"}]]);const L=r("BoxesIcon",[["path",{d:"M2.97 12.92A2 2 0 0 0 2 14.63v3.24a2 2 0 0 0 .97 1.71l3 1.8a2 2 0 0 0 2.06 0L12 19v-5.5l-5-3-4.03 2.42Z",key:"lc1i9w"}],["path",{d:"m7 16.5-4.74-2.85",key:"1o9zyk"}],["path",{d:"m7 16.5 5-3",key:"va8pkn"}],["path",{d:"M7 16.5v5.17",key:"jnp8gn"}],["path",{d:"M12 13.5V19l3.97 2.38a2 2 0 0 0 2.06 0l3-1.8a2 2 0 0 0 .97-1.71v-3.24a2 2 0 0 0-.97-1.71L17 10.5l-5 3Z",key:"8zsnat"}],["path",{d:"m17 16.5-5-3",key:"8arw3v"}],["path",{d:"m17 16.5 4.74-2.85",key:"8rfmw"}],["path",{d:"M17 16.5v5.17",key:"k6z78m"}],["path",{d:"M7.97 4.42A2 2 0 0 0 7 6.13v4.37l5 3 5-3V6.13a2 2 0 0 0-.97-1.71l-3-1.8a2 2 0 0 0-2.06 0l-3 1.8Z",key:"1xygjf"}],["path",{d:"M12 8 7.26 5.15",key:"1vbdud"}],["path",{d:"m12 8 4.74-2.85",key:"3rx089"}],["path",{d:"M12 13.5V8",key:"1io7kd"}]]);const q=r("TestTubeIcon",[["path",{d:"M14.5 2v17.5c0 1.4-1.1 2.5-2.5 2.5h0c-1.4 0-2.5-1.1-2.5-2.5V2",key:"187lwq"}],["path",{d:"M8.5 2h7",key:"csnxdl"}],["path",{d:"M14.5 16h-5",key:"1ox875"}]]),E={class:"comparison-visual"},F={class:"comparison-item traditional"},G={class:"timeline"},H={class:"timeline-arrow"},N={class:"timeline-arrow"},V={class:"timeline-arrow"},j={class:"comparison-item modern"},O={class:"timeline"},W={class:"timeline-arrow"},Y={class:"timeline-arrow"},$={class:"timeline-loop"},U={class:"benefit-list"},Z={class:"benefit-item"},K={class:"benefit-item"},X={class:"benefit-item"},J={class:"benefit-item"},Q={class:"pipeline-diagram"},_={class:"pipeline-stage"},tt={class:"stage-header"},et={class:"pipeline-arrow"},st={class:"pipeline-stage"},it={class:"stage-header"},nt={class:"pipeline-arrow"},ot={class:"pipeline-stage"},lt={class:"stage-header"},at={class:"pipeline-arrow"},rt={class:"pipeline-stage highlighted"},dt={class:"stage-header"},ut={class:"pipeline-arrow"},pt={class:"pipeline-stage"},ct={class:"stage-header"},gt={class:"callout-box"},mt={class:"callout-icon"},yt={class:"tips-grid"},vt={class:"tip-card"},ft={class:"tip-icon"},ht={class:"tip-card"},wt={class:"tip-icon"},bt={class:"tip-card"},St={class:"tip-icon"},Ct={class:"tip-card"},kt={class:"tip-icon"},Tt={class:"tip-card"},It={class:"tip-icon"},At={class:"tip-card"},Dt={class:"tip-icon"},Pt={class:"feature-grid"},zt={class:"feature-card"},xt={class:"feature-icon"},Mt={class:"feature-card"},Bt={class:"feature-icon"},Rt={class:"feature-card"},Lt={class:"feature-icon"},qt={class:"feature-card"},Et={class:"feature-icon"},Ft={class:"integration-flow"},Gt={class:"flow-steps"},Ht={class:"flow-arrow"},Nt={class:"flow-arrow"},Vt={class:"flow-arrow"},jt={class:"flow-arrow"},Ot={class:"cta-section"},Wt={class:"cta-buttons"},Yt=c({__name:"CiCdSecurityIntegration",setup($t){const p={title:"CI/CD Security Integration: Adding Penetration Testing to Your Pipeline",slug:"cicd-security-integration",featuredImage:"/images/blog/blog-cicd-security-integration.jpg",excerpt:"Learn how to integrate penetration testing and security scanning into your CI/CD pipeline. Practical patterns, sample configurations, and performance optimization tips.",publishDate:"2025-01-21",keywords:"CI/CD security testing, DevSecOps penetration testing, security pipeline integration, shift-left security, GitHub Actions security, GitLab CI security, automated security testing, DAST CI/CD",faqs:[{question:"What is shift-left security?",answer:"Shift-left security means moving security testing earlier in the development lifecycle, integrating it into CI/CD pipelines rather than waiting until the end. This catches vulnerabilities when they are cheaper and faster to fix, reducing security debt and deployment delays."},{question:"How do I add security testing to my CI/CD pipeline?",answer:"Start with SAST (static analysis) on every commit, add depen
1dency scanning for known CVEs, implement DAST (dynamic testing) on staging deployments, and trigger penetration testing on major releases. Use security gates that block deployments with critical findings."},{question:"Will security testing slow down my pipeline?",answer:"It can if not implemented correctly. Optimize by: running fast tests (SAST, dependency scanning) on every commit, running slower tests (DAST, pentesting) asynchronously or on nightly builds, caching results, and using incremental scanning that only tests changed code."},{question:"What is the difference between SAST and DAST?",answer:"SAST (Static Application Security Testing) analyzes source code without running the application, finding issues like SQL injection patterns and hardcoded secrets. DAST (Dynamic Application Security Testing) tests the running application like an attacker would, finding runtime issues like authentication flaws and misconfigurations."}],category:{name:"DevSecOps",slug:"devsecops",color:"#8b5cf6"},readTime:12,howTo:{name:"How to Add Penetration Testing to Your CI/CD Pipeline",description:"Step-by-step guide to integrating security testing into your continuous integration and deployment workflow.",totalTime:"PT2H",steps:[{name:"Set up SAST scanning",text:"Add Static Application Security Testing to your build stage to catch code-level vulnerabilities before deployment."},{name:"Configure DAST in staging",text:"Deploy Dynamic Application Security Testing against your staging environment to find runtime vulnerabilities."}
1,{name:"Add dependency scanning",text:"Integrate Software Composition Analysis (SCA) to detect vulnerable third-party libraries."},{name:"Implement security gates",text:"Configure pipeline gates that block deployments when critical vulnerabilities are detected."},{name:"Set up continuous pentesting",text:"Integrate API-triggered penetration testing for comprehensive security validation on each release."}]},tocHeaders:[{id:"why-shift-left",text:"Why Shift-Left Security Matters",level:2},{id:"where-testing-fits",text:"Where Security Testing Fits in CI/CD",level:2},{id:"integration-patterns",text:"CI/CD Security Integration Patterns",level:2},{id:"performance-considerations",text:"Performance Considerations",level:2},{id:"sample-configurations",text:"Sample Pipeline Configurations",level:2},{id:"manticore-integration",text:"ManticoreAI CI/CD Integration",level:2},{id:"conclusion",text:"Building a DevSecOps Culture",level:2},{id:"get-started",text:"Add Penetration Testing to Your Pipeline",level:2}]};return(Ut,e)=>{const d=y;return g(),m(w,v(f(p)),{default:l(()=>[e[65]||(e[65]=t("p",{class:"intro"}," Your team deploys 50 times a day. Your security team runs penetration tests once a year. The math doesn't work. By the time your annual pentest completes, you've shipped thousands of changesâany of which could have introduced vulnerabilities. ",-1)),e[66]||(e[66]=t("p",null,[t("strong",null,"Shift-left security"),n(" means integrating security testing into your development pipeline, catching issues before they reach production. This guide shows you how to add penetration testing to your CI/CD workflow. ")],-1)),e[67]||(e[67]=t("hr",null,null,-1)),e[68]||(e[68]=t("h2",{id:"why-shift-left"},"Why Shift-Left Security Matters",-1)),t("p",null,[e[1]||(e[1]=n(" The ",-1)),s(d,{to:"/blog/why-traditional-pentests-take-long"},{default:l(()=>[...e[0]||(e[0]=[n("traditional security model",-1)])]),_:1}),e[2]||(e[2]=n(" treats penetration testing as a gate at the end of developmentâtest once before release, fix issues, ship. This made sense when software shipped quarterly. It doesn't work when you deploy continuously. ",-1))]),t("div",E,[t("div",F,[e[7]||(e[7]=t("h3",null,"Traditional Model",-1)),t("div",G,[e[3]||(e[3]=t("div",{class:"timeline-item"},"Develop (6 months)",-1)),t("div",H,[s(i(o),{size:16})]),e[4]||(e[4]=t("div",{class:"timeline-item"},"Pentest (4 weeks)",-1)),t("div",N,[s(i(o),{size:16})]),e[5]||(e[5]=t("div",{class:"timeline-item"},"Fix (2 weeks)",-1)),t("div",V,[s(i(o),{size:16})]),e[6]||(e[6]=t("div",{class:"timeline-item"},"Ship",-1))]),e[8]||(e[8]=t("p",{class:"comparison-note"},"Security feedback arrives months after code was written",-1))]),t("div",j,[e[13]||(e[13]=t("h3",null,"Shift-Left Model",-1)),t("div",O,[e[10]||(e[10]=t("div",{class:"timeline-item"},"Develop",-1)),t("div",W,[s(i(o),{size:16})]),e[11]||(e[11]=t("div",{class:"timeline-item"},"Test",-1)),t("div",Y,[s(i(o),{size:16})]),e[12]||(e[12]=t("div",{class:"timeline-item"},"Ship",-1)),t("div",$,[s(i(b),{size:16}),e[9]||(e[9]=t("span",null,"Continuous",-1))])]),e[14]||(e[14]=t("p",{class:"comparison-note"},"Security feedback within hours of code commit",-1))])]),e[69]||(e[69]=t("p",null,"The benefits of shift-left security testing:",-1)),t("div",U,[t("div",Z,[s(i(a),{size:20}),e[15]||(e[15]=t("div",null,[t("strong",null,"Faster Feedback"),t("span",null,"Developers learn about vulnerabilities while the code is fresh in mind")],-1))]),t("div",K,[s(i(a),{size:20}),e[16]||(e[16]=t("div",null,[t("strong",null,"Cheaper Fixes"),t("span",null,"Fixing issues in development costs 10-100x less than fixing them in production")],-1))]),t("div",X,[s(i(a),{size:20}),e[17]||(e[17]=t("div",null,[t("strong",null,"Reduced Risk"),t("span",null,"Vulnerabilities caught before they reach production can't be exploited")],-1))]),t("div",J,[s(i(a),{size:20}),e[18]||(e[18]=t("div",null,[t("strong",null,"Better Culture"),t("span",null,"Security becomes part of development, not an afterthought")],-1))])]),e[70]||(e[70]=t("hr",null,null,-1)),e[71]||(e[71]=t("h2",{id:"where-testing-fits"},"Where Security Testing Fits in CI/CD",-1)),e[72]||(e[72]=t("p",null," Different types of security testing belong at different stages of your pipeline. Here's a typical integration architecture: ",-1)),t("div",Q,[t("div",_,[t("div",tt,[s(i(S),{size:20}),e[19]||(e[19]=t("span",null,"Commit",-1))]),e[20]||(e[20]=t("div",{class:"stage-tests"},[t("span",{class:"test-type"},"Secret Scanning"),t("span",{class:"test-type"},"SAST (Static Analysis)"),t("span",{class:"test-type"},"Dependency Check")],-1)),e[21]||(e[21]=t("div",{class:"stage-time"},"< 5 minutes",-1))]),t("div",et,[s(i(o),{size:20})]),t("div",st,[t("div",it,[s(i(L),{size:20}),e[22]||(e[22]=t("span",null,"Build",-1))]),e[23]||(e[23]=t("div",{class:"stage-tests"},[t("span",{class:"test-type"},"Container Scanning"),t("span",{class:"test-type"},"IaC Analysis")],-1)),e[24]||(e[24]=t("div",{class:"stage-time"},"5-15 minutes",-1))]),t("div",nt,[s(i(o),{size:20})]),t("div",ot,[t("div",lt,[s(i(q),{size:20}),e[25]||(e[25]=t("span",null,"Test",-1))]),e[26]||(e[26]=t("div",{class:"stage-tests"},[t("span",{class:"test-type"},"DAST (Dynamic Analysis)"),t("span",{class:"test-type"}
1,"API Security Testing")],-1)),e[27]||(e[27]=t("div",{class:"stage-time"},"15-30 minutes",-1))]),t("div",at,[s(i(o),{size:20})]),t("div",rt,[t("div",dt,[s(i(C),{size:20}),e[28]||(e[28]=t("span",null,"Security Gate",-1))]),e[29]||(e[29]=t("div",{class:"stage-tests"},[t("span",{class:"test-type highlighted"},"Penetration Testing"),t("span",{class:"test-type"},"Compliance Validation")],-1)),e[30]||(e[30]=t("div",{class:"stage-time"},"Hours-Days",-1))]),t("div",ut,[s(i(o),{size:20})]),t("div",pt,[t("div",ct,[s(i(k),{size:20}),e[31]||(e[31]=t("span",null,"Deploy",-1))]),e[32]||(e[32]=t("div",{class:"stage-tests"},[t("span",{class:"test-type"},"Runtime Protection"),t("span",{class:"test-type"},"Continuous Monitoring")],-1)),e[33]||(e[33]=t("div",{class:"stage-time"},"Ongoing",-1))])]),t("div",gt,[t("div",mt,[s(i(T),{size:24})]),e[34]||(e[34]=t("div",{class:"callout-content"},[t("h3",null,"Penetration Testing in CI/CD"),t("p",null,"Full penetration testing is typically too slow for every commit. Instead, run it on merge to main, before major releases, or on a scheduled basis against staging environments. Automated security testing (SAST/DAST) provides continuous coverage.")],-1))]),e[73]||(e[73]=t("hr",null,null,-1)),e[74]||(e[74]=t("h2",{id:"integration-patterns"},"CI/CD Security Integration Patterns",-1)),e[75]||(e[75]=t("p",null," There are several patterns for integrating security testing into your pipeline. The right choice depends on your deployment frequency and risk tolerance: ",-1)),e[76]||(e[76]=t("div",{class:"pattern-cards"},[t("div",{class:"pattern-card"},[t("div",{class:"pattern-header"},[t("h3",null,"Gate Pattern"),t("span",{class:"pattern-badge blocking"},"Blocking")]),t("p",null,"Security tests run as a required gate. Pipeline fails if critical/high issues found."),t("div",{class:"pattern-pros-cons"},[t("div",{class:"pros"},[t("strong",null,"Pros:"),n(" No vulnerable code deploys ")]),t("div",{class:"cons"},[t("strong",null,"Cons:"),n(" Can block deployments; requires fast tests ")])]),t("div",{class:"pattern-use-case"},[t("strong",null,"Best for:"),n(" Production deployments, regulated environments ")])]),t("div",{class:"pattern-card"},[t("div",{class:"pattern-header"},[t("h3",null,"Async Pattern"),t("span",{class:"pattern-badge non-blocking"},"Non-Blocking")]),t("p",null,"Security tests run in parallel. Results reported but don't block deployment."),t("div",{class:"pattern-pros-cons"},[t("div",{class:"pros"},[t("strong",null,"Pros:"),n(" Doesn't slow deployment; allows fast iteration ")]),t("div",{class:"cons"},[t("strong",null,"Cons:"),n(" Vulnerable code may deploy before results arrive ")])]),t("div",{class:"pattern-use-case"},[t("strong",null,"Best for:"),n(" Development environments, feature branches ")])]),t("div",{class:"pattern-card"},[t("div",{class:"pattern-header"},[t("h3",null,"Scheduled Pattern"),t("span",{class:"pattern-badge scheduled"},"Scheduled")]),t("p",null,"Full security testing runs on a schedule (nightly, weekly) against deployed environments."),t("div",{class:"pattern-pros-cons"},[t("div",{class:"pros"},[t("strong",null,"Pros:"),n(" Comprehensive testing; no pipeline impact ")]),t("div",{class:"cons"},[t("strong",null,"Cons:"),n(" Delayed feedback; issues may be in production ")])]),t("div",{class:"pattern-use-case"},[t("strong",null,"Best for:"),n(" Full penetration testing, complex test suites ")])]),t("div",{class:"pattern-card"},[t("div",{class:"pattern-header"},[t("h3",null,"Hybrid Pattern"),t("span",{class:"pattern-badge hybrid"},"Recommended")]),t("p",null,"Fast scans gate deployments; comprehensive testing runs async or scheduled."),t("div",{class:"pattern-pros-cons"},[t("div",{class:"pros"},[t("strong",null,"Pros:"),n(" Balances speed and coverage ")]),t("div",{class:"cons"},[t("strong",null,"Cons:"),n(" More complex to configure ")])]),t("div",{class:"pattern-use-case"},[t("strong",null,"Best for:"),n(" Most production environments ")])])],-1)),e[77]||(e[77]=t("hr",null,null,-1)),e[78]||(e[78]=t("h2",{id:"performance-considerations"},"Performance Considerations",-1)),e[79]||(e[79]=t("p",null," Adding security testing to CI/CD introduces latency. Here's how to minimize impact without sacrificing security: ",-1)),t("div",yt,[t("div",vt,[t("div",ft,[s(i(I),{size:24})]),e[35]||(e[35]=t("h3",null,"Parallelize Testing",-1)),e[36]||(e[36]=t("p",null,"Run security scans in parallel with functional tests rather than sequentially. Most CI systems support parallel job execution.",-1))]),t("div",ht,[t("div",wt,[s(i(A),{size:24})]),e[37]||(e[37]=t("h3",null,"Incremental Scanning",-1)),e[38]||(e[38]=t("p",null,"Only scan changed files/components rather than the entire codebase. SAST tools often support this mode.",-1))]),t("div",bt,[t("div",St,[s(i(u),{size:24})]),e[39]||(e[39]=t("h3",null,"Tiered Testing",-1)),e[40]||(e[40]=t("p",null,"Fast scans on every commit; comprehensive scans on merge to main. Match test depth to code change significance.",-1))]),t("div",Ct,[t("div",kt,[s(i(D),{size:24})]),e[41]||(e[41]=t("h3",null,"Cache Results",-1)),e[42]||(e[42]=t("p",null,"Cache dependency vulnerability data and baseline scan results. Only re-scan when input
1s change.",-1))]),t("div",Tt,[t("div",It,[s(i(P),{size:24})]),e[43]||(e[43]=t("h3",null,"Smart Triggers",-1)),e[44]||(e[44]=t("p",null,"Trigger deep testing only when security-relevant code changes (auth, payments, data handling).",-1))]),t("div",At,[t("div",Dt,[s(i(z),{size:24})]),e[45]||(e[45]=t("h3",null,"Timeout Policies",-1)),e[46]||(e[46]=t("p",null,"Set reasonable timeouts for security tests. A hanging scan shouldn't block deployments indefinitely.",-1))])]),e[80]||(e[80]=t("hr",null,null,-1)),e[81]||(e[81]=t("h2",{id:"sample-configurations"},"Sample Pipeline Configurations",-1)),e[82]||(e[82]=t("p",null," Here are example configurations for common CI/CD platforms: ",-1)),e[83]||(e[83]=t("div",{class:"config-tabs"},[t("div",{class:"config-section"},[t("h3",null,"GitHub Actions"),t("div",{class:"code-block"},[t("pre",null,[t("code",null,`name: Security Pipeline 2 3on: 4 push: 5 branches: [main] 6 pull_request: 7 branches: [main] 8 9jobs: 10 security-scan: 11 runs-on: ubuntu-latest 12 steps: 13 - uses: actions/checkout@v4 14 15 - name: SAST Scan 16 uses: github/codeql-action/analyze@v3 17 18 - name: Dependency Check 19 run: npm audit --audit-level=high 20 21 - name: Container Scan 22 uses: aquasecurity/trivy-action@master 23 with: 24 image-ref: '\${{ env.IMAGE_NAME }}' 25 26 pentest-trigger: 27 needs: security-scan 28 if: github.ref == 'refs/heads/main' 29 runs-on: ubuntu-latest 30 steps: 31 - name: Trigger Penetration Test 32 run: | 33 curl -X POST "$PENTEST_API_URL" \\ 34 -H "Authorization: Bearer $PENTEST_API_KEY" \\ 35 -d '{"target": "$STAGING_URL"}'`)])])]),t("div",{class:"config-section"},[t("h3",null,"GitLab CI"),t("div",{class:"code-block"},[t("pre",null,[t("code",null,`stages: 36 - build 37 - test 38 - security 39 - deploy 40 41sast: 42 stage: security 43 image: registry.gitlab.com/security-products/sast 44 script: 45 - /analyzer run 46 47dependency_scanning: 48 stage: security 49 image: registry.gitlab.com/security-products/dependency-scanning 50 script: 51 - /analyzer run 52 53pentest: 54 stage: security 55 only: 56 - main 57 script: 58 - | 59 curl -X POST "$PENTEST_API_URL" \\ 60 -H "Authorization: Bearer $PENTEST_API_KEY" \\ 61 -d '{"target": "$STAGING_URL"}'`)])])])],-1)),e[84]||(e[84]=t("hr",null,null,-1)),e[85]||(e[85]=t("h2",{id:"manticore-integration"},"ManticoreAI CI/CD Integration",-1)),e[86]||(e[86]=t("p",null," ManticoreAI provides native CI/CD integration through our lightweight SDK and API, enabling you to add penetration testing to your pipeline: ",-1)),t("div",Pt,[t("div",zt,[t("div",xt,[s(i(u),{size:28})]),e[47]||(e[47]=t("h3",null,"48-Hour Results",-1)),e[48]||(e[48]=t("p",null,"Full penetration tests complete in 48 hoursâfast enough for release cycle testing, not just annual audits.",-1))]),t("div",Mt,[t("div",Bt,[s(i(x),{size:28})]),e[49]||(e[49]=t("h3",null,"API-First Design",-1)),e[50]||(e[50]=t("p",null,"Trigger tests, retrieve results, and manage findings programmatically. Designed for automation from day one.",-1))]),t("div",Rt,[t("div",Lt,[s(i(R),{size:28})]),e[51]||(e[51]=t("h3",null,"Webhook Notifications",-1)),e[52]||(e[52]=t("p",null,"Get notified when tests complete or critical findings are discovered. Integrate with Slack, PagerDuty, or custom endpoints.",-1))]),t("div",qt,[t("div",Et,[s(i(B),{size:28})]),e[53]||(e[53]=t("h3",null,"Trend Analysis",-1)),e[54]||(e[54]=t("p",null,"Track security posture over time. See which releases introduced issues and measure remediation velocity.",-1))])]),t("div",Ft,[e[60]||(e[60]=t("h3",null,"Integration Workflow",-1)),t("div",Gt,[e[55]||(e[55]=t("div",{class:"flow-step"},[t("span",{class:"flow-num"},"1"),t("span",{class:"flow-text"},"PR merged to main")],-1)),t("div",Ht,[s(i(o),{size:16})]),e[56]||(e[56]=t("div",{class:"flow-step"},[t("span",{class:"flow-num"},"2"),t("span",{class:"flow-text"},"Deploy to staging")],-1)),t("div",Nt,[s(i(o),{size:16})]),e[57]||(e[57]=t("div",{class:"flow-step"},[t("span",{class:"flow-num"},"3"),t("span",{class:"flow-text"},"API triggers ManticoreAI")],-1)),t("div",Vt,[s(i(o),{size:16})]),e[58]||(e[58]=t("div",{class:"flow-step"},[t("span",{class:"flow-num"},"4"),t("span",{class:"flow-text"},"Results in 48h")],-1)),t("div",jt,[s(i(o),{size:16})]),e[59]||(e[59]=t("div",{class:"flow-step"},[t("span",{class:"flow-num"},"5"),t("span",{class:"flow-text"}
61,"Findings â Jira")],-1))])]),e[87]||(e[87]=t("hr",null,null,-1)),e[88]||(e[88]=t("h2",{id:"conclusion"},"Building a DevSecOps Culture",-1)),e[89]||(e[89]=t("p",null," Integrating security into CI/CD is a technical challenge, but success ultimately depends on culture: ",-1)),e[90]||(e[90]=t("ul",null,[t("li",null,[t("strong",null,"Start small"),n("âadd one security check and iterate. Don't try to implement everything at once.")]),t("li",null,[t("strong",null,"Make it fast"),n("âif security tests slow down deployments, developers will work around them.")]),t("li",null,[t("strong",null,"Prioritize ruthlessly"),n("âblock on critical issues only. Advisory warnings for medium/low.")]),t("li",null,[t("strong",null,"Measure and improve"),n("âtrack mean time to remediation, not just issue counts.")]),t("li",null,[t("strong",null,"Celebrate wins"),n("âwhen security catches issues pre-production, that's success.")])],-1)),e[91]||(e[91]=t("p",null," The goal isn't perfect securityâit's continuous improvement. Each vulnerability caught before production is a win. Each developer who learns to think about security is a force multiplier. ",-1)),t("div",Ot,[e[63]||(e[63]=t("h2",{id:"get-started"},"Add Penetration Testing to Your Pipeline",-1)),e[64]||(e[64]=t("p",null,"ManticoreAI integrates with your CI/CD workflow to provide continuous security validation. See how fast, accurate penetration testing fits your development cycle.",-1)),t("div",Wt,[s(d,{to:"/contact?source=cicd-security-integration",class:"cta-primary"},{default:l(()=>[e[61]||(e[61]=n(" Book a Demo ",-1)),s(i(o),{size:18})]),_:1}),s(d,{to:"/blog/what-is-ptaas",class:"cta-secondary"},{default:l(()=>[e[62]||(e[62]=n(" Learn About PTaaS ",-1)),s(i(M),{size:16})]),_:1})])])]),_:1},16)}}}),he=h(Yt,[["__scopeId","data-v-13231d44"]]);export{he as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.