D

devsecops

Enterprise DevSecOps CI/CD Pipeline enforcing Bandit SAST, non-root Docker builds, Trivy container CVE scans, and OPA/Rego compliance gates (NIST SP 800-53 & FedRAMP).

Landing page, ten scenarios, claims ledger and a posture mirror an assessor can check without an account. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 6: a CI component at enforce phase. A planted off-catalog include stays red: the gate stops it. Guide: https://evidence-factory.gitlab.io/guide/

DevSecOps health check for GitLab Self-Managed instances.

Deterministic, format-preserving dependency remediation for GitLab CI — Maven first. A hundred eyes on your dependency graph.

Shared CI/CD components for the Mandrel Project: commit linting, security scanning, tests, semantic versioning, and artifact publishing for Go services, Go modules, and specification bundles.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

Skaledheim (SKM) is a modular platform designed to orchestrate distributed services inside a cohesive DevSecOps cluster oriented ecosystem.

Production-style DevSecOps platform on AWS: STIG-hardened RKE2 Kubernetes on RHEL 9, built from code with Terraform, Ansible and Puppet. GitLab CI scan gates, Harbor, GitOps with Argo CD, Keycloak SSO and air-gapped delivery. One command builds it, one tears it down.

Chapter 4: a Go binary at report phase. Gaps are published and advisory, so the merge request stays green. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 3: the driver. One tool provisions the group, assesses controls, pushes verdicts and exports OSCAL. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 5: a container image at cutover phase. A planted unsigned-image gap stays red: the floor blocks it. Guide: https://evidence-factory.gitlab.io/guide/

VibeSecOps: the methodology Foxx Cyber uses to ship software written with AI coding agents. Rulebook, agent boundaries, machine-enforced gates, evidence, accepted-risk registers and POA&Ms, plus levels to score your own repository. Not vibe coding.

Gitons is a GitLab Duo merge-safety control plane. It evaluates every merge request using change risk, security findings, test evidence, and release policy, then posts a 0–100 score with a clear action: advance, require approval, or stop

WITNESS — evidence-first, read-only visibility for connected-home sources, and the post-code DevSecOps automation built around it for the GitLab Transcend Hackathon (Life After Code). An empty result and a failed request are not the same thing.

Attention as currency for GitHub repos: verified stars mint credits, credits buy feed highlights. Live at repoherald.com. Ten-stage GitLab pipeline, eight Duo review rules written from real invariants, and an MCP client pointed at its own API.

Find release-order failures that green MR CI misses. GitLab Duo proposes falsifiable experiments; GitLab CI proves evidence-backed release waves.

Orin — autonomous DevSecOps engineer on the GitLab Duo Agent Platform: assign it an issue and it plans, implements, reviews, merges, deploys, and monitors with zero human touches. Built for the GitLab Transcend "Life After Code" hackathon.

Digital health check for small-business websites — built, secured, released, deployed and monitored by a GitLab Duo night shift with no human in the loop.