medium.comwriteupAutomating Penetration Testing with SecureCodeBox on Kubernetes (Kind) + GitHub Actions
Walks through a GitHub Actions pipeline that spins up a kind cluster, deploys the SecureCodeBox operator, the Juice Shop target and the ZAP-Advanced scanner, then runs an authenticated full scan. Findings summaries are pulled from the Scan resource status and the full findings.json from MinIO, then compared with a baseline report committed to the repo to flag new, persistent or resolved categories. The pipeline fails the build when issues remain. It gives a reusable pattern for DAST regression tracking in CI.
TL;DR Tutorial: SecureCodeBox + ZAP-Advanced scan of Juice Shop on a kind cluster in GitHub Actions, with baseline regression comparison of findings.
Organisations named here
- SecureCodeBox
- ZAP-Advanced
Technologies named here
- SecureCodeBox
- Nmap
- nikto
- MinIO Client
- kubectl
- jq
- OWASP Zap
- GitHub Actions
- Kubernetes
- Helm
- MinIO
- Juice Shop
- kind
Related in DevSecOps
jfrog.comarticleJFrog: The Governance Gap Between Your Policy and Your Pipeline
stepsecurity.ioarticleDev Machine Guard Now Supports Windows - StepSecurity
socket.devwriteupSocket: TanStack npm Packages Compromised
securitylab.github.comadvisory