Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
End to End: Security Gates, Exception Handling and Metrics in the Bookstore Pipeline
A quiet security pipeline runs only the checks a developer can fix within minutes on the PR and the deep checks on main; fixable critical and high findings fail, and the rest are tracked through exceptions with an owner and an expiry date. With real output we show Bookstore's single workflow, a gate that catches an expired exception, vulnerability age and MTTR, OpenSSF Scorecard and the mapping of the controls to the OWASP Top 10:2025.
Signing and Provenance: Sigstore, Artifact Attestations and SLSA v1.2
An image signature proves the content has not changed and who signed it, and provenance proves which repo, workflow and commit produced it; both only help if they are verified at deploy time. We verify keyless Sigstore signatures and GitHub attestations on real releases, bind an SBOM attestation to the Bookstore image, reject unsigned and tag-referenced images with Kyverno, and assess the pipeline against SLSA v1.2.
SBOM and VEX: Knowing What You Ship with CycloneDX 1.7 and SPDX 3
An SBOM is the machine-readable list of components in a release, and its real value is querying which version of which product is affected when a new CVE arrives, without building anything; VEX then states, with a justification, whether it is affected. For Bookstore we produce and verify .NET, Angular and image SBOMs, query them in Dependency-Track and apply OpenVEX and CycloneDX VEX with real output.
DAST: Scanning a Running Application with ZAP — Baseline, API Scan and Authenticated Scanning
DAST sends requests to the running application from outside and finds behavioral flaws such as headers, cookies, error leaks and reflected input; but it only scans the endpoints it can reach and cannot see authorization bugs. We scan Bookstore.Api with ZAP 2.17 using baseline, API scan and an Automation Framework plan, and show with real output how to catch a dropped session in a token-based scan, turn findings into integration tests and run DAST on main.
Container and IaC Scanning: Image Vulnerabilities, Base Image Choice and Manifest Scanning
Image scanning checks the operating system packages and the application dependencies of the artifact you actually deploy; most findings come from unused packages, and a chiseled, non-root base image removes most of them. With real output we show the Bookstore image dropping from 42 findings to 6, how Trivy and Grype differ, verifying the scanner with a SHA pin and a cosign signature after the March 2026 Trivy incident, and Dockerfile, Kubernetes and Terraform scanning.
SAST: Finding Vulnerabilities in Source Code with CodeQL, Semgrep and .NET Security Analyzers
SAST looks for paths where user input (a source) reaches a dangerous call (a sink) without a sanitizer; it only sees the sinks it models and cannot find business rule or authorization gaps. At Bookstore we run CodeQL, Semgrep and the .NET security analyzers against the same five problems and show with real output who found what, a tested Bookstore-specific Semgrep rule, false positive triage and a pipeline that fails only on new findings.
Dependency Scanning in Depth: NuGetAudit, npm audit, Dependabot and Prioritizing Findings
Sorting dependency findings by CVSS score is not enough: urgency is set by exploitation evidence in KEV, EPSS's 30-day exploitation probability and whether your code actually reaches the vulnerable function. At Bookstore we configure NuGetAudit at the repo level and show with real output how .NET 10 package pruning removes false positives, an expiring NuGetAuditSuppress, a triage tool that queries EPSS and KEV, and separating security from version updates in Dependabot.
Secret Scanning: Pre-commit, Push Protection and the First 30 Minutes After a Leak
Secret scanning is not one tool but layers: pre-commit on the developer machine, the PR commit range in the pipeline, push protection on GitHub and periodic scans of the whole history; after a leak the order is always rotate first, then impact analysis, and clean up history last. With real output we show why gitleaks 8.30's default rules missed two dev-prefixed secrets, Bookstore-specific rules, base64 detection and cleanup with git-filter-repo.
What Is DevSecOps? Putting Security Controls in the Right Place in the Pipeline
DevSecOps means putting each security control where the information it needs first appears in the pipeline and returning findings to the team that wrote the code right then: secrets at pre-commit, SAST and SCA in the PR, image scanning on main, DAST after deploy. We map the Bookstore pipeline before and after, show failing only on new findings with a Semgrep baseline using real output, and map the controls to NIST SSDF and OWASP DSOMM.