Building AppSec for solo devs

I’m writing a book. Well, I’m building a course…with a lot of supplemental content, which…put it all together and it’s a basically book.

The course/book is a combination of Python tips, tricks, etc. I’ve learned writing automations over the past five years in AppSec. I’ve been at three different companies, each vastly different business demands—but their AppSec story was all the same. We have limited to no budget. We accidentally discovered we need AppSec. We don’t know what to buy. But there is a lot of data to analyze, more tools make it more complex, and we need organization and answers.

AppSec is a weird problem of software development, project management, and data analysis all wrapped into a hairball trying to “shift left” for some undefined reason.

What is it?

So, this course/book will cover a specific Python topics necessary for writing automations, some applied topics where Python can solve problems, and real projects—where I used Python to solve direct problem or curiosity in my job.

I’m excited to be writing it. It’s for the AppSec engineer who might not have the strongest software development background, but needs some helpful pointers for what to focus on.

Tangentially, I’m excited for it because I want to create a business. And this is my first real step in the direction of building a monetized product. The videos on YouTube and Tiktok, and the LinkedIn posts, are one thing…but I want something I can point to and say, “I built that.”

A note on AppSec

In writing ideas for this book, I’ve stumbled on another idea. They have a funny of way of compounding like that, don’t they?

I’m writing this book for the AppSec engineer who needs help, but…

In a similar vein, solo developers have a growing need for more security embedded in their development practices. What good are the impressive offerings from Checkmarx, Sonatype, GitHub, Snyk, and the like…if they all come with price tags outside a solopreneur’s budget? Developers have a multitude of options for development tools, web frameworks, languages, etc. but security tooling is disjointed, expensive, and (in my opinion) business first—not developer first.

A security pipeline

We need a roadmap (or at least an example) to create a security pipeline for solo developers. Something that can be run locally, and gives the developer as much control over it as they like.

Here is the security pipeline tech stack I’m starting with:

  • Version Control — GitLab
  • secrets-detection — GitLeaks, TruffleHog, KingFisher, or detect-secrets
  • SAST — Opengrep
  • DAST — DIY Selenium tests…DAST is flaky
  • SCA — Renovate (or updatecli or tidelift, or Google OSV Scanner)
  • Container Security — trivy + Docker DHI (optional: Chainguard)
  • Supply Chain — registries: Verdaccio (npm) + GitLab (Docker) + pypisever/devpi/PuLP (Python)
  • Vulnerability Management — Data pipeline project: Postgres + pgadmin + Grafana

This stack should be able to run on a basic machine with any modern 4-core CPU, 16GB RAM, and 256-512GB of storage depending what kind of log retention is desired.

This isn’t perfect. But it’s my attempt at creating a security pipeline. Eventually, I’d like to orchestrate this into an automated script (or small set of scripts) so it can be deployed with as little fuss as possible.

More to come soon.