DevSecOps Pipeline

A security-integrated CI/CD pipeline — SAST, DAST, SCA, custom rules, policy gates, and vulnerability management — built around Tasklane, a multi-tenant project-management tool that serves as its target application.

Warning

Tasklane is a security testing target. Run it locally or in an ephemeral, access-restricted environment, and never expose it to a public network. Seed it with synthetic data only.

Layout

Path	Contents
frontend/	Next.js (TypeScript) client
backend/	FastAPI (Python) service
infra/	Terraform infrastructure definitions
security/	Custom scanner rules, policies and configuration

Running

The two services run independently.

Development

cd frontend && npm ci && npm run dev

cd backend && uv sync && uv run fastapi dev

Production build

cd frontend && npm ci && npm run build && npm run start

cd backend && uv sync && uv run fastapi run

Containers

cd frontend && docker build -t tasklane-frontend .
docker run --rm -p 3000:3000 tasklane-frontend

cd backend && docker build -t tasklane-backend .
docker run --rm -p 8000:8000 tasklane-backend

Both images run as a non-root user and carry no build toolchain.

The client serves on http://localhost:3000 and the API on http://localhost:8000, with its OpenAPI schema at /openapi.json.

Pre-commit hooks

Gitleaks, ruff, and ESLint run locally before anything reaches CI.

uv tool install pre-commit
pre-commit install

The ESLint hook runs the frontend's own npm run lint, so cd frontend && npm ci first if you haven't already. To run every hook against the full repo instead of just staged files:

pre-commit run --all-files