A security-integrated CI/CD pipeline — SAST, DAST, SCA, custom rules, policy gates, and vulnerability management — built around Tasklane, a multi-tenant project-management tool that serves as its target application.
Warning
Tasklane is a security testing target. Run it locally or in an ephemeral, access-restricted environment, and never expose it to a public network. Seed it with synthetic data only.
| Path | Contents |
|---|---|
frontend/ |
Next.js (TypeScript) client |
backend/ |
FastAPI (Python) service |
infra/ |
Terraform infrastructure definitions |
security/ |
Custom scanner rules, policies and configuration |
The two services run independently.
Development
cd frontend && npm ci && npm run devcd backend && uv sync && uv run fastapi devProduction build
cd frontend && npm ci && npm run build && npm run startcd backend && uv sync && uv run fastapi runContainers
cd frontend && docker build -t tasklane-frontend .
docker run --rm -p 3000:3000 tasklane-frontendcd backend && docker build -t tasklane-backend .
docker run --rm -p 8000:8000 tasklane-backendBoth images run as a non-root user and carry no build toolchain.
The client serves on http://localhost:3000 and the API on
http://localhost:8000, with its OpenAPI schema at /openapi.json.
Gitleaks, ruff, and ESLint run locally before anything reaches CI.
uv tool install pre-commit
pre-commit installThe ESLint hook runs the frontend's own npm run lint, so cd frontend && npm ci first if you haven't already. To run every hook against the full repo
instead of just staged files:
pre-commit run --all-files