TL;DR — the essentials
- DevSecOps = automated security at every commit/build/release, without blocking the roadmap.
- Stack 2026: Semgrep (SAST), Snyk Open Source (SCA), Trivy (image scan), gitleaks (secrets), Checkov (IaC), Sigstore (signing).
- Mandatory quality gates: no secret in clear, no critical CVE in direct dependency, no high SAST vulnerability without exception, no container image with critical CVE.
- Target metrics: <3% PR blocked, MTTR critical vulnerability <7 days, 100% secrets stored in vault.
- Articulation with CRA: CRA requires SBOM, secure CI/CD, automated patching capability.
The 2026 typical stack
Static Application Security Testing (SAST)
Semgrep (Returntocorp) has become the SAST of reference in 2026 for modern SaaS: high-performance, multi-language, customizable rules in YAML. More accessible than CodeQL, more performant than Snyk Code on specific patterns.
Alternatives: SonarQube (mature, broad coverage), Snyk Code (advanced SAST, AI-augmented), CodeQL (GitHub, deep analysis).
Software Composition Analysis (SCA)
Snyk Open Source or Dependabot (GitHub native) for direct dependencies. Renovate for granular control of updates.
Critical: prioritize CVEs by exploitability (EPSS score) and not just by CVSS. Most CVEs are not exploited; focus on the 10% that are.
Container image scanning
Trivy (Aqua Security) or Grype (Anchore) for OCI image scanning. Integrated in CI/CD, blocking on critical CVEs without dérogation.
Best practice: distroless or minimal base images, signed by Sigstore cosign at build, verified at deployment.
Secret detection
gitleaks in pre-commit hook + scan history regularly. truffleHog for finer detection (entropy-based).
If a secret has been committed: rotate immediately, audit access, document the incident. Don't just delete the commit — Git history is keeping it.
Infrastructure as Code (IaC) scanning
Checkov (Bridgecrew/Palo Alto) or TFSec for Terraform, CloudFormation, Kubernetes manifests. Catches misconfigurations before deployment.
SBOM — Software Bill of Materials
An SBOM lists all components of your application: name, version, supplier, license, hash, transitive dependencies. Two standards: SPDX (ISO/IEC 5962:2021) and CycloneDX (OWASP).
The Cyber Resilience Act (CRA) makes the SBOM mandatory for "important" and "critical" products from December 11, 2027. SBOM must be: automatic, up-to-date at every build, machine-readable, traceable, signed.
Tools: Syft (Anchore) for container images, cdxgen for source code, Maven plugin CycloneDX for Java, @cyclonedx/cyclonedx-npm for Node.
Supply chain — signing and provenance
Sigstore is the CNCF project for cryptographic signing of software artifacts (containers, binaries, SBOM) without persistent key management. Components: cosign (CLI), Fulcio (CA), Rekor (transparency log).
Adopted by Kubernetes, PyPI, npm, Linux Foundation. Aligned with SLSA Level 2+ and CRA requirements. Setup: 1-2 days for full integration.
Quality gates — what to block in CI/CD
Four mandatory blocking gates:
- No secret in clear text in commit (gitleaks).
- No critical CVE in direct dependency (Snyk).
- No high SAST vulnerability without traceable dérogation (Semgrep).
- No container image with critical CVE (Trivy).
The rest in warning mode. Findings tracked in Jira/Linear, dérogations traced with expiration date.
Target metrics for a serious SaaS in 2026
- MTTR critical vulnerability: < 7 days
- PR blocked by quality gates: < 3%
- Secrets stored in vault: 100%
- SBOM generated automatically: 100% of builds
- Container images signed: 100% of releases
- Test coverage >: 80%