Devsecops

Write OPA/Gatekeeper and Kyverno admission policies for Kubernetes security guardrails.

Detect secrets in code, git history, and running containers — pre-commit hooks, CI scanning, and incident response for exposed credentials.

Sign container images and artifacts with cosign (keyless via OIDC and key-based); verify signatures in CD pipelines and admission policies.

Generate, attach, and verify SBOMs (CycloneDX/SPDX) for container images; implement SLSA provenance; harden software supply chain.

Harden container images and Kubernetes workload security contexts — distroless, multi-stage, minimal attack surface.