Introduction

Objective:

To demonstrate the integration of vulnerability management into a DevSecOps pipeline.

Key Tools Used:

• AWS EC2 (Ubuntu, T2.medium) — hosting environment
• Docker & Docker Compose — containerization
• DefectDojo — vulnerability management platform
• OWASP Dependency-Check — dependency scanning
• GitHub Actions — CI/CD pipeline

Architecture Overview

High-Level Diagram

• Dev Team (pushes)→ GitHub Repo (Triggers)→ GitHub Actions Pipeline
• Pipeline runs OWASP Dependency-Check → Uploads results to DefectDojo → Security team evaluates findings

Workflow Summary:

1. Developer commits code to repository.
2. CI pipeline automatically triggers dependency scan.