Published
Secure CI/CD Starter secure-cicd-starter Reusable GitHub Actions templates for building, scanning, signing, and releasing container services with security gates that engineers can copy into real repositories.
Shows practical shift-left delivery: secrets detection, SAST, IaC checks, SBOM generation, image scanning, and signed artifacts in one pipeline.
GitHub Actions Gitleaks Semgrep Checkov Trivy Syft Cosign
Project highlights
- Pull request annotations for security findings - SARIF uploads into GitHub code scanning - SBOM artifact attached to every release - Documented break-glass bypass with expiry Build steps
- Create reusable workflow files under .github/workflows/ - Add sample Docker app and Terraform module with known passing controls - Publish screenshots of successful and failed security gates - Write a clear technical README with architecture and tradeoffs Shows how the pipeline design turns scanner output into enforceable DevSecOps guardrails.
View on GitHub
Published
Terraform Azure Landing Zone Lite terraform-azure-landing-zone-lite Small Azure landing-zone foundation with networking, policy assignment, tagging, budgets, diagnostics wiring, and GitHub OIDC deployment guidance.
Demonstrates cloud platform engineering, secure-by-default infrastructure, and governance-as-code for regulated teams.
Terraform Azure Azure Policy TFLint Checkov GitHub OIDC
Project highlights
- Terraform formatting and validation in CI - TFLint and Checkov static analysis - Module examples for dev, test, and prod - Security decision records for each baseline control Build steps
- Reusable modules for resource groups, networking, diagnostics, and policy assignments - Dev, test, and prod examples with safe tfvars templates - GitHub Actions validation for fmt, validate, TFLint, and Checkov - OIDC guidance that avoids static Azure credentials in CI Combines cloud foundation controls, reusable infrastructure, and developer-facing deployment guidance.
View on GitHub
Published
Kubernetes Security Baseline kubernetes-security-baseline Deployable Kubernetes hardening baseline with secure Helm defaults, default-deny networking, least-privilege RBAC, Gatekeeper admission controls, policy tests, and configuration scanning.
Combines preventive admission controls, hardened workload configuration, automated security testing, and documented runtime response.
Kubernetes Helm OPA Gatekeeper Conftest Trivy kind GitHub Actions
Project highlights
- Policy tests for privileged pods and unsafe capabilities - NetworkPolicy examples with allowed and denied flows - Helm chart lint and template validation in CI - Runtime detection runbook for suspicious container behavior Build steps
- Create a local kind-based demo cluster path - Add Gatekeeper constraints for pod security and image provenance - Ship secure and insecure sample workloads to validate the gates - Add diagrams for request flow, policy flow, and alert flow Connects pipeline controls with platform security, admission policy, and production Kubernetes operations.
View on GitHub
Published
AI Security Guardrails Lab ai-security-guardrails-lab Model-independent security service that evaluates untrusted prompts, authorizes tool calls by role, redacts sensitive output, and records privacy-preserving audit events.
Adds a deterministic enforcement layer around AI workflows with adversarial evaluation, explicit tool boundaries, and incident-ready telemetry.
Python HTTP API Policy as Code OWASP LLM Top 10 GitHub Actions Azure AI Foundry pattern
Project highlights
- Twelve adversarial cases with a deterministic pass/fail report - Role-based tool authorization and a global high-risk denylist - Sensitive-output redaction and hashed audit records - Unit and live HTTP API tests in GitHub Actions Build steps
- Configurable TOML policies for prompt and tool controls - Dependency-light Python API and command-line interface - Threat model and Azure AI Foundry integration guidance - Unsafe AI response playbook and CI evaluation gate Applies cloud-security fundamentals such as identity, least privilege, data protection, testing, observability, and response to AI-enabled services.
View on GitHub
Published
SonarQube + Trivy DevSecOps Lab sonarqube-trivy-devsecops-lab Hands-on lab that builds a Java or Node service, runs code quality and security checks, scans the container image, and publishes findings.
Turns tutorial-style DevSecOps learning into your own working lab with screenshots, pipeline logs, and clear remediation notes.
Jenkins SonarQube Trivy Docker Maven or Node GitHub
Project highlights
- Pipeline screenshots for build, quality gate, and security scan - Before-and-after remediation commit history - Documented false-positive handling - Docker Compose lab setup for local reproduction Build steps
- Create docker-compose.yml for Jenkins and SonarQube - Add a sample app with intentional low-risk findings - Write Jenkinsfile stages for build, unit test, SonarQube, Trivy, and publish - Capture results in README and link from the portfolio page Makes your GitHub activity visible through CI, scanning, and troubleshooting proof.
View on GitHub
Published
Cloud Cost Governance Bot cloud-cost-governance-bot Python automation that reviews cloud inventory exports, flags cost and governance drift, and opens actionable GitHub issues.
Combines FinOps, governance, automation, and security hygiene in a repeatable cloud-control workflow.
Python GitHub Actions Azure Cost Management AWS Cost Explorer Markdown reports
Project highlights
- Sample CSV inventory input with anonymised data - Generated governance report - GitHub issue creation dry-run mode - Unit tests around tagging and budget rules Build steps
- Define cost and tag policy rules in YAML - Parse sample Azure and AWS export files locally - Generate a markdown report for pull requests - Add dry-run GitHub issue creation for drift items Shows the business side of platform engineering: controls, cost, and automation that leaders care about.
View on GitHub
Published
Cloud Incident Response Runbooks cloud-incident-response-runbooks Operational runbooks and small automation scripts for leaked secret response, exposed storage, suspicious IAM changes, and vulnerable image rollout.
Documents incident ownership, communication, containment, recovery, and safe automation for common cloud scenarios.
Bash Python AWS CLI Azure CLI GitHub Actions Markdown
Project highlights
- Runbooks with severity, owner, detection, containment, and recovery sections - CLI scripts with dry-run defaults - Post-incident review template - Mapping to common controls such as least privilege and logging Build steps
- Write four runbooks from realistic but anonymised scenarios - Add scripts that validate access before changing anything - Create tabletop exercise checklist - Publish a blog post linking each runbook to platform controls Combines preventive cloud controls with repeatable detection, containment, recovery, and follow-up procedures.
View on GitHub