InternshipAll 60 tasks, level by level
The real graded DevSecOps tasks the portal assigns, grouped into three levels.
The portal assigns these DevSecOps tasks. Finish Level 1 before Level 2 and Level 2 before Level 3. Your mentor may mark some tasks as required for the certificate.
Level 1: Foundations (24 tasks)
| Task | What to do |
|---|---|
| What DevSecOps means | Write a one-page explanation of shifting security left, with a diagram of where security checks fit in a CI/CD pipeline. |
| Secure your GitHub account | Turn on 2FA, review SSH keys and tokens, and enable branch protection on a repo named devsecops-internship. |
| Find secrets in code | Plant a fake API key in a test repo, detect it with gitleaks or trufflehog, remove it from history and explain why rotation is still needed. |
| Dependency scanning | Run npm audit or pip-audit on a sample project, list the vulnerabilities by severity and upgrade at least two. |
| Enable Dependabot | Turn on Dependabot alerts and version updates for your repo and merge one generated pull request. |
| Linux hardening basics | On a VM, create a non-root user, disable root SSH login, enable a firewall (ufw) and document each step. |
| HTTPS and certificates | Explain TLS, then inspect the certificate chain of three websites and record issuer, expiry and key type. |
| OWASP Top 10 summary | Summarise each OWASP Top 10 risk in two lines with one real-world example. |
| First CI pipeline | Create a GitHub Actions workflow that installs dependencies and runs tests on every push. |
| Docker basics | Containerise a small app and explain image layers, the base image and why smaller images are safer. |
| Least privilege | Write examples of least privilege for a database user, a cloud account and a CI token. |
| Security checklist for a web app | Write a 20-item security checklist your team could use before every release. |
| Pre-commit hooks | Add pre-commit hooks that run secret scanning and linting before every commit. |
| Password policy review | Review the password and MFA settings of three services you use and write recommendations. |
Security.txt and disclosure | Add a security.txt file to a site and write a short vulnerability disclosure policy. |
| Branch protection rules | Require reviews, status checks and signed commits on main, and document each rule. |
| Dependency licence check | List the licences of your project's dependencies and flag any that could be a problem. |
| Log what matters | List which security events an app should log (logins, permission changes) and add three of them. |
| Backup basics | Explain the 3-2-1 backup rule and back up a project database following it. |
| Cookie security | Set Secure, HttpOnly and SameSite on cookies in a small app and show the headers. |
| CORS review | Find a too-open CORS setting in a sample API and restrict it. |
| Docker image tags | Explain why using the latest tag is risky and pin images by version or digest. |
| Security champions | Write a one-page plan for a security champion role inside a development team. |
| Vulnerability triage | Take 10 scanner findings and sort them into fix now, fix later and false positive, with reasons. |
Level 2: Building real features (20 tasks)
| Task | What to do |
|---|---|
| SAST in the pipeline | Add Semgrep or CodeQL to your CI so it fails on high-severity findings. Fix or justify each finding. |
| Container image scanning | Scan your Docker image with Trivy or Grype, then reduce the vulnerabilities with a slimmer base image. Report before and after. |
| Dockerfile best practices | Rewrite a Dockerfile to use a non-root user, pinned versions, multi-stage build and no secrets. Lint it with hadolint. |
| DAST with OWASP ZAP | Run a ZAP baseline scan against a deliberately vulnerable local app (Juice Shop or DVWA) and explain three alerts. |
| Secrets management | Move CI secrets into GitHub encrypted secrets or a vault, and show the app reading them at runtime. |
| Infrastructure as Code scanning | Write a small Terraform file, scan it with Checkov or tfsec, and fix the misconfigurations it finds. |
| Signed commits and releases | Set up signed commits and a tagged release, and explain how this protects the supply chain. |
| SBOM generation | Generate a software bill of materials for your app with Syft or CycloneDX and explain what it is used for. |
| Security headers | Add CSP, HSTS, X-Content-Type-Options and Referrer-Policy to a web app and verify them with securityheaders.com or curl. |
| Threat model a feature | Threat-model a login feature with STRIDE and list the mitigations you would build. |
| Secret rotation | Rotate a database password used by an app without downtime and document the steps. |
| Least-privilege CI token | Reduce your CI workflow's GITHUB_TOKEN permissions to the minimum and test it still works. |
| OIDC to the cloud | Let GitHub Actions deploy to a cloud account using OIDC instead of stored keys. |
| Container runtime hardening | Run a container read-only, drop Linux capabilities and add a seccomp profile. |
| Kubernetes secrets | Compare Kubernetes Secrets, sealed secrets and external secret managers and use one. |
| Pipeline as code review | Review a CI/CD workflow file for injection risks (untrusted input in run steps) and fix them. |
| API security testing | Test an API for broken object level authorisation by changing IDs and document the result. |
| WAF basics | Put a web application firewall rule set (Cloudflare free rules or ModSecurity) in front of a test app. |
| Compliance mapping | Map five of your pipeline controls to ISO 27001 or SOC 2 control areas. |
| Security dashboard | Build a dashboard showing open vulnerabilities by severity and age across repos. |
Level 3: Professional work and capstone (16 tasks)
| Task | What to do |
|---|---|
| Kubernetes security basics | Deploy an app to a local cluster (kind or minikube) with resource limits, a non-root pod and a network policy. |
| Policy as code | Write an OPA/Gatekeeper or Kyverno policy that blocks containers running as root, and show it rejecting one. |
| Cloud security posture | In a free cloud account, review IAM users, public buckets and open ports using the provider's security tools, and fix what you find. |
| Runtime monitoring | Install Falco (or a similar tool) in your lab and trigger one alert, then explain what it detected. |
| Incident response drill | Write a runbook for a leaked API key: detect, contain, rotate, review and report. Walk through it once. |
| Full secure pipeline | Build one pipeline that runs tests, SAST, dependency scan, image scan and deploys only when all pass. |
| Security metrics | Define 5 DevSecOps metrics (for example time to fix critical issues) and show how you would collect them. |
| Capstone: secure delivery | Deliver an app through a fully secured pipeline with documentation of every control, findings fixed, and a final security report. |
| Supply chain levels | Explain SLSA levels and raise your project's build to at least level 2 with provenance. |
| Signed images in Kubernetes | Sign an image with Cosign and enforce signature checks in your cluster. |
| Chaos and security | Simulate a compromised pod and show which controls limit the damage. |
| Cloud IAM review | Find unused permissions in a cloud account with an access analyser and remove them. |
| Red team your pipeline | Try (in your own lab) to sneak a malicious dependency into a build and document which control stops it. |
| Tabletop exercise | Run a tabletop exercise for a ransomware scenario with classmates and record lessons learned. |
| DevSecOps maturity assessment | Assess a project with the OWASP DevSecOps Maturity Model and plan the next level. |
| Capstone 2: platform security baseline | Deliver a reusable secure template repo (CI with all scans, signed releases, policies, docs) that any new project can start from. |