Tools and first-week setup

The tools a DevSecOps intern uses and how to set up your workspace in week one.

These are the main tools for DevSecOps tasks. You do not need all of them on day one; the Level 1 tasks tell you when to install each one.

Set up your workspace

Create a free GitHub account if you do not have one, with a professional username, and set up your LinkedIn profile: every task is submitted with a LinkedIn post.
Create one repository for the internship, for example devsecops-internship, with a README that says who you are and what the repo holds.
Keep one folder per task, named with the task number and title, so mentors find your work quickly.
Commit small changes every day with clear messages. Your daily work report uses these commits as proof.
Never commit passwords, API keys or personal data. Put secrets in a .env file and add it to .gitignore.

Task	What to do
What DevSecOps means	Write a one-page explanation of shifting security left, with a diagram of where security checks fit in a CI/CD pipeline.
Secure your GitHub account	Turn on 2FA, review SSH keys and tokens, and enable branch protection on a repo named devsecops-internship.
Find secrets in code	Plant a fake API key in a test repo, detect it with gitleaks or trufflehog, remove it from history and explain why rotation is still needed.
Dependency scanning	Run npm audit or pip-audit on a sample project, list the vulnerabilities by severity and upgrade at least two.