Shift-Left Security Scanning

6 Interactive Sessions

Short, interactive sessions: watch it work, try it, then build it yourself. You can go deeper at any time in the written chapters.

1. 1

   Catch security problems while the code is being written

   Automatic checks, called scanners, can find whole kinds of security problems as soon as code is written: leaked passwords, unsafe server settings, unsafe code and known flaws. That is when they are cheapest to fix.

2. 2

   Keep passwords and keys out of your code

   A secret scanner spots passwords and keys as soon as you write them, and finds the ones already committed, so you can block the commit and replace a leaked key before anyone uses it.

3. 3

   Check server settings before anything is built

   Servers, networks and storage are now set up from files, and those files can hold unsafe settings. An infrastructure scanner checks them against a list of rules at the pull request, so unsafe settings never go live.

4. 4

   Find unsafe code before it runs

   A code scanner reads your code without running it and looks for kinds of unsafe pattern, such as a database query built from what a user typed. It flags them on the pull request, at the exact line.

5. 5

   Find known flaws in what you ship

   Two kinds of scan find known flaws. One checks the package you are about to ship for outside code with published flaws. The other probes the running app to see whether it is open to attack.

6. 6

   Make the scanners worth listening to

   A scanner is only worth what people act on. Findings people can trust, and each scan in the right place, turn four kinds of scanner into real protection.

How this certificate is scored

Your certificate shows how many of your written answers met the rubric below, checked by an AI grader. Anyone who checks your certificate sees it.

• You answer 6 short questions, one for each module, in your own words (at least 40 words each).
• An AI grader checks each answer against what its module asks for: it must answer the question, use the course's practice case specifically, and be correct.
• To pass, at least 5 of the 6 answers must meet that bar. The certificate says the answers were graded by AI.

The rubric

1. Module 1, Why Shift-Left Scanning: The case + a map of the four scanner families.
2. Module 2, Secrets Scanning (Gitleaks): Secret scanning in pre-commit + CI, and the rotate-don't-delete rule.
3. Module 3, IaC & Config Scanning (Checkov): Policy-as-code catching misconfigured infrastructure at the PR.
4. Module 4, Code Scanning / SAST (Semgrep): Pattern-based SAST that flags insecure code — with its limits understood.
5. Module 5, Vulnerability Scanning (Nuclei & Dependencies): SCA/image scans plus active template scanning of running targets.
6. Module 6, Fidelity: Tuning & Wiring It In: A trusted, tuned scan program wired into the pipeline with sane gating.

What you walk away with