Operate Application Security From Code to Deployment
Build and test an application-security evidence chain. Use offline Python to reconcile artifacts, scan scope, pipeline authority, credential lineage and infrastructure state; independently validate an AI-proposed patch before defending rollout closure.
A fictional document-support service has a web application, conversion worker and scheduled importer. Its security reports disagree about deployed artifacts, and a proposed AI repair must preserve legitimate behavior as well as enforce the boundary.
Seven lessons build one review packet with executable offline checks, multiple mechanism diagrams, negative cases and worked decisions. You will trace artifact identity, assess reports, constrain pipeline authority, review credential lineage and infrastructure drift, validate a proposed patch, and defend per-target closure after a rollback request.
The first two lessons are open. Pipeline authority requires a free account; the remaining lessons are Premium. Each program states its assumptions and operational limits. Product references, including CodeMender, are dated and linked in the relevant lesson.
When you finish, you can
- Join source revisions, build claims and running or scheduled artifacts
- Evaluate scan inputs, scope gaps and reviewed dispositions
- Test the boundary between contribution and privileged promotion
- Trace exposed credentials and independently surviving authority
- Preserve unknown plan values and reconcile live drift
- Validate an AI-proposed patch against independent behavior contracts
- Defend target-specific closure and a changed rollback candidate
BEFORE YOU START · You can follow a build and read short Python programs. Examples use only the Python standard library and fictional records; no scanner, cloud account, agent product or real credential is required.
Syllabus
Map the release and its evidence
Connect application ownership to actual artifacts, then determine whether the scan reports cover the release.
Bound delivery authority
Separate privileged promotion from contribution work and respond to an exposed build credential.
Verify the deployed repair
Reconcile infrastructure state, validate an AI-proposed patch with independent tests, and defend target-specific repair closure when the rollout changes.