Shift Left Security: 4 Automated Security Gates in GitHub Actions

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2023-44487, CVE-2026-23745, CVE-2026-33845. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

A security researcher filed a report against our Node.js API two years ago. The vulnerability was prototype pollution in an npm package we had been shipping for eight months. The fix took about 20 minutes. The internal review to figure out how it got through took two days. The package had a known CVE. It had been sitting in the NVD for months before we found it. Our CI never checked. Code review didn’t catch it. The researcher did. There’s a stat from IBM’s Cost of a Data Breach 2024 report that I keep referencing when this comes up: The average breach costs $4.88 million. Teams running DevSecOps practices save $1.68 million from that cost on average. The number I actually find more useful is smaller. A vulnerability caught in CI costs about $80 to fix. Caught in production, the same costs $7,600. That gap is why this article exists. Four automated security gates wired into GitHub Actions, running on every push and pull request — none of them require an enterprise license:

Gate 1: Dependency scanning — finds CVEs in your npm packages before they ship. Gate 2: Container image scanning — finds CVEs in your Docker base image OS packages. Gate 3: Static analysis (SAST) — finds code-level vulnerabilities such as SQL injection and hardcoded secrets. Gate 4: Dynamic scanning (DAST) — finds runtime vulnerabilities in a running instance of your app.

Wired together, the pipeline looks like this: Pull Request / Push to main │ ▼ ┌──────────────────────────────────────────────────────┐ │ GitHub Actions Pipeline │ │ │ │ Gate 1: Dependency Scan Gate 2: Image Scan │ │ (npm audit + …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2023-44487, CVE-2026-23745, CVE-2026-33845): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/shift-left-security-4-automated-security-gates-in-github-actions/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.