Create a Secure DevSecOps Pipeline

In this article:

How to create a secure DevSecOps Build Pipeline for a Python Application using CircleCI and the Crashtest Security Suite

The DevSecOps Example is a simple web application written with Django. It implements a single view that will return everything the user inputs. The templating engine disables the automatic XSS protection feature, which sanitizes the input. In addition, the XSSDisableMiddleware disables the XSS protection feature implemented in a modern web browser.

Tutorial Overview

This application contains a build file for CircleCI to deploy the vulnerable application to Heroku. Build jobs are defined as a dependency check for the python application using safety and a dynamic application security test using the Crashtest Security Suite.

This application is used within workshops held by Crashtest Security. This tutorial contains the steps to follow in the workshop. If you want to attend one of those workshops, let us know via e-mail.

Create Accounts

  • GitHub: Create an account to get access to the source code of this example project
  • CircleCI: Login using GitHub to grant CircleCI access to your GitHub projects
  • Heroku: Create an account to deploy the example application there
  • Crashtest Security: Create an account to conduct a dynamic vulnerability scan

Fork the Repository

To get access to the repository code, fork this repository by clicking the “Fork” button on the top right:

GitHub Fork Repository

This will create your own copy of the code repository and redirect you to the repository page.

Configure Heroku to be used with this project

  • Create a new application within Heroku: You may choose any name and region you like. Just remember the name of your new Heroku app. We will refer to the name of your Heroku app as HEROKU_APP_NAME. For this tutorial, I have named the application sigs-devsecops-example
  • Go to the app settings, click on “Reveal Config Vars” and add a new environment variable DISABLE_COLLECTSTATIC = 1. This is needed for the Django application to run properly on Heroku. If you miss setting this environment variable, you will later see an error message during the corresponding build step.
  • When you click on “Open App”, you should see a default page from Heroku that states that you have no application running yet.
Configuring Heroku
  • Retrieve your Heroku API key here: (At the bottom of the page). You need this API key to grant CircleCI access to deploy your application. We will refer to this variable as HEROKU_API_KEY.
  • Open the CircleCI dashboard: Log in using your GitHub account when you get asked for login credentials. This grants CircleCI access permissions to get the code from your repository.
  • Add your GitHub Repository to CircleCI by clicking “Add Projects” in the left menu bar and then on “Set Up Project”
  • Choose “Workflows” in the left menu bar and then click on the little gear symbol next to your project
  • Configure the following two environment variables:
    • HEROKU_APP_NAME – Enter the name that you previously chose
    • HEROKU_API_KEY – Enter the API Key as provided by Heroku

Commit a Change to the Repository

  • To start afresh build in CircleCI, we need to trigger a change in the repository. Therefore we add a submit button to the form in the application.
  • In your GitHub repository, navigate to devsecops-example-heroku/vulnerable/templates/index.html and click the pencil icon to edit the file.
  • Add a button to the form by adding the following code before the form closing tag (line 11).
<input type="submit" value="Send!" />
Github Input
  • When the file is saved, the change is committed to the repository, and a new build is triggered in CircleCI automatically.
CircleCI Triggered Build
  • The build deploys the application, and you can now access it from Heroku by clicking the “Open App” button.
Heroku Open App Application
  • You can see that the application contains a Cross-Site-Scripting vulnerability by typing the following as your name within the application. This will make the browser show an alert box as it is interpreting your provided JavaScript:

Enable Python Safety (SAST) Build Step

  • To enable the dependency check of all python dependencies in the build, add the following lines at the end of the file devsecops-example-heroku/vulnerable/.circleci/config.yml (make sure that the indentation matches).
# Run python safety check
      - python-safety
GitHub Enable Dependency Check
  • The new build step must fail, as there are known vulnerabilities in the Django version used.
CircleCI Fail Screenshot
  • To fix the build, figure out what the latest Django version is and update it in the file devsecops-example-heroku/requirements.txt. You can find the latest Django version here:

Enable Crashtest Security (DAST) Build Step

  • To integrate a dynamic vulnerability scan using the Crashtest Security Suite, log in on and create a new project with the following settings:
    • Project Type: Multi-Page Application
    • Title: Choose a title you like
    • Protocol: https
    • URL: The URL your application is running (Copy from your browser address bar after clicking on “Open App” in Heroku).
  • Click on Verify Project to download the verification file. You need this file to allow the Crashtest Security Suite to scan your application.
Crashtest Security Suite Verify Project
  • In GitHub, within your project’s root directory, click on “Create new file.”
  • Name the file similar to the downloaded verification file and fill it with the same content.
GitHub Create New File
  • Generate a Webhook within the Crashtest Security Suite. Go to the project preferences and click on “Generate” in the Webhook section
Crashtest Security Suite Generate a Webhook
  • Add a new environment variable in the project settings in CircleCI:
    • CRASHTEST_WEBHOOK – Enter the ID of the webhook that you just generated (without the URL path).
CircleCI Add Crashtest Webhook
  • Now enable the dynamic vulnerability scan for your application by adding the following lines at the end of the file devsecops-example-heroku/vulnerable/.circleci/config.yml (make sure that the indentation matches, the line “requires” has 4 additional whitespaces of indentation compared to the line before).
# Start Crashtest Security Suite
      - dast:
            - heroku/deploy-via-git
GitHub enable dynamic vulnerability scan
  • Now the build fails because of several more detected vulnerabilities, such as the Cross-Site-Scripting Vulnerability
CircleCI Build Fails Screenshot

Resolve Vulnerabilities

  • To resolve the Cross-Site-Scripting vulnerability open the file devsecops-example-heroku/vulnerable/templates/index.html and remove the pipe | safe in line 4.
  • Now you should get a successful build again and have a much more secure application than before.

Get a quick security audit of your website for free now

We are analyzing
Scanning target
Scan status: In progress
Scan target:
Date: 22/09/2023
Crashtest Security Suite will be checking for:
Information disclosure Known vulnerabilities SSL misconfiguration Open ports
Complete your scan request
Please fill in your details receive the
quick security audit by email.
Security specialist is analyzing your scan report.
То verify your identity please provide your phone/mobile:
Thank you.
We have received your request.
As soon as your security audit is ready, we will notify you.