Introduction
When I joined Virtuexpo as a fullstack developer on a work-study program, I quickly identified the lack of DevSecOps practices within the company: no CI/CD pipeline, manual deployments prone to errors, no vulnerability detection, and secrets handled manually.
I proposed to management a comprehensive project to implement DevSecOps practices and mindset, using CampusFlow — the B2B SaaS application I was responsible for — as a pilot project.
Analysis and Proposal
The first step was to analyze existing practices: mapping the information system, auditing development and deployment processes. This assessment identified gaps and helped build a well-argued proposal for management.
Pilot Project Implementation
On CampusFlow, I single-handedly designed and deployed a complete GitHub Actions CI/CD pipeline:
- CI triggered on each pull request: automated tests, SAST scan, DAST analysis, secret detection, linter, code quality
- CD: automated deployment via rsync of pre-built archives, eliminating all human intervention
- Daily scheduled pipeline: scanning known vulnerabilities (CVEs) in PHP and JavaScript dependencies
I also provisioned a Linux VPS configured from scratch (SSH hardening, fail2ban, Logwatch with daily email reports, Docker, Nginx reverse proxy) to host two internal applications developed by other team members — a purely DevOps role on these applications.
Change Management
The technical setup was only half the work. The other half was convincing people. For about a year, I regularly presented the concrete benefits of DevOps practices to the development team:
- Pilot project metrics (deployment frequency, pipeline duration, reliability)
- Detected security vulnerabilities, including those affecting dependencies shared with the company's other product
- Daily time and reliability gains
This groundwork paid off: the project was validated by management and accepted by the development team for extension to the second product.
Measurable Results
- Deployment frequency: from 1-2 per month to over 5 per day
- Pipeline duration: from 25 minutes (manual or early versions) to approximately 3 minutes
- Vulnerability detection: from zero detection capability to an average of 10 CVEs per month, with peaks above 40
- CVE fix time: maximum 12 hours on weekdays, 48 hours on weekends
- Reliability: zero deployment failures due to human error
- Secret management: 100% in GitHub Secrets, zero manual handling
