| name | moai-ref-secops |
| description | DevSecOps, container, and API operational defensive security reference: CI/CD pipeline hardening, secret scanning, IaC misconfiguration detection, SAST/DAST integration, container image scanning, Kubernetes RBAC hardening, container-escape defense, runtime threat detection, OWASP API Top 10 operational defense, WAF rule tuning, and GraphQL/REST depth and rate limiting. Agent-extending skill that amplifies backend, security, and platform-engineering work with production-grade defensive patterns for pipelines, containers, and running APIs. NOT for: offensive techniques (exploit execution, container-escape attack steps, privilege-escalation procedures, attack tooling), dev-time web-app OWASP Top 10 (see moai-ref-owasp-checklist), LLM/AI security (see moai-ref-llm-security), supply-chain provenance and signing (see moai-ref-supply-chain), or general API design (see moai-ref-api-patterns).
|
| when_to_use | Use when hardening a CI/CD pipeline, scanning infrastructure-as-code for misconfiguration, hardening a container image or Kubernetes cluster, defending against container escape, writing runtime-detection rules, enforcing operational API defenses (BOLA detection in production, rate-limit enforcement, server-side authorization, WAF tuning), or limiting GraphQL/REST query depth and complexity. Loads as background knowledge for DevSecOps review, container-security hardening, and API operational-defense tasks across any language ecosystem.
|
| user-invocable | false |
| metadata | {"version":"1.0.0","category":"domain","status":"active","updated":"2026-06-24","tags":"devsecops, container, kubernetes, rbac, api-security, owasp-api, cicd, iac-scanning, runtime-detection, waf, reference"} |
| progressive_disclosure | {"enabled":true,"level1_tokens":100,"level2_tokens":3000} |
DevSecOps, Container, and API Operational Security Reference
Defensive practitioner reference for the operational layer of a system — the
pipeline that builds it, the container and orchestrator that run it, and the API
surface it exposes at runtime. Every section is framed as defense, hardening,
detection, or verification: it describes the misconfiguration, how to detect it,
and how to prevent it, never how to exploit it.
This skill is split into three modules by sub-domain. The overview below gives the
shared threat model and an entry point; the depth lives in the modules. The threat
model is operational: a pipeline can be subverted to inject a build step, a container
can be misconfigured into a host breakout, and a running API can leak one tenant's
data to another. The defenses establish least privilege, isolation, detection, and
runtime authorization at each layer.
Three Sub-Domains (modules)
| Sub-domain | Module | Covers |
|---|
| DevSecOps | modules/devsecops.md | CI/CD pipeline hardening, secret scanning, IaC misconfiguration detection (Terraform / CloudFormation), SAST/DAST integration |
| Container | modules/container.md | Image scanning, Kubernetes RBAC hardening, container-escape defense (seccomp / AppArmor / read-only root / non-root), runtime threat detection |
| API operational | modules/api-ops.md | OWASP API Top 10 operational defense (BOLA / broken-auth detection in production, rate-limit enforcement, server-side authorization), WAF rule tuning, GraphQL/REST depth and complexity limiting |
Operational Trust Boundaries
The core defensive insight: each operational layer is a boundary where an attacker
who has reached it can move to the next. Defense-in-depth means each boundary
assumes the one before it may have failed.
| Boundary | Operational risk | Primary defense | Module |
|---|
| Source → pipeline | Injected build step, leaked secret, poisoned runner | Signed pipeline, secret scanning, runner isolation | DevSecOps |
| Pipeline → infra config | Misconfigured cloud resource (open bucket, permissive IAM) | IaC scanning before apply | DevSecOps |
| Image → registry | Vulnerable base image, embedded secret | Image scanning + admission control |
