The DevSecOps Application Security Pipeline turns a small FastAPI reference product into a complete local product-security operating model.
The project demonstrates secure design, API security controls, cloud reference architecture, AppSec scanning, dynamic testing, finding normalisation, release assurance, lifecycle governance, evidence consolidation, developer enablement, Security Champions and downstream integration readiness.
Key result: the repository can regenerate deterministic portfolio evidence with make portfolio-full and validate final readiness with make final-validation.