A workshop announcement for "Code to Cloud: Secure Modern Applications Using Open-Source Tools" at DEF CON 34 features a portrait of Mackenzie Jackson in the foreground against a black background with event details and logos.

AppSec Village

LXCL:Grants entry to the workshop.

Classroom Admission

LXCL:Please join the queue and as seats become available you will be granted access to the workshop.

Waitlist

Location:&nbsp;AppSec Village Classroom Presenter: Mackenzie Jackson, Developer and security advocate DescriptionWant to build secure applications without co-sponsoring a Formula 1 team? The modern threat landscape is a mess of AI-generated vulnerabilities, supply chain poisoning, and cloud misconfigurations. You don&#39;t need a seven-figure vendor budget to fight it. In this 2-hour hands-on workshop, we will build a complete, automated AppSec pipeline using entirely open-source tools. We will wire up Opengrep for SAST, Trivy for containers, Checkov for infrastructure, and ZAP for DAST - piping the chaos into DefectDojo for centralized vulnerability management. We will also explore how to use local AI models to triage the inevitable mountain of false positives. You will walk away with a functional pipeline and a realistic understanding of where open-source excels, and where it falls apart. Pre-requisites To participate fully, please ensure you have the following ready to go:<ol fr-original-style="text-align: left;" style="text-align: left; width: 100%; box-sizing: inherit;"><li fr-original-style="" style="box-sizing: inherit;">A GitHub Account: We will be using GitHub Actions for CI/CD security automation.&nbsp;</li><li fr-original-style="" style="box-sizing: inherit;">A Code Editor: (e.g., VS Code, Sublime Text, Cursor......)</li></ol>The &quot;Nice-to-HavesIf you want&nbsp;to hit the ground running, can install the following.<ul fr-original-style="text-align: left;" style="text-align: left; box-sizing: inherit;"><li fr-original-style="" style="box-sizing: inherit;">Docker: We&rsquo;ll use this to host our security dashboard, DefectDojo.</li><li fr-original-style="" style="box-sizing: inherit;">Security Tools: Our workshop covers tools including <a fr-original-style="" href="https://github.com/aquasecurity/trivy" style="text-decoration-color: currentcolor; user-select: auto; box-sizing: inherit;" target="_blank">Trivy</a>, <a fr-original-style="" href="https://github.com/betterleaks/betterleaks" style="text-decoration-color: currentcolor; user-select: auto; box-sizing: inherit;" target="_blank">BetterLeaks</a>, and <a fr-original-style="" href="https://github.com/opengrep/opengrep" style="text-decoration-color: currentcolor; user-select: auto; box-sizing: inherit;" target="_blank">Opengrep</a>. If you want to install these prior, that will be helpful.&nbsp;</li></ul>No Stress SetupIf you run into any technical hurdles or don&#39;t have time to install everything prior to the workshop:<ul fr-original-style="text-align: left;" style="text-align: left; box-sizing: inherit;"><li fr-original-style="" style="box-sizing: inherit;">We&rsquo;ll help you out: We will have time during the session to troubleshoot installations together.</li><li fr-original-style="" style="box-sizing: inherit;">Follow along anyway: If you prefer not to install these tools on your machine, you can still participate by following the live demonstrations and participating in the many other exercises.&nbsp;</li></ul>The goal is for everyone to gain hands-on experience, regardless of their local setup.

Hi <span contenteditable="false" data-custom-variable="{{firstname}}" fr-original-class="fr-deletable styled-tag-chip" fr-original-style="" style="color: rgb(42, 42, 196); overflow-wrap: anywhere; user-select: none; background-color: rgb(248, 248, 255); border: 1px solid rgb(191, 191, 255); border-radius: 4px; margin: 0px; padding: 1px 8px; font-size: 11px; display: inline-block; box-sizing: inherit;">First name, Thank you for reserving your spot for Code to Cloud: Secure Modern Applications Using Open-Source Tools Workshop! We&#39;re excited to have you join us. Your tickets are booked &mdash; here&#39;s everything you need to know: 📅&nbsp;Date &amp; Time: Saturday, August 8, 4:15pm - 6:00pm 📍 Location:&nbsp;AppSec Village Classroom @ AppSec Village ⚠️ Please pay particular attention to the prerequisites so you come prepared and ready to get the most out of the session. We can&#39;t wait to see you there! Ailin Castellucci <a fr-original-style="" href="mailto:ailin@appsecvillage.com" style="text-decoration-color: currentcolor; user-select: auto; box-sizing: inherit;" target="_blank">ailin@appsecvillage.com</a> 💜 Love AppSec Village? If this workshop (or anything else we do) has been valuable to you, please consider becoming an <a fr-original-style="" href="https://www.zeffy.com/en-US/ticketing/appsec-village-super-fan" style="text-decoration-color: currentcolor; user-select: auto; box-sizing: inherit;" target="_blank">AppSec Village Super Fan</a>! Your support helps us keep bringing great content and events like this one to the community.

Location: AppSec Village Classroom Presenter: Mackenzie Jackson, Developer and security advocate DescriptionWant to build secure applications without co-sponsoring a Formula 1 team? The modern threat landscape is a mess of AI-generated vulnerabilities, supply chain poisoning, and cloud misconfigurations. You don't need a seven-figure vendor budget to fight it. In this 2-hour hands-on workshop, we will build a complete, automated AppSec pipeline using entirely open-source tools. We will wire up Opengrep for SAST, Trivy for containers, Checkov for infrastructure, and ZAP for DAST - piping the chaos into DefectDojo for centralized vulnerability management. We will also explore how to use local AI models to triage the inevitable mountain of false positives. You will walk away with a functional pipeline and a realistic understanding of where open-source excels, and where it falls apart. Pre-requisites To participate fully, please ensure you have the following ready to go:<ol><li>A GitHub Account: We will be using GitHub Actions for CI/CD security automation. </li><li>A Code Editor: (e.g., VS Code, Sublime Text, Cursor......)</li></ol>The "Nice-to-HavesIf you want to hit the ground running, can install the following.<ul><li>Docker: We’ll use this to host our security dashboard, DefectDojo.</li><li>Security Tools: Our workshop covers tools including <a href="https://github.com/aquasecurity/trivy" target="_blank">Trivy</a>, <a href="https://github.com/betterleaks/betterleaks" target="_blank">BetterLeaks</a>, and <a href="https://github.com/opengrep/opengrep" target="_blank">Opengrep</a>. If you want to install these prior, that will be helpful. </li></ul>No Stress SetupIf you run into any technical hurdles or don't have time to install everything prior to the workshop:<ul><li>We’ll help you out: We will have time during the session to troubleshoot installations together.</li><li>Follow along anyway: If you prefer not to install these tools on your machine, you can still participate by following the live demonstrations and participating in the many other exercises. </li></ul>The goal is for everyone to gain hands-on experience, regardless of their local setup.

AppSec Village

Code to Cloud: Secure Modern Applications Using Open-Source Tools

300 Convention Center Dr

Classroom Admission

Free

Waitlist

Free

Add a donation