I've spent twenty-five years building and securing deployment pipelines, and the single biggest shift in that time isn't a tool — it's where security lives. We used to bolt it on at the end, right before a release, when changing anything was expensive and everyone was already tired. That's backwards. DevSecOps is the correction: you move security checks left, into the pipeline, so problems surface when they're cheap to fix and the person who introduced them is still looking at the code.
This is a tour of the tool categories that matter, with representative (mostly open-source) examples and where each one fits in a real GitLab CI/CD or GitHub Actions pipeline. It is not a ranked ad. The right toolchain depends on your team size and how mature your infrastructure is, and I'll come back to that at the end.
What DevSecOps actually means
DevSecOps is "shift-left security": treating security as a property of the pipeline, not a gate at the end of it. Concretely, it means your CI runs the same checks a security reviewer would — scanning code, dependencies, containers, infrastructure definitions, and secrets — automatically, on every push, and fails the build when it finds something that genuinely matters.
