An Automated Continuous Pipeline for Vulnerability Detection

Abstract

This thesis presents the design, implementation, and evaluation of an automated CI/CD pipeline focused on the continuous detection and mitigation of vulnerabilities in software projects. Motivated by a real-world security incident that exposed weaknesses in the organization's development workflow, the work adopts a CyberDevOps-based approach, combining continuous integration and delivery practices with automated security mechanisms. The proposed solution integrates static and dynamic code analysis tools, dependency scanning, secret detection, and functional testing, all orchestrated within a continuous and automated workflow. Additionally, a locally hosted large language model (LLM) is incorporated to support AI-assisted code reviews and vulnerability assessments. The pipeline was implemented using Jenkins and validated within a real development project. The evaluation showed that, although the infrastructure is technically sound and fully operational, the immediate improvements in code quality were constrained by external factors, specifically, an imminent release deadline. In this context, the development team prioritized the delivery of new features over the remediation of known vulnerabilities and technical debt. Temporal monitoring performed through DevLake revealed a 91.6% increase in development activity following the pipeline's introduction, demonstrating its effectiveness in supporting faster delivery cycles. Simultaneously, a 96.56% reduction in average code review time was observed, indicating that automation significantly enhanced the efficiency of the validation process. However, an initial deterioration in code quality and security indicators was also recorded, particularly in tools such as SonarQube, Snyk, and Trivy, highlighting the importance of aligning automation with quality assurance practices that allocate time and resources for addressing the issues detected.