SentinelForge

SentinelForge is an exercise in building a CI/CD pipeline where security scanning actually blocks a bad build: a critical vulnerability, a leaked secret, a failing test all stop the pipeline instead of sailing through.

Jenkins orchestrates the pipeline stages. SonarQube runs static analysis (SAST) against the codebase. Trivy scans the built container image for known vulnerabilities. Snyk covers dependency scanning (SCA) so vulnerable packages get caught before they ship. Docker packages the app, and AWS is the target deployment environment.

A GitLeaks pre-commit hook already stops secrets from ever reaching a commit in the first place, and the Flask demo app has a pytest suite (5 passing tests) so the pipeline has something real to build, test, and scan end to end.