Expense Manager — DevSecOps-Hardened Expense Platform
A secure full-stack expense management platform with an automated end-to-end DevSecOps CI/CD pipeline — every commit is scanned for secrets, vulnerabilities, and live security issues before it ships.
Internal tools are where security standards go to die, and everyone kind of knows it. This client's expense app had a hardcoded API key in a commit from eighteen months ago that nobody had noticed because nobody was scanning for it. It wasn't negligence exactly — the customer-facing product got all the security budget, and the internal app got whatever was left, which was nothing.
Rather than bolt security review onto the end of the release process where it slows everyone down and gets skipped under deadline pressure, we built it into the pipeline as five automated gates that run on every commit. Gitleaks scans for secrets before code even reaches review. Trivy and Snyk cover dependency and container vulnerabilities, catching the kind of transitive dependency issue nobody reads changelogs for. Cosign signs every build artifact so there's a verifiable chain from source to deployed binary. OWASP ZAP runs dynamic scans against a staging deploy before anything reaches production. None of this is exotic tooling — it's the standard DevSecOps stack. The difference is that it actually runs on every merge instead of being a checklist item someone forgets.
We found and fixed three real issues during the initial pipeline rollout, including that old hardcoded key, before any of it reached production. Since then, the pipeline runs in under six minutes and hasn't let a secret through, which means the team gets the same protection their customer-facing product has without anyone having to remember to ask for it.