What question did this study set out to answer?

This research aims to design and implement a security-first DevSecOps CI/CD pipeline for a 3-tier web application.

May 31, 2026Open Access

Implementing DevSecOps in CI/CD Pipelines for 3-Tier Web Applications: A Security-First Approach Using Jenkins, SonarQube, Trivy, and Kubernetes

Key Points

This research aims to design and implement a security-first DevSecOps CI/CD pipeline for a 3-tier web application.
Developed a CI/CD pipeline using Jenkins and integrated security tools like SonarQube and Trivy.
Containerized the application using Docker and deployed it on Amazon EKS using Kubernetes manifests.
Implemented a manual approval gate for production deployment and provided real-time visibility through Slack notifications.
Integrating security tools reduced the risk of credential leakage and dependency vulnerabilities.
Achieved a significant decrease in container misconfigurations reaching production, ensuring safer deployments.

Abstract

This paper presents the design and implementation of a comprehensive DevSecOps CI/CD pipeline for a 3-tier web application comprising a React.js frontend, Node.js backend API, and MySQL database. The pipeline is built using Jenkins as the automation engine and integrates multi-layer security tooling including GitLeaks for secret detection, SonarQube for Static Application Security Testing (SAST), and Trivy for filesystem and container image vulnerability scanning. A manual production approval gate ensures human oversight before deployment. The application is containerized using Docker and deployed to Amazon EKS (Elastic Kubernetes Service) on AWS in the ap-south-1 region using Kubernetes manifests for all three tiers. Slack notifications provide real-time pipeline visibility. The study demonstrates that integrating security at every stage of the CI/CD pipeline — the shift-left security model — significantly reduces the risk of credential leakage, dependency vulnerabilities, and container misconfigurations reaching production. The complete implementation is publicly available at https://github.com/jatin8318/DevSecOps-CI-CD-Pipeline-for-a-3-Tier-Web-Application

Ask AI

Helpful

Bookmark

View Full Paper