DevSecOps maturity, with GitHub as the foundation
GitHub has grown well beyond code hosting, and its native CI/CD tooling via GitHub Actions makes it a full development platform. What’s less obvious is that the platform can also carry a DevSecOps program. Using GitHub Advanced Security, teams can meet the first level of OWASP's DevSecOps Maturity Model (DSOMM) without bolting on complex external toolchains.
DSOMM evaluates a security program across four axes: static depth (how thorough your static analysis is in CI), dynamic depth (the coverage of your runtime scanning), intensity (how frequently scans run), and consolidation (how findings are triaged and remediated).
What Level 1 maturity actually means
Level 1 is the baseline: you have security tooling in place, but you haven't tuned it. Static analysis tools—secret scanning, software composition analysis (SCA), and static application security testing (SAST)—run with stock settings. Dynamic application security testing (DAST) runs with its default configuration. Scan schedules are often weekly or monthly, limited to the default branch, and reporting is fragmented at this stage.
Two operational rules matter more than the tool choice at Level 1:
- Never fail a build on scan results. Early scans generate false positives, and failing builds on them will erode developer trust in the security program before it matures.
- Start small. Roll out tooling to a narrow set of teams first, and invest in knowledge transfer so engineers can run the tools and interpret results on their own.
Regardless of scale, the tooling has to give developers immediate feedback. Security findings that surface within the existing developer workflow—rather than in a separate report—save engineers the cognitive overhead of switching between tools and tasks during a sprint.
Stitching Level 1 together with GitHub-native tools
With GitHub Advanced Security enabled at the organization level, each pillar of Level 1 maps to a native or low-friction capability:
- SCA via the dependency graph, Dependabot alerts, and Dependabot security updates
- SAST through code scanning
- Secret scanning for private repositories
- DAST with OWASP ZAP, the open-source scanner run in its default mode
The SCA and secret scanning pieces operate continuously and automatically, while code scanning and DAST jobs run as part of the CI pipeline. Alerts route back to the repository where developers already work, keeping security findings inside the review and fix loop rather than in a separate tracker.
Once your team has operated at Level 1 and built the muscles for remediation and tooling analysis, you can plan a move toward Level 2 within six to twelve months. The focus there shifts toward tuning scan rules, refining workflow consolidation, and tightening the feedback loop—but that progress depends on having a stable, trustworthy Level 1 baseline first.
