FinPay: a DevSecOps pipeline to ship every day, securely

FinPay released once a month, at the weekend, after a long list of manual checks. Security audits came at the end of the project and blocked releases.

• Rare, risky deployments
• Vulnerable dependencies found late
• Secrets shared in configuration files

We built a complete DevSecOps pipeline

• CI/CD: build, tests, static code analysis (SAST), dependency audit, image scanning and automated penetration tests (DAST) on the staging environment
• Kubernetes deployment with automatic rollback when metrics degrade, and two-person approval for production
• Secrets in a dedicated vault, with a pre-commit check that blocks any key in the code
• Monitoring, alerting and uptime dashboards

Developers were trained in secure coding practices and in reading the reports.

FinPay now releases several times a day, vulnerabilities are fixed in hours instead of weeks and every deployment leaves an audit trail for compliance reviews.