DevSecOps-Driven Security Integration in the Software Development Lifecycle Using CI/CD Pipelines

CI/CD pipelines are the foundation of the new software delivery, which makes them fast in deployment but may slow down or inconsist in enforcement of security. DevSecOps builds upon DevOps by means of automated security testing, which is directly embedded within the software development lifecycle (SDLC). The paper introduces a containerized DevSecOps infrastructure integrated into CI/CD pipelines, which automatically inject vulnerabilities into the system, conducts multi-tool security assessment, and monitors performance with standardized metrics. The framework combines SAST (Semgrep, CodeQL, SonarQube), SCA (npm audit, Snyk), and DAST (OWASP ZAP), as well as using a Random Forest classifier to predict multi-class vulnerabilities (XSS, hardcoded secrets, CORS misconfigurations and others). The experimental findings indicate that multi-tool pipelines have extensive coverage, and category-specific performance (opposite-most-effective with CORS, most-weak with hardcoded secrets) was demonstrated by ML-assisted classification. Altogether, the system can be recalled with 0.75 accuracy, precision 0.38, and F1-score 0.50, highlighting the significance of containers, repeatable pipelines, essential rule engineering, automated reports, and ML augmentation to scalable, reliable security in high-speed CI/CD systems.