Penerapan DevSecOps pada Backend Sistem Koperasi Karyawan YPTM Universitas Merdeka Malang Menggunakan Pengujian SAST

Idham Hastirou; Himawan Pramaditya

doi:10.55606/jupikom.v5i3.7725

Authors

Idham Hastirou Universitas Merdeka Malang, Jawa Timur
Himawan Pramaditya Universitas Merdeka Malang, Jawa Timur

DOI:

https://doi.org/10.55606/jupikom.v5i3.7725

Keywords:

DevSecOps; Static Application Security Testing; Semgrep; CI/CD; Backend; Koperasi Digital; Shift-left security.

Abstract

Developing a backend system for employee cooperatives requires an approach that not only delivers functional features but also ensures security integration from the earliest stages of the development lifecycle. This research aims to implement DevSecOps on the backend system of YPTM Universitas Merdeka Malang employee cooperative through the integration of Static Application Security Testing (SAST) into the Continuous Integration/Continuous Delivery (CI/CD) pipeline. The backend system is developed using the Bun runtime with oRPC library for type-safe endpoint definitions, PostgreSQL as the relational database, and Redis as the caching layer and asynchronous task queue. DevSecOps implementation is applied across four security layers: development-time, pre-merge, build-time, and runtime, while the evaluation in this study is focused on the pre-merge layer. In the pre-merge layer, SAST scanning using Semgrep runs automatically on every push and pull request event with six rulesets covering OWASP Top 10, security audit, TypeScript, JavaScript, Next.js, and SQL injection. An automated security gate is enforced with thresholds of MAX_CRITICAL=0 and MAX_HIGH=5, which fails the pipeline when vulnerability findings exceed the determined limits. Implementation results show that the pipeline detected 48 security findings, with 42 valid findings and 6 false positives, yielding a precision of 87.5%. The risk score was recorded at 210 based on customized severity weights. All findings are integrated into a risk score trend that is historically recorded for continuous security monitoring. This research demonstrates that SAST integration into the CI/CD pipeline can be implemented automatically on the cooperative backend system, with a security gate mechanism that successfully failed the pipeline in the tested scenarios. As a single case study, the results are descriptive and are not intended to be generalized

References

[1] D. Kamiilah Afrida, E. Wahyu Puji Lestari, F. Lailiya, and A. Fawaiq Suwanan, “Peran Digitalisasi Koperasi Sebagai Pendongkrak UMKM Dalam Pengembangan Ekonomi Wilayah Kota Surabaya,” 2021.

[2] M. T. Chulkamdi, Z. Wulansari, A. Haryoko, and R. Alfiyanti, “(elektronik) Fakultas Teknik Universitas Islam Balitar,” 2025.

[3] D. Persetujuan Bersama, “FRESIDEN REPUBLIK INDONESIA 2-DEWAN PERWAKILAN RAKYAT REPUBLIK INDONESIA dan PRESIDEN REPUBLIK INDONESIA.”

[4] R. Setiawan and A. Faruq, “SISTEM INFORMASI KOPERASI TABURPUJA BERBASIS TANGGUNG RENTENG,” 2019.

[5] X. Zhao, T. Clear, and R. Lal, “Identifying the primary dimensions of DevSecOps: A multi-vocal literature review ✩,” J. Syst. Softw., vol. 214, p. 112063, 2024, doi: 10.5281/zenodo.7.

[6] Naga Murali Krishna Koneru, “Integrating Security into CI/CD Pipelines: A DevSecOps Approach with SAST, DAST, and SCA Tools,” International Journal of Science and Research Archive, vol. 3, no. 1, pp. 250–265, Oct. 2021, doi: 10.30574/ijsra.2021.3.1.0080.

[7] R. N. Rajapakse, M. Zahedi, M. A. Babar, and H. Shen, “Challenges and solutions when adopting DevSecOps: A systematic review,” Inf. Softw. Technol., vol. 141, p. 106700, Jan. 2022, doi: 10.1016/J.INFSOF.2021.106700.

[8] R. Myrbakken Håvard and Colomo-Palacios, “DevSecOps: A Multivocal Literature Review,” in Software Process Improvement and Capability Determination, A. and O. R. V. and R. T. and D. A. Mas Antonia and Mesquida, Ed., Cham: Springer International Publishing, 2017, pp. 17–29.

[9] Agil Maulana Nanda Riady, Paniran Paniran, and I Made Budi Suksmadana, “Perancangan Backend Api Berbasis Rest-Api pada Aplikasi Rekomendasi Resep Makanan,” Mars : Jurnal Teknik Mesin, Industri, Elektro Dan Ilmu Komputer, vol. 2, no. 3, pp. 94–106, Jun. 2024, doi: 10.61132/mars.v2i3.137.

[10] Ananta Wira Satriaji, “ANALISIS SPESIFIKASI KEBUTUHAN PERANGKAT LUNAK (SKPL) DALAM PENGEMBANGAN APLIKASI KOPERASI DIGITAL BERBASIS MOBILE MENGGUNAKAN METODE DEVOPS (Studi Kasus Pada Koperasi Karyawan,” 2026.

[11] OWASP Foundation, “OWASP Top 10:2021,” Open Worldwide Application Security Project (OWASP).

[12] M. Shahin, M. Ali Babar, and L. Zhu, “Continuous Integration, Delivery and Deployment: A Systematic Review on Approaches, Tools, Challenges and Practices,” IEEE Access, vol. 5, pp. 3909–3943, 2017, doi: 10.1109/ACCESS.2017.2685629.