https://www.pivotpointsecurity.com/validating-security-within-your-devops-pipeline/