{"id":8185,"date":"2026-10-30T17:10:00","date_gmt":"2026-10-30T17:10:00","guid":{"rendered":"https:\/\/www.devopsconsulting.in\/blog\/?p=8185"},"modified":"2026-10-30T17:10:00","modified_gmt":"2026-10-30T17:10:00","slug":"devsecops-controls-worth-installing-first","status":"publish","type":"post","link":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/","title":{"rendered":"Nine DevSecOps Controls Worth Installing First"},"content":{"rendered":"

Consulting engagements that promise security transformation usually fail in a predictable place: the client buys tools, the tools produce findings, and nobody owns the decision about what happens next. The fix is to install controls in an order where each one makes the next credible. Below is that order, drawn from the placed-controls view of DevSecOps \u2014 the discipline of building security into the delivery path and its teams so that every change gets checked, traced and cleared to ship without a separate late-stage review. Nine items, sequenced deliberately, each with the reason it earns its slot. Engagements that follow roughly this sequence report fewer blocked releases and fewer political fights than engagements that lead with a platform purchase.<\/p>\n

What “Installing” Means in a DevSecOps Rollout<\/h2>\n

Four attributes describe any control worth the name: its position in the path a change travels, the confidence its verdict deserves, the cost of running it, and its action when it fires \u2014 block, warn, or record. The list below assigns each control a position and an action, and that assignment is the actual engineering work. A scanner with no assigned action is shelfware; a blocking control placed where its error rate is high will be bypassed within a month. Keep those two failure modes in mind as you read, because every item here exists to avoid one of them.<\/p>\n

The Nine, In Order<\/h2>\n
    \n
  1. Secret scanning with server-side push protection.<\/strong> Positioned at the commit and the push, acting to block. Credential leaks are the most frequent and most preventable pipeline failure, and the control costs almost nothing to run. Install a pre-commit scanner for developers and switch on the server-side check on the hosting platform, then review bypass events weekly. Rotation discipline matters as much as detection: when a secret does escape, rotate the credential first and rewrite git history second \u2014 reversing that order leaves a live key in a stranger’s hands while you tidy the past.<\/li>\n
  2. Actions and dependencies pinned to full commit SHAs.<\/strong> Positioned at workflow resolution, blocking by default. Tags are mutable; digests are not. A pinned reference means the code your pipeline executes today is the code you reviewed last month, no matter what happens to upstream repositories.<\/li>\n
  3. Per-job permissions and short-lived identities.<\/strong> Positioned inside CI configuration, acting to constrain blast radius. Every job gets the minimum rights it needs, and cloud access runs through OIDC or workload identity federation instead of stored keys. Long-lived CI credentials are the quiet enabler of nearly every pipeline compromise worth reading about; wildcard trust policies in cloud roles are their equally quiet twin.<\/li>\n
  4. Fork isolation rules.<\/strong> Positioned at the pull-request boundary, blocking. Pull requests from forks receive no secrets, and untrusted code never executes under triggers that carry repository write access \u2014 the pull_request_target failure mode has burned enough public projects that the rule should be considered settled law. Gate rules themselves must come from the base commit, never from the fork, or the fox writes the henhouse policy.<\/li>\n
  5. Dependency and container scanning.<\/strong> Positioned at build, initially recording rather than blocking. A software bill of materials is generated on every build from day one \u2014 deciding what to do about it can wait a sprint, but the receipts cannot be reconstructed later. Inventory first, judgement second.<\/li>\n
  6. Static analysis tuned to the changed-lines rule.<\/strong> Positioned at pull request, blocking only on problems that are freshly introduced and genuinely dangerous \u2014 and only when the rule producing them is accurate enough to trust, with an effective false-positive rate near zero. Results limited to changed lines keep the signal-to-noise ratio survivable. This is the hardest item to tune and the reason the list places it after the mechanical wins.<\/li>\n
  7. Policy as code for infrastructure manifests.<\/strong> Positioned at plan and apply, blocking on defined violations. Conftest-style checks turn reviewer folklore into executable rules, which stops the same misconfiguration from being caught by memory on Tuesday and missed on Friday.<\/li>\n
  8. Build provenance and signing.<\/strong> Positioned at artifact creation, recording; verification happens at deploy. An SBOM plus a signature plus a provenance statement turn “where did this binary come from?” from an archaeology project into a query. Verification at deploy time is the half teams forget \u2014 a signature nobody checks is a wax seal on a envelope nobody opens.<\/li>\n
  9. The gate-and-exception register.<\/strong> Positioned across the whole path, adjudicating. One narrow gate policy, one register where every exception has an owner and a ninety-day expiry, one monthly review. This is the control that makes the other eight governable.<\/li>\n<\/ol>\n

    What DevSecOps Tooling Gets Named in the Field<\/h2>\n

    Client teams always ask for names, so here they are with their honest caveats. Gitleaks handles secret detection and is considered feature-complete, receiving security patches only. CodeQL and Semgrep cover static analysis \u2014 note that Semgrep’s –config auto<\/em> convenience sends your project URL to a remote service, which some clients will care about. Trivy scans images and dependencies, Syft generates SBOMs, Conftest evaluates policies, ZAP covers dynamic testing, and the OpenSSF Scorecard grades a repository’s own security posture. Sigstore’s cosign, Fulcio and Rekor handle the signing and transparency layer from item eight. Findings should flow in SARIF so every tool lands in one review surface. Standards worth citing in a statement of work: NIST’s SSDF (v1.1, with a v1.2 draft circulating), SLSA for build levels, OWASP’s Top 10 and ASVS, SAMM and BSIMM for programme maturity, CycloneDX and SPDX for bills of materials. Not one of them certifies “DevSecOps” \u2014 a sentence worth putting in every proposal, because someone in procurement will assume otherwise.<\/p>\n

    Objections arrive on schedule, and the experienced answer is evidence rather than reassurance. “Will this slow delivery?” \u2014 measure pipeline overhead before and after, and point out that eight of the nine items add seconds, because scanning is not the expensive part; untuned blocking rules are, and those are calibrated separately. “Do we need a security team first?” \u2014 no; you need named owners per control, which is an org-chart change measured in paragraphs, not headcount. “Can we start with the platform instead?” \u2014 platforms consolidate controls that already exist; buying one with nothing placed is how organisations end up paying twice for a dashboard and still lacking an owner. Each answer ends the same way: run the control in warning mode, show the numbers, then decide about blocking. Decisions made on local evidence stick; decisions imported from a slide deck get revisited every budget cycle. None of these answers require new headcount \u2014 they require calendars, owners, and the patience to watch one number per control for a month.<\/p>\n

    Sequencing Notes for Consulting Engagements<\/h2>\n

    The order above is not sacred, but the dependencies are. Items one through four are mechanical and can land inside a fortnight; they create the credibility that buys patience for items five through nine, which require tuning. Engagements that invert this \u2014 leading with the blocking gate or the platform contract \u2014 spend their political capital on arguments about noise before earning the right to be believed. For the underlying model \u2014 control families, the SSDF mapping, the metrics that prove a gate has authority \u2014 the single most useful source is the placed-controls write-up of DevSecOps<\/a>, and it doubles as a client-facing reference when definitions get contested. The integration work itself follows the pattern described in this site’s guide to folding security into DevOps pipelines<\/a>, and the assessment phase is best structured along the lines of a consulting engagement blueprint that runs from assessment to enablement<\/a> rather than a tool inventory.<\/p>\n

    A final calibration note for anyone quoting this list in a proposal: each control should be traceable to a practice in the SSDF, an owner in the client’s org chart, and a metric in the monthly review. Controls that satisfy all three survive the engagement. Controls that satisfy only the first are how DevSecOps initiatives quietly become shelfware \u2014 and the testing discipline that keeps delivery honest while all this lands is covered in the site’s piece on how automated testing changes quality and delivery speed<\/a>. Deliver the nine in order, measure behaviour instead of coverage, and the transformation conversation stops being a slide and starts being a habit.<\/p>\n","protected":false},"excerpt":{"rendered":"

    A consultant’s installation order for pipeline security: nine controls, why each earns its slot, and the sequencing that keeps delivery moving.<\/p>\n","protected":false},"author":8,"featured_media":8186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[],"class_list":["post-8185","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops-consulting"],"yoast_head":"\nNine DevSecOps Controls Worth Installing First - DevOps Consulting<\/title>\n<meta name=\"description\" content=\"Nine DevSecOps controls to install first in a delivery pipeline: pinning, permissions, secret protection, SBOMs, signing and gates, with sequencing notes.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nine DevSecOps Controls Worth Installing First - DevOps Consulting\" \/>\n<meta property=\"og:description\" content=\"Nine DevSecOps controls to install first in a delivery pipeline: pinning, permissions, secret protection, SBOMs, signing and gates, with sequencing notes.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/\" \/>\n<meta property=\"og:site_name\" content=\"DevOps Consulting\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-30T17:10:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.devopsconsulting.in\/blog\/wp-content\/uploads\/2026\/10\/b2a-banner-1135628-banner.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Kabir Malhotra\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kabir Malhotra\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/\"},\"author\":{\"name\":\"Kabir Malhotra\",\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/#\\\/schema\\\/person\\\/4cff11af81c93e658f55af13b267f093\"},\"headline\":\"Nine DevSecOps Controls Worth Installing First\",\"datePublished\":\"2026-10-30T17:10:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/\"},\"wordCount\":1356,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/b2a-banner-1135628-banner.png\",\"articleSection\":[\"DevOps consulting\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/\",\"url\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/\",\"name\":\"Nine DevSecOps Controls Worth Installing First - DevOps Consulting\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/b2a-banner-1135628-banner.png\",\"datePublished\":\"2026-10-30T17:10:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/#\\\/schema\\\/person\\\/4cff11af81c93e658f55af13b267f093\"},\"description\":\"Nine DevSecOps controls to install first in a delivery pipeline: pinning, permissions, secret protection, SBOMs, signing and gates, with sequencing notes.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/devsecops-controls-worth-installing-first\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/b2a-banner-1135628-banner.png\",\"contentUrl\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/b2a-banner-1135628-banner.png\",\"width\":1200,\"height\":630},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/\",\"name\":\"DevOps Consulting\",\"description\":\"DevOps Consulting | SRE Consulting | DevSecOps Consulting | MLOps Consulting\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/#\\\/schema\\\/person\\\/4cff11af81c93e658f55af13b267f093\",\"name\":\"Kabir Malhotra\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d77044c5c70611f0b6d1131a1758057dcb873aae1740ec1c40a13a6428461d0b?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d77044c5c70611f0b6d1131a1758057dcb873aae1740ec1c40a13a6428461d0b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d77044c5c70611f0b6d1131a1758057dcb873aae1740ec1c40a13a6428461d0b?s=96&d=mm&r=g\",\"caption\":\"Kabir Malhotra\"},\"url\":\"https:\\\/\\\/www.devopsconsulting.in\\\/blog\\\/author\\\/kabir-malhotra\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Nine DevSecOps Controls Worth Installing First - DevOps Consulting","description":"Nine DevSecOps controls to install first in a delivery pipeline: pinning, permissions, secret protection, SBOMs, signing and gates, with sequencing notes.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/","og_locale":"en_US","og_type":"article","og_title":"Nine DevSecOps Controls Worth Installing First - DevOps Consulting","og_description":"Nine DevSecOps controls to install first in a delivery pipeline: pinning, permissions, secret protection, SBOMs, signing and gates, with sequencing notes.","og_url":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/","og_site_name":"DevOps Consulting","article_published_time":"2026-10-30T17:10:00+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.devopsconsulting.in\/blog\/wp-content\/uploads\/2026\/10\/b2a-banner-1135628-banner.png","type":"image\/png"}],"author":"Kabir Malhotra","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kabir Malhotra","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/#article","isPartOf":{"@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/"},"author":{"name":"Kabir Malhotra","@id":"https:\/\/www.devopsconsulting.in\/blog\/#\/schema\/person\/4cff11af81c93e658f55af13b267f093"},"headline":"Nine DevSecOps Controls Worth Installing First","datePublished":"2026-10-30T17:10:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/"},"wordCount":1356,"commentCount":0,"image":{"@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/#primaryimage"},"thumbnailUrl":"https:\/\/www.devopsconsulting.in\/blog\/wp-content\/uploads\/2026\/10\/b2a-banner-1135628-banner.png","articleSection":["DevOps consulting"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/","url":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/","name":"Nine DevSecOps Controls Worth Installing First - DevOps Consulting","isPartOf":{"@id":"https:\/\/www.devopsconsulting.in\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/#primaryimage"},"image":{"@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/#primaryimage"},"thumbnailUrl":"https:\/\/www.devopsconsulting.in\/blog\/wp-content\/uploads\/2026\/10\/b2a-banner-1135628-banner.png","datePublished":"2026-10-30T17:10:00+00:00","author":{"@id":"https:\/\/www.devopsconsulting.in\/blog\/#\/schema\/person\/4cff11af81c93e658f55af13b267f093"},"description":"Nine DevSecOps controls to install first in a delivery pipeline: pinning, permissions, secret protection, SBOMs, signing and gates, with sequencing notes.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.devopsconsulting.in\/blog\/devsecops-controls-worth-installing-first\/#primaryimage","url":"https:\/\/www.devopsconsulting.in\/blog\/wp-content\/uploads\/2026\/10\/b2a-banner-1135628-banner.png","contentUrl":"https:\/\/www.devopsconsulting.in\/blog\/wp-content\/uploads\/2026\/10\/b2a-banner-1135628-banner.png","width":1200,"height":630},{"@type":"WebSite","@id":"https:\/\/www.devopsconsulting.in\/blog\/#website","url":"https:\/\/www.devopsconsulting.in\/blog\/","name":"DevOps Consulting","description":"DevOps Consulting | SRE Consulting | DevSecOps Consulting | MLOps Consulting","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.devopsconsulting.in\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.devopsconsulting.in\/blog\/#\/schema\/person\/4cff11af81c93e658f55af13b267f093","name":"Kabir Malhotra","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d77044c5c70611f0b6d1131a1758057dcb873aae1740ec1c40a13a6428461d0b?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d77044c5c70611f0b6d1131a1758057dcb873aae1740ec1c40a13a6428461d0b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d77044c5c70611f0b6d1131a1758057dcb873aae1740ec1c40a13a6428461d0b?s=96&d=mm&r=g","caption":"Kabir Malhotra"},"url":"https:\/\/www.devopsconsulting.in\/blog\/author\/kabir-malhotra\/"}]}},"_links":{"self":[{"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/posts\/8185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/comments?post=8185"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/posts\/8185\/revisions"}],"predecessor-version":[{"id":8198,"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/posts\/8185\/revisions\/8198"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/media\/8186"}],"wp:attachment":[{"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/media?parent=8185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/categories?post=8185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsconsulting.in\/blog\/wp-json\/wp\/v2\/tags?post=8185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}