<![CDATA[Developing a backend system for employee cooperatives requires an approach that not only delivers functional features but also ensures security integration from the earliest stages of the development lifecycle. This research aims to implement DevSecOps on the backend system of YPTM Universitas Merdeka Malang employee cooperative through the integration of Static Application Security Testing (SAST) into the Continuous Integration/Continuous Delivery (CI/CD) pipeline. The backend system is developed using the Bun runtime with oRPC library for type-safe endpoint definitions, PostgreSQL as the relational database, and Redis as the caching layer and asynchronous task queue. DevSecOps implementation is applied across four security layers: development-time, pre-merge, build-time, and runtime, while the evaluation in this study is focused on the pre-merge layer. In the pre-merge layer, SAST scanning using Semgrep runs automatically on every push and pull request event with six rulesets covering OWASP Top 10, security audit, TypeScript, JavaScript, Next.js, and SQL injection. An automated security gate is enforced with thresholds of MAX_CRITICAL=0 and MAX_HIGH=5, which fails the pipeline when vulnerability findings exceed the determined limits. Implementation results show that the pipeline detected 48 security findings, with 42 valid findings and 6 false positives, yielding a precision of 87.5%. The risk score was recorded at 210 based on customized severity weights. All findings are integrated into a risk score trend that is historically recorded for continuous security monitoring. This research demonstrates that SAST integration into the CI/CD pipeline can be implemented automatically on the cooperative backend system, with a security gate mechanism that successfully failed the pipeline in the tested scenarios. As a single case study, the results are descriptive and are not intended to be generalized]]>
