Integrating DevSecOps and LLM‑Enhanced Mobile Security: A Unified Framework for Automated Security Testing in Modern CI/CD Pipelines

Abstract

With the accelerating shift toward rapid software delivery through continuous integration and continuous deployment (CI/CD) pipelines, the need for robust, automated security testing has never been more critical. Traditional security processes often lag behind the pace of development, leading to increased vulnerability exposure. The DevSecOps paradigm—integrating development, operations, and security—has emerged to address this gap by embedding security checks into CI/CD workflows. Simultaneously, the rise of mobile applications that incorporate large‑language-model (LLM) functionalities introduces new privacy and security risks that demand automated, systematic testing. This paper synthesizes extant research on DevSecOps automation and extends it to propose a unified framework tailored for modern mobile applications enhanced by LLMs. Drawing on empirical and conceptual studies of automated scanning, static and dynamic analysis, heuristic algorithm‑based testing, security compliance models, and barriers to adoption, we construct a comprehensive pipeline architecture. We argue that integrating heuristic‑driven testing (via genetic algorithms), static and dynamic vulnerability detection, security compliance artifacts, and specialized LLM‑privacy testing can significantly raise the security baseline while maintaining deployment velocity. We elaborate on architectural design, methodological considerations, potential challenges, and future directions, including governance, scalability, and human-in-the-loop oversight. This synthesis aims to guide both academia and industry toward more resilient, automated security practices in a landscape increasingly shaped by AI‑enhanced mobile software.