[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6J3C8HPRWSC133MS7TRWT2V":3,"skill-same:01M6J3C8HPRWSC133MS7TRWT2V":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6J3C8HPRWSC133MS7TRWT2V","implementing-devsecops-security-scanning",null,"Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI\u002FCD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving DevSecOps pipeline setup, automated security scanning in CI\u002FCD, SAST\u002FDAST\u002FSCA integration, or shift-left security implementation.","onfire7777\u002Funiversal-ai-skills-library","onfire7777","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F240866566?v=4","01M6HZJCF2QEW8DY7HE1JDKGK2","Jake B","01M6HZJCKK8SEXKN76V9SGKZ12",17,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-devsecops-security-scanning\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing devsecops security scanning","implementing","security scanning","scanning","security","devsecops","ci","pipeline","SCA","semgrep","owasp-zap","gitleaks","testing","analysis","secrets","Composition","open","cybersecurity","CI\u002FCD","container scanning","2026-11-10 10:12:30",false,"---\nname: implementing-devsecops-security-scanning\nlicense: Apache-2.0\ndescription: Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI\u002FCD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving DevSecOps pipeline setup, automated security scanning in CI\u002FCD, SAST\u002FDAST\u002FSCA integration, or shift-left security implementation.\nmetadata:\n  domain: cybersecurity\n  subdomain: application-security\n  tags:\n  - devsecops\n  - SAST\n  - DAST\n  - SCA\n  - semgrep\n  - trivy\n  - owasp-zap\n  - gitleaks\n  - CI-CD\n  - shift-left\n  version: 1.0.0\n  author: mahipal\n---\n# Implementing DevSecOps Security Scanning\n\n## When to Use\n\n- Setting up automated security scanning in a new or existing CI\u002FCD pipeline\n- Shifting security left by catching vulnerabilities before code reaches production\n- Meeting compliance requirements (SOC 2, PCI-DSS, ISO 27001) that mandate automated security testing\n- Integrating SAST, DAST, and SCA together to achieve comprehensive application security coverage\n- Establishing security gates that block deployments containing critical or high-severity vulnerabilities\n\n**Do not use** as a replacement for manual penetration testing. Automated scanning catches common vulnerability patterns but cannot replace human-driven security assessments for business logic flaws and complex attack chains.\n\n## Prerequisites\n\n- CI\u002FCD platform: GitHub Actions, GitLab CI, Jenkins, or Azure DevOps\n- Container runtime (Docker) for running scanning tools\n- A staging environment URL for DAST scanning (DAST cannot test static code)\n- Repository access with permissions to modify CI\u002FCD workflow files\n- Tool-specific requirements:\n  - Semgrep: free for open-source rulesets (`p\u002Fsecurity-audit`, `p\u002Fowasp-top-ten`)\n  - Trivy: free, no account required\n  - OWASP ZAP: free, Docker image available\n  - Gitleaks: free, no account required\n\n## Workflow\n\n### Step 1: Add Secrets Detection with Gitleaks\n\nSecrets detection runs first because leaked credentials are the highest-priority finding. Add to `.github\u002Fworkflows\u002Fsecurity.yml`:\n\n```yaml\nname: DevSecOps Security Pipeline\non:\n  push:\n    branches: [main, develop]\n  pull_request:\n    branches: [main]\n\njobs:\n  secrets-scan:\n    name: Secrets Detection (Gitleaks)\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0  # Full history for scanning all commits\n\n      - name: Run Gitleaks\n        uses: gitleaks\u002Fgitleaks-action@v2\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n```\n\nConfigure `.gitleaks.toml` in the repository root for custom rules and allowlists:\n\n```toml\n[extend]\nuseDefault = true\n\n[allowlist]\ndescription = \"Global allowlist\"\npaths = [\n  '''\\.gitleaks\\.toml''',\n  '''test\u002Ffixtures\u002F.*''',\n  '''docs\u002Fexamples\u002F.*'''\n]\n\n[[rules]]\nid = \"custom-internal-api-key\"\ndescription = \"Internal API key pattern\"\nregex = '''INTERNAL_KEY_[A-Za-z0-9]{32}'''\ntags = [\"internal\", \"api-key\"]\n```\n\n### Step 2: Add SAST Scanning with Semgrep\n\nSemgrep performs static code analysis to find security vulnerabilities, bugs, and code patterns:\n\n```yaml\n  sast-scan:\n    name: SAST (Semgrep)\n    runs-on: ubuntu-latest\n    container:\n      image: semgrep\u002Fsemgrep\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Semgrep SAST scan\n        run: |\n          semgrep scan \\\n            --config p\u002Fsecurity-audit \\\n            --config p\u002Fowasp-top-ten \\\n            --config p\u002Fsecrets \\\n            --severity ERROR \\\n            --error \\\n            --json \\\n            --output semgrep-results.json \\\n            .\n\n      - name: Upload SAST results\n        if: always()\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: semgrep-results\n          path: semgrep-results.json\n```\n\nFor custom rules, create `.semgrep\u002Fcustom-rules.yml`:\n\n```yaml\nrules:\n  - id: no-exec-user-input\n    patterns:\n      - pattern: exec($INPUT)\n      - pattern-not: exec(\"...\")\n    message: >\n      User input passed to exec(). This is a command injection vulnerability.\n    severity: ERROR\n    languages: [python]\n    metadata:\n      cwe: \"CWE-78: OS Command Injection\"\n      owasp: \"A03:2021 - Injection\"\n\n  - id: no-raw-sql-queries\n    patterns:\n      - pattern: cursor.execute(f\"...\")\n      - pattern: cursor.execute(\"...\" + ...)\n    message: >\n      SQL query built with string concatenation or f-strings. Use parameterized queries.\n    severity: ERROR\n    languages: [python]\n    metadata:\n      cwe: \"CWE-89: SQL Injection\"\n      owasp: \"A03:2021 - Injection\"\n```\n\n### Step 3: Add SCA Scanning with Trivy\n\nTrivy scans dependencies, container images, IaC files, and generates SBOM:\n\n```yaml\n  sca-scan:\n    name: SCA & Container Scan (Trivy)\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Trivy filesystem scan (dependencies)\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          scan-type: 'fs'\n          scan-ref: '.'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          format: 'json'\n          output: 'trivy-fs-results.json'\n\n      - name: Run Trivy IaC scan (Terraform, CloudFormation)\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          scan-type: 'config'\n          scan-ref: '.'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          format: 'json'\n          output: 'trivy-iac-results.json'\n\n      - name: Upload SCA results\n        if: always()\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: trivy-results\n          path: trivy-*.json\n\n  container-scan:\n    name: Container Image Scan (Trivy)\n    runs-on: ubuntu-latest\n    needs: [sast-scan]  # Build image only after SAST passes\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build Docker image\n        run: docker build -t app:${{ github.sha }} .\n\n      - name: Scan container image\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          image-ref: 'app:${{ github.sha }}'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          format: 'json'\n          output: 'trivy-image-results.json'\n\n      - name: Generate SBOM\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          image-ref: 'app:${{ github.sha }}'\n          format: 'cyclonedx'\n          output: 'sbom.json'\n\n      - name: Upload SBOM\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: sbom\n          path: sbom.json\n```\n\n### Step 4: Add DAST Scanning with OWASP ZAP\n\nDAST runs against a deployed staging environment. It is slower than SAST\u002FSCA and should run asynchronously or on a schedule:\n\n```yaml\n  dast-scan:\n    name: DAST (OWASP ZAP)\n    runs-on: ubuntu-latest\n    needs: [deploy-staging]  # Must run after app is deployed to staging\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run ZAP Baseline Scan (fast, suitable for CI)\n        uses: zaproxy\u002Faction-baseline@v0.14.0\n        with:\n          target: ${{ vars.STAGING_URL }}\n          rules_file_name: '.zap\u002Frules.tsv'\n          cmd_options: '-a -j'\n\n      # For nightly full scans, use action-full-scan instead:\n      # - name: Run ZAP Full Scan (comprehensive, 30-60 min)\n      #   uses: zaproxy\u002Faction-full-scan@v0.12.0\n      #   with:\n      #     target: ${{ vars.STAGING_URL }}\n```\n\nCreate `.zap\u002Frules.tsv` to configure alert thresholds:\n\n```tsv\n10010\tIGNORE\t(Cookie No HttpOnly Flag - acceptable for non-sensitive cookies)\n10011\tIGNORE\t(Cookie Without Secure Flag - staging uses HTTP)\n90033\tWARN\t(Loosely Scoped Cookie)\n10038\tFAIL\t(Content Security Policy Header Not Set)\n40012\tFAIL\t(Cross Site Scripting - Reflected)\n40014\tFAIL\t(Cross Site Scripting - Persistent)\n40018\tFAIL\t(SQL Injection)\n90019\tFAIL\t(Server Side Code Injection)\n90020\tFAIL\t(Remote OS Command Injection)\n```\n\n### Step 5: Aggregate Results and Enforce Security Gates\n\nCreate a summary job that aggregates all scan results and enforces pass\u002Ffail gates:\n\n```yaml\n  security-gate:\n    name: Security Gate\n    runs-on: ubuntu-latest\n    needs: [secrets-scan, sast-scan, sca-scan, container-scan]\n    if: always()\n    steps:\n      - name: Check scan results\n        run: |\n          echo \"Checking security scan results...\"\n\n          # Fail the pipeline if any upstream job failed\n          if [[ \"${{ needs.secrets-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: Secrets detected in repository\"\n            exit 1\n          fi\n\n          if [[ \"${{ needs.sast-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: SAST found critical\u002Fhigh vulnerabilities\"\n            exit 1\n          fi\n\n          if [[ \"${{ needs.sca-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: SCA found critical\u002Fhigh vulnerable dependencies\"\n            exit 1\n          fi\n\n          if [[ \"${{ needs.container-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: Container image has critical\u002Fhigh vulnerabilities\"\n            exit 1\n          fi\n\n          echo \"All security gates passed\"\n```\n\n### Step 6: Configure Branch Protection Rules\n\nEnforce the security pipeline as a required status check:\n\n```\nGitHub Repository > Settings > Branches > Branch Protection Rules\n\nBranch name pattern: main\n  Require status checks to pass before merging: Enabled\n    Required status checks:\n      - Secrets Detection (Gitleaks)\n      - SAST (Semgrep)\n      - SCA & Container Scan (Trivy)\n      - Security Gate\n  Require branches to be up to date before merging: Enabled\n```\n\n### Step 7: Set Up Developer Feedback Loop\n\nConfigure pre-commit hooks so developers catch issues before pushing:\n\n```yaml\n# .pre-commit-config.yaml\nrepos:\n  - repo: https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\n    rev: v8.22.1\n    hooks:\n      - id: gitleaks\n\n  - repo: https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fsemgrep\n    rev: v1.102.0\n    hooks:\n      - id: semgrep\n        args: ['--config', 'p\u002Fsecurity-audit', '--config', 'p\u002Fowasp-top-ten', '--error']\n```\n\nInstall and activate pre-commit:\n\n```bash\npip install pre-commit\npre-commit install\npre-commit run --all-files  # Test against existing codebase\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SAST (Static Application Security Testing)** | Analyzes source code without executing it to find security vulnerabilities; runs fast, catches issues early, but cannot find runtime flaws |\n| **DAST (Dynamic Application Security Testing)** | Tests a running application by sending requests and analyzing responses; finds runtime issues but requires a deployed environment |\n| **SCA (Software Composition Analysis)** | Scans project dependencies against vulnerability databases (NVD, GitHub Advisory) to find known-vulnerable libraries |\n| **SBOM (Software Bill of Materials)** | Machine-readable inventory of all components and dependencies in an application, used for vulnerability tracking and compliance |\n| **Shift Left** | Security practice of moving security testing earlier in the SDLC, from post-deployment to pre-commit and CI stages |\n| **Security Gate** | A CI\u002FCD pipeline checkpoint that blocks deployment if security scan results exceed defined severity thresholds |\n| **Pre-commit Hook** | Local Git hook that runs security checks before code is committed, providing the fastest developer feedback loop |\n\n## Verification\n\n- [ ] Gitleaks blocks commits and PRs containing hardcoded secrets (test with a dummy API key)\n- [ ] Semgrep scan runs on every PR and reports findings as annotations or comments\n- [ ] Trivy filesystem scan detects a known-vulnerable dependency (test by adding a vulnerable package)\n- [ ] Trivy container scan runs successfully against the built Docker image\n- [ ] SBOM is generated and stored as a build artifact in CycloneDX or SPDX format\n- [ ] OWASP ZAP baseline scan runs against the staging URL without crashing\n- [ ] Security gate job blocks merges to main when any scan finds critical\u002Fhigh severity issues\n- [ ] Branch protection rules enforce required status checks before merge\n- [ ] Pre-commit hooks catch secrets and SAST findings locally before push\n- [ ] Developer documentation explains how to interpret scan results and fix common findings\n","# Implementing DevSecOps Security Scanning\n\n## When to Use\n\n- Setting up automated security scanning in a new or existing CI\u002FCD pipeline\n- Shifting security left by catching vulnerabilities before code reaches production\n- Meeting compliance requirements (SOC 2, PCI-DSS, ISO 27001) that mandate automated security testing\n- Integrating SAST, DAST, and SCA together to achieve comprehensive application security coverage\n- Establishing security gates that block deployments containing critical or high-severity vulnerabilities\n\n**Do not use** as a replacement for manual penetration testing. Automated scanning catches common vulnerability patterns but cannot replace human-driven security assessments for business logic flaws and complex attack chains.\n\n## Prerequisites\n\n- CI\u002FCD platform: GitHub Actions, GitLab CI, Jenkins, or Azure DevOps\n- Container runtime (Docker) for running scanning tools\n- A staging environment URL for DAST scanning (DAST cannot test static code)\n- Repository access with permissions to modify CI\u002FCD workflow files\n- Tool-specific requirements:\n  - Semgrep: free for open-source rulesets (`p\u002Fsecurity-audit`, `p\u002Fowasp-top-ten`)\n  - Trivy: free, no account required\n  - OWASP ZAP: free, Docker image available\n  - Gitleaks: free, no account required\n\n## Workflow\n\n### Step 1: Add Secrets Detection with Gitleaks\n\nSecrets detection runs first because leaked credentials are the highest-priority finding. Add to `.github\u002Fworkflows\u002Fsecurity.yml`:\n\n```yaml\nname: DevSecOps Security Pipeline\non:\n  push:\n    branches: [main, develop]\n  pull_request:\n    branches: [main]\n\njobs:\n  secrets-scan:\n    name: Secrets Detection (Gitleaks)\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0  # Full history for scanning all commits\n\n      - name: Run Gitleaks\n        uses: gitleaks\u002Fgitleaks-action@v2\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n```\n\nConfigure `.gitleaks.toml` in the repository root for custom rules and allowlists:\n\n```toml\n[extend]\nuseDefault = true\n\n[allowlist]\ndescription = \"Global allowlist\"\npaths = [\n  '''\\.gitleaks\\.toml''',\n  '''test\u002Ffixtures\u002F.*''',\n  '''docs\u002Fexamples\u002F.*'''\n]\n\n[[rules]]\nid = \"custom-internal-api-key\"\ndescription = \"Internal API key pattern\"\nregex = '''INTERNAL_KEY_[A-Za-z0-9]{32}'''\ntags = [\"internal\", \"api-key\"]\n```\n\n### Step 2: Add SAST Scanning with Semgrep\n\nSemgrep performs static code analysis to find security vulnerabilities, bugs, and code patterns:\n\n```yaml\n  sast-scan:\n    name: SAST (Semgrep)\n    runs-on: ubuntu-latest\n    container:\n      image: semgrep\u002Fsemgrep\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Semgrep SAST scan\n        run: |\n          semgrep scan \\\n            --config p\u002Fsecurity-audit \\\n            --config p\u002Fowasp-top-ten \\\n            --config p\u002Fsecrets \\\n            --severity ERROR \\\n            --error \\\n            --json \\\n            --output semgrep-results.json \\\n            .\n\n      - name: Upload SAST results\n        if: always()\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: semgrep-results\n          path: semgrep-results.json\n```\n\nFor custom rules, create `.semgrep\u002Fcustom-rules.yml`:\n\n```yaml\nrules:\n  - id: no-exec-user-input\n    patterns:\n      - pattern: exec($INPUT)\n      - pattern-not: exec(\"...\")\n    message: >\n      User input passed to exec(). This is a command injection vulnerability.\n    severity: ERROR\n    languages: [python]\n    metadata:\n      cwe: \"CWE-78: OS Command Injection\"\n      owasp: \"A03:2021 - Injection\"\n\n  - id: no-raw-sql-queries\n    patterns:\n      - pattern: cursor.execute(f\"...\")\n      - pattern: cursor.execute(\"...\" + ...)\n    message: >\n      SQL query built with string concatenation or f-strings. Use parameterized queries.\n    severity: ERROR\n    languages: [python]\n    metadata:\n      cwe: \"CWE-89: SQL Injection\"\n      owasp: \"A03:2021 - Injection\"\n```\n\n### Step 3: Add SCA Scanning with Trivy\n\nTrivy scans dependencies, container images, IaC files, and generates SBOM:\n\n```yaml\n  sca-scan:\n    name: SCA & Container Scan (Trivy)\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run Trivy filesystem scan (dependencies)\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          scan-type: 'fs'\n          scan-ref: '.'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          format: 'json'\n          output: 'trivy-fs-results.json'\n\n      - name: Run Trivy IaC scan (Terraform, CloudFormation)\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          scan-type: 'config'\n          scan-ref: '.'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          format: 'json'\n          output: 'trivy-iac-results.json'\n\n      - name: Upload SCA results\n        if: always()\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: trivy-results\n          path: trivy-*.json\n\n  container-scan:\n    name: Container Image Scan (Trivy)\n    runs-on: ubuntu-latest\n    needs: [sast-scan]  # Build image only after SAST passes\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Build Docker image\n        run: docker build -t app:${{ github.sha }} .\n\n      - name: Scan container image\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          image-ref: 'app:${{ github.sha }}'\n          severity: 'CRITICAL,HIGH'\n          exit-code: '1'\n          format: 'json'\n          output: 'trivy-image-results.json'\n\n      - name: Generate SBOM\n        uses: aquasecurity\u002Ftrivy-action@0.28.0\n        with:\n          image-ref: 'app:${{ github.sha }}'\n          format: 'cyclonedx'\n          output: 'sbom.json'\n\n      - name: Upload SBOM\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: sbom\n          path: sbom.json\n```\n\n### Step 4: Add DAST Scanning with OWASP ZAP\n\nDAST runs against a deployed staging environment. It is slower than SAST\u002FSCA and should run asynchronously or on a schedule:\n\n```yaml\n  dast-scan:\n    name: DAST (OWASP ZAP)\n    runs-on: ubuntu-latest\n    needs: [deploy-staging]  # Must run after app is deployed to staging\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Run ZAP Baseline Scan (fast, suitable for CI)\n        uses: zaproxy\u002Faction-baseline@v0.14.0\n        with:\n          target: ${{ vars.STAGING_URL }}\n          rules_file_name: '.zap\u002Frules.tsv'\n          cmd_options: '-a -j'\n\n      # For nightly full scans, use action-full-scan instead:\n      # - name: Run ZAP Full Scan (comprehensive, 30-60 min)\n      #   uses: zaproxy\u002Faction-full-scan@v0.12.0\n      #   with:\n      #     target: ${{ vars.STAGING_URL }}\n```\n\nCreate `.zap\u002Frules.tsv` to configure alert thresholds:\n\n```tsv\n10010\tIGNORE\t(Cookie No HttpOnly Flag - acceptable for non-sensitive cookies)\n10011\tIGNORE\t(Cookie Without Secure Flag - staging uses HTTP)\n90033\tWARN\t(Loosely Scoped Cookie)\n10038\tFAIL\t(Content Security Policy Header Not Set)\n40012\tFAIL\t(Cross Site Scripting - Reflected)\n40014\tFAIL\t(Cross Site Scripting - Persistent)\n40018\tFAIL\t(SQL Injection)\n90019\tFAIL\t(Server Side Code Injection)\n90020\tFAIL\t(Remote OS Command Injection)\n```\n\n### Step 5: Aggregate Results and Enforce Security Gates\n\nCreate a summary job that aggregates all scan results and enforces pass\u002Ffail gates:\n\n```yaml\n  security-gate:\n    name: Security Gate\n    runs-on: ubuntu-latest\n    needs: [secrets-scan, sast-scan, sca-scan, container-scan]\n    if: always()\n    steps:\n      - name: Check scan results\n        run: |\n          echo \"Checking security scan results...\"\n\n          # Fail the pipeline if any upstream job failed\n          if [[ \"${{ needs.secrets-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: Secrets detected in repository\"\n            exit 1\n          fi\n\n          if [[ \"${{ needs.sast-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: SAST found critical\u002Fhigh vulnerabilities\"\n            exit 1\n          fi\n\n          if [[ \"${{ needs.sca-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: SCA found critical\u002Fhigh vulnerable dependencies\"\n            exit 1\n          fi\n\n          if [[ \"${{ needs.container-scan.result }}\" == \"failure\" ]]; then\n            echo \"BLOCKED: Container image has critical\u002Fhigh vulnerabilities\"\n            exit 1\n          fi\n\n          echo \"All security gates passed\"\n```\n\n### Step 6: Configure Branch Protection Rules\n\nEnforce the security pipeline as a required status check:\n\n```\nGitHub Repository > Settings > Branches > Branch Protection Rules\n\nBranch name pattern: main\n  Require status checks to pass before merging: Enabled\n    Required status checks:\n      - Secrets Detection (Gitleaks)\n      - SAST (Semgrep)\n      - SCA & Container Scan (Trivy)\n      - Security Gate\n  Require branches to be up to date before merging: Enabled\n```\n\n### Step 7: Set Up Developer Feedback Loop\n\nConfigure pre-commit hooks so developers catch issues before pushing:\n\n```yaml\n# .pre-commit-config.yaml\nrepos:\n  - repo: https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks\n    rev: v8.22.1\n    hooks:\n      - id: gitleaks\n\n  - repo: https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fsemgrep\n    rev: v1.102.0\n    hooks:\n      - id: semgrep\n        args: ['--config', 'p\u002Fsecurity-audit', '--config', 'p\u002Fowasp-top-ten', '--error']\n```\n\nInstall and activate pre-commit:\n\n```bash\npip install pre-commit\npre-commit install\npre-commit run --all-files  # Test against existing codebase\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SAST (Static Application Security Testing)** | Analyzes source code without executing it to find security vulnerabilities; runs fast, catches issues early, but cannot find runtime flaws |\n| **DAST (Dynamic Application Security Testing)** | Tests a running application by sending requests and analyzing responses; finds runtime issues but requires a deployed environment |\n| **SCA (Software Composition Analysis)** | Scans project dependencies against vulnerability databases (NVD, GitHub Advisory) to find known-vulnerable libraries |\n| **SBOM (Software Bill of Materials)** | Machine-readable inventory of all components and dependencies in an application, used for vulnerability tracking and compliance |\n| **Shift Left** | Security practice of moving security testing earlier in the SDLC, from post-deployment to pre-commit and CI stages |\n| **Security Gate** | A CI\u002FCD pipeline checkpoint that blocks deployment if security scan results exceed defined severity thresholds |\n| **Pre-commit Hook** | Local Git hook that runs security checks before code is committed, providing the fastest developer feedback loop |\n\n## Verification\n\n- [ ] Gitleaks blocks commits and PRs containing hardcoded secrets (test with a dummy API key)\n- [ ] Semgrep scan runs on every PR and reports findings as annotations or comments\n- [ ] Trivy filesystem scan detects a known-vulnerable dependency (test by adding a vulnerable package)\n- [ ] Trivy container scan runs successfully against the built Docker image\n- [ ] SBOM is generated and stored as a build artifact in CycloneDX or SPDX format\n- [ ] OWASP ZAP baseline scan runs against the staging URL without crashing\n- [ ] Security gate job blocks merges to main when any scan finds critical\u002Fhigh severity issues\n- [ ] Branch protection rules enforce required status checks before merge\n- [ ] Pre-commit hooks catch secrets and SAST findings locally before push\n- [ ] Developer documentation explains how to interpret scan results and fix common findings\n",{"name":5,"license":15,"metadata":49,"description":7},{"tags":50,"author":56,"domain":41,"version":57,"subdomain":58},[29,51,52,32,33,53,34,35,54,55],"SAST","DAST","trivy","CI-CD","shift-left","mahipal","1.0.0","application-security","main","2a76bf42ce5c860adf8d0f3fcf3f6804109ac65b","skills\u002Fimplementing-devsecops-security-scanning",0,"https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fwiki","https:\u002F\u002Fgithub.com\u002Fonfire7777","trying to create something actually useful","2026-09-11 13:25:26",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add onfire7777\u002Funiversal-ai-skills-library --skill implementing-devsecops-security-scanning",{"tool":74,"command":75},"bunx","bunx skills add onfire7777\u002Funiversal-ai-skills-library --skill implementing-devsecops-security-scanning",{"tool":77,"command":78},"pnpm","pnpm dlx skills add onfire7777\u002Funiversal-ai-skills-library --skill implementing-devsecops-security-scanning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-devsecops-security-scanning\u002FSKILL.md",true,[82,87,93],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-devsecops-security-scanning\u002FLICENSE",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fapi-reference.md","REFERENCE","参考文档",2039,"https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-devsecops-security-scanning\u002Freferences\u002Fapi-reference.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fagent.py","SCRIPT","脚本",6930,"https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-devsecops-security-scanning\u002Fscripts\u002Fagent.py",[100,129,138,148,169,185],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":104,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":116,"publishedAt":44},"01M6J7MPK8ZE9VQJR4KK6ZMZJQ","zyte-api-automation","Automate Zyte API tasks via Rube MCP (Composio). Always search tools first for current schemas.","MIT","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fzyte-api-automation\u002FSKILL.md",[107,110,111],{"categoryNo":108,"categoryName":109,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[117,118,119,120,121,122,123,124,125,126,127,128],"automation","api","zyte api automation","for","MCP","via","composio","automate","first","Tools","search","tasks",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":104,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":44},"01M6J7MK45K2ZZ0EWTP1N6SZ7F","zylvie-automation","Automate Zylvie tasks via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fzylvie-automation\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,137,121,128,120,122,123,124,125,126,127],"zylvie automation",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":104,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":44},"01M6J7MGDCVZ3YCXGEAPR5V3MS","zoominfo-automation","Automate Zoominfo tasks via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fzoominfo-automation\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,147,117,124,123,126,122,128,120,127,121,125],"zoominfo","zoominfo automation",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":104,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":155,"publishedAt":44},"01M6J7MDK48N09B7C6H9TCPY9A","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[154],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[156,157,158,159,160,161,162,163,164,165,166,167,168],"zoom out","zoom","perspective","code","re","you","with","understand","it","use","context","how","true",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":104,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":44},"01M6J7MAD47Q9A55AK3EXS914H","zoho-mail-automation","Automate Zoho Mail tasks via Rube MCP (Composio): email sending, folders, labels, and mailbox management. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fzoho-mail-automation\u002FSKILL.md",[175],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[177,178,179,180,117,181,127,128,121,126,182,120,122,183,123,184,124,125],"mail","zoho mail automation","zoho","zoho mail","email","labels","mailbox","management",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":104,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":195,"publishedAt":44},"01M6J7M76HTWPP8TRWWCDS42NB","zoho-invoice-automation","Automate Zoho Invoice tasks via Rube MCP (Composio): invoices, estimates, expenses, clients, and payment tracking. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fonfire7777\u002Funiversal-ai-skills-library\u002Fblob\u002Fmain\u002Fskills\u002Fzoho-invoice-automation\u002FSKILL.md",[191,192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":193,"categoryName":194,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000040","财务",[196,117,179,197,121,122,120,198,199,200,123,201,202,124,125,126,127,128],"invoice","zoho invoice automation","invoices","expenses","clients","payment","tracking"]