Security scanning: dependency audits, SAST, secrets detection. Use when setting up Dependabot, CodeQL, or TruffleHog in CI, or creating a SECURITY.md policy.
Security scanning: dependency audits, SAST, secrets detection. Use when setting up Dependabot, CodeQL, or TruffleHog in CI, or creating a SECURITY.md policy.
Use WebSearch or WebFetch to verify current versions.
Step 2: Detect project languages and security posture
Run the detection script to scan the project for language signals and the
three security layers (dependency auditing / SAST / secret detection) plus a
SECURITY.md policy:
Parse STATUS= and the ISSUES: block from the output. The KEY=VALUE lines
report language detection (LANG_JS, LANG_PYTHON, LANG_RUST, LANG_GO) and
the presence matrix (DEPENDABOT, CODEQL, GITLEAKS_CONFIG, SECURITY_POLICY,
TRUFFLEHOG, DEPENDENCY_REVIEW, SECURITY_LAYERS_PRESENT).
Step 3: Generate compliance report
Print a formatted compliance report showing status for each security component across dependency auditing, SAST scanning, secret detection, and security policies.
If --check-only is set, stop here.
For the compliance report format, see REFERENCE.md.
Step 4: Configure dependency auditing (if --fix or user confirms)
For complete configuration templates, see REFERENCE.md.
Step 5: Configure SAST scanning (if --fix or user confirms)
Create CodeQL workflow .github/workflows/codeql.yml with detected languages
For Python projects, install and configure Bandit
Run Bandit: uv run bandit -r src/ -f json -o bandit-report.json
For CodeQL workflow and Bandit configuration templates, see REFERENCE.md.
Step 6: Configure secret detection (if --fix or user confirms)
Install gitleaks: brew install gitleaks (or go install github.com/gitleaks/gitleaks/v8@latest)
Create .gitleaks.toml with project-specific allowlists
Run initial scan: gitleaks detect --source .
Add pre-commit hook to .pre-commit-config.yaml
Optionally configure TruffleHog workflow for CI
For gitleaks, TruffleHog, and CI workflow configuration templates, see REFERENCE.md.
Step 7: Create security policy
Create SECURITY.md from the template (supported-versions table, vulnerability
reporting process, report contents, best practices, automated-tools list) in
REFERENCE.md.
Step 8: Configure CI/CD integration
Create comprehensive security workflow .github/workflows/security.yml with jobs for:
Dependency audit
Secret scanning (TruffleHog)
SAST scan (CodeQL)
Schedule weekly scans in addition to push/PR triggers.
For the CI security workflow template, see REFERENCE.md.
Step 9: Update standards tracking
Update .project-standards.yaml with the security component keys. For the
exact block, see REFERENCE.md.
Step 10: Report configuration results
Print a summary of all changes made across dependency auditing, SAST scanning, secret detection, security policy, and CI/CD integration. Include next steps for reviewing Dependabot PRs, CodeQL findings, and enabling private vulnerability reporting.
