dvscps-sec-scan

name	dvscps-sec-scan
description	Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving DevSecOps pipeline setup, automated security scanning in CI/CD, SAST/DAST/SCA integration, or shift-left security implementation.
domain	cybersecurity
subdomain	application-security
tags	["devsecops","SAST","DAST","SCA","semgrep","trivy","owasp-zap","gitleaks","CI-CD","shift-left"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-04","ID.RA-01","PR.DS-10"]

Implementing DevSecOps Security Scanning

When to Use

• Setting up automated security scanning in a new or existing CI/CD pipeline
• Shifting security left by catching vulnerabilities before code reaches production
• Meeting compliance requirements (SOC 2, PCI-DSS, ISO 27001) that mandate automated security testing
• Integrating SAST, DAST, and SCA together to achieve comprehensive application security coverage
• Establishing security gates that block deployments containing critical or high-severity vulnerabilities

Do not use as a replacement for manual penetration testing. Automated scanning catches common vulnerability patterns but cannot replace human-driven security assessments for business logic flaws and complex attack chains.

Prerequisites

• CI/CD platform: GitHub Actions, GitLab CI, Jenkins, or Azure DevOps
• Container runtime (Docker) for running scanning tools
• A staging environment URL for DAST scanning (DAST cannot test static code)
• Repository access with permissions to modify CI/CD workflow files
• Tool-specific requirements:
  • Semgrep: free for open-source rulesets (p/security-audit, p/owasp-top-ten)
  • Trivy: free, no account required
  • OWASP ZAP: free, Docker image available
  • Gitleaks: free, no account required

Workflow

Step 1: Add Secrets Detection with Gitleaks

Secrets detection runs first because leaked credentials are the highest-priority finding. Add to .github/workflows/security.yml:

name: DevSecOps Security Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  secrets-scan:
    name: Secrets Detection (Gitleaks)
    runs-on: ubuntu-latest