implementing-devsecops-security-scanning

name	implementing-devsecops-security-scanning
description	Use when integrating Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving DevSecOps pipeline setup, automated security scanning in CI/CD, SAST/DAST/SCA integration, or shift-left security implementation.
domain	cybersecurity
tags	["devsecops","SAST","DAST","SCA","semgrep","trivy","owasp-zap","gitleaks","CI-CD","shift-left"]
subdomain	application-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-04","ID.RA-01","PR.DS-10"]

Implementing Devsecops Security Scanning

Overview

Cybersecurity skill for implementing devsecops security scanning. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing devsecops security scanning"

• "Integrates Static Application Security Testing (SAST), Dynamic Application Secur"

• Setting up automated security scanning in a new or existing CI/CD pipeline

• Shifting security left by catching vulnerabilities before code reaches production

• Meeting compliance requirements (SOC 2, PCI-DSS, ISO 27001) that mandate automated security testing

• Integrating SAST, DAST, and SCA together to achieve comprehensive application security coverage

• Establishing security gates that block deployments containing critical or high-severity vulnerabilities

Do not use as a replacement for manual penetration testing. Automated scanning catches common vulnerability patterns but cannot replace human-driven security assessments for business logic flaws and complex attack chains.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• CI/CD platform: GitHub Actions, GitLab CI, Jenkins, or Azure DevOps
• Container runtime (Docker) for running scanning tools
• A staging environment URL for DAST scanning (DAST cannot test static code)
• Repository access with permissions to modify CI/CD workflow files
• Tool-specific requirements:
  • Semgrep: free for open-source rulesets (p > security-audit, p > owasp-top-ten)
  • Trivy: free, no account required
  • OWASP ZAP: free, Docker image available
  • Gitleaks: free, no account required

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}