Skills_Sec

Audits project dependencies (npm, pip, Go, Maven, Gradle) for CVEs, supply chain risks, typosquatting, and dependency confusion attacks.

Performs Static Application Security Testing (SAST) on source code, identifying OWASP Top 10 vulnerabilities, critical CWEs, and insecure patterns with prioritized remediation.

Generates and audits Software Bill of Materials (SBOM) in SPDX/CycloneDX format, evaluating supply chain integrity, component risks, and regulatory compliance.

Conducts structured threat modeling (STRIDE) for features and systems, identifying attack vectors, supply chain threats, and mitigation controls at the beginning of the SDLC.

Detects hardcoded secrets, credentials, and sensitive data in source code, configuration files, and scripts before they reach the repository.

Performs a complete security review of Pull Requests and code diffs, covering business logic, attack surface, OWASP ASVS compliance, and IaC security with a formal merge verdict.