appsec-scan

To run CI security scanners locally, you can execute tools like Fortify, Parasoft, Trivy, and Scantist against your project to identify vulnerabilities before pushing. This mirrors your CI security pipeline locally and aggregates results into a severity-gated summary.

A pre-push security check runs SAST and SCA scanners like Pylint and ESLint on Python and JavaScript code to catch high or critical vulnerabilities early. It generates per-scanner results and a final severity gate that fails if critical issues are found.

Yes, local security scanning supports Java projects using Gradle and Maven through Parasoft Jtest. It orchestrates the execution of these SAST scanners alongside Python and JavaScript tools to provide aggregated vulnerability reports.

Yes, you can use Trivy for container image scanning as part of a local security scan. Trivy executes alongside SAST tools like Fortify and Scantist to provide comprehensive vulnerability coverage, with all results collected in a dedicated directory.

The best way to aggregate SAST and SCA scan results locally is to run multiple scanners in parallel and collect outputs in a single directory. This approach produces a unified severity-gated summary that fails on critical or high findings.

You should not use a local CI security pipeline for general code review, unit testing, or lint-only requests. It is specifically designed to execute CI-grade SAST, SCA, and container image security scans before pushing code to GitLab.