skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

implementing-devsecops-security-scanning

Automate SAST, DAST, and SCA security scanning across CI/CD pipelines.

2|Updated Apr 14, 2026
Search Tags:#sast#devsecops#semgrep#trivy#security-scanning#sca#dast
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill implementing-devsecops-security-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-devsecops-security-scanning
Source: https://github.com/Acczdy/MoZiSec/tree/main/web-security/.claude/skills/implementing-devsecops-security-scanning
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill implementing-devsecops-security-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving DevSecOps pipeline setup, automated security scanning in CI/CD, SAST/DAST/SCA integration, or shift-left security implementation.

Core Features & Use Cases

  • SAST/DAST/SCA Orchestration: centralizes security checks across build, test, and release stages.
  • Tool Coverage: includes Semgrep, Trivy, OWASP ZAP, and Gitleaks for comprehensive risk detection.
  • Shift-Left Enablement: supports early vulnerability detection and governance in CI/CD pipelines.

Quick Start

Set up a DevSecOps pipeline that runs Semgrep, Trivy, and Gitleaks in CI/CD on every commit.

Frequently Asked Questions about implementing-devsecops-security-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate SAST, DAST, and SCA scanning into my CI/CD pipeline?▼

Integrate SAST, DAST, and SCA scanning into CI/CD pipelines by orchestrating Semgrep, OWASP ZAP, Trivy, and Gitleaks across build, test, and deployment stages for automated code analysis and vulnerability detection.

What is the best way to automate security scanning and secrets detection during code commits?▼

Automate security scanning and secrets detection during commits by configuring YAML-based pipeline rules to trigger Semgrep for static analysis and Gitleaks for secrets detection on every push.

Does Trivy work for SCA and container scanning in DevSecOps workflows?▼

Yes, Trivy works for SCA and container scanning in DevSecOps workflows, auditing software dependencies and container images for vulnerabilities during the CI/CD pipeline execution.

Can I use OWASP ZAP for DAST in shift-left security pipelines?▼

Yes, you can use OWASP ZAP for DAST in shift-left security pipelines to perform dynamic testing against running applications, identifying vulnerabilities during the test phase before deployment.

What tools do I need for a complete DevSecOps security scanning setup?▼

A complete DevSecOps security scanning setup requires Semgrep for SAST, OWASP ZAP for DAST, Trivy for SCA and container scanning, and Gitleaks for secrets detection across CI/CD stages.

Why should I implement shift-left security instead of post-deployment testing?▼

Implement shift-left security to detect vulnerabilities, dependency risks, and secrets early in the build and test stages, reducing remediation costs and preventing exploits before deployment.

Related Skills

Explore More Software Engineering Skills→
inbharataiinbharatai
22

jenkins-pipeline

Generate Jenkins declarative and scripted pipelines with stages, parallel execution, credentials, and shared libraries.

Community
Intermediate
d-padmanabhand-padmanabhan
15

codebase-security-audit

Audit codebases with secrets scanning, SAST, SCA, and IaC validation.

Community
Advanced
levanminhduclevanminhduc

docker

Guide containerization of applications with Dockerfiles, Compose, and CI/CD pipelines.

Community
Advanced
cosmixcosmix
53

ci-cd

Design and automate CI/CD pipelines for GitHub Actions, GitLab CI, and Jenkins.

Community
Advanced