moai-domain-security

SAST scanning automates security vulnerability detection in code during CI/CD execution. Use tools like Bandit for Python, integrate them into your pipeline stages, and configure them to block builds on high-severity findings. This Skill provides SAST workflow patterns and tooling guidance for multiple languages.

Secrets management prevents hardcoded credentials in code. Implement scanning tools that detect exposed API keys, tokens, and passwords before commit. This Skill enforces secrets detection patterns and integrates quality gates to catch leaks early in your development workflow.

Dependency security scanning, powered by tools like Trivy, detects known vulnerabilities in third-party libraries. The scanner generates reports with severity levels and remediation paths. This Skill automates dependency checks across CI/CD and provides migration guidance for vulnerable packages.

Yes. This Skill integrates language detection to apply OWASP Top 10 security patterns consistently across codebases written in different languages. It works with language-specific tools and enforces unified security standards regardless of your tech stack.

Security-focused quality gates enforce minimum standards like ≥85% test coverage and SAST compliance before code merges. This Skill applies TRUST 5 alignment checks and generates test/lint plans, ensuring only code meeting security baselines proceeds to production.

SAST finds vulnerabilities in source code; DAST tests running applications for runtime security flaws. Running both catches different vulnerability classes. This Skill guides integration of both workflows into design discussions and code reviews for comprehensive coverage.