role-aqa:security-testing

Automate security testing in CI/CD pipelines by integrating SAST, DAST, and dependency scanning tools like OWASP ZAP and SonarQube. This Skill orchestrates these tools to identify vulnerabilities, ensuring a robust security posture before deployment.

SAST analyzes source code for flaws, while DAST tests running applications. This Skill automates both SAST and DAST using tools like SonarQube and OWASP ZAP, providing comprehensive coverage to detect known and potential security vulnerabilities.

Yes, you can use OWASP ZAP to run baseline scans against staging environments. This Skill automates baseline scanning with OWASP ZAP to identify critical vulnerabilities and check project dependencies before deploying new features.

Check project dependencies for vulnerabilities using automated dependency scanning tools like Snyk and Trivy. This Skill orchestrates dependency scanning to detect known security flaws and mitigate risks within your application's libraries.

Yes, this approach includes penetration test planning alongside SAST, DAST, and dependency scanning. It provides guidance on implementing various security testing types and integrates with threat modeling processes to manage vulnerabilities effectively.

Integrate SonarQube and Trivy for vulnerability scanning by using this Skill to automate their execution. It combines SAST, DAST, and dependency scanning to detect security flaws and integrates with threat modeling processes.