scan-vulnerabilities

To scan code for security vulnerabilities and check dependencies for known CVEs, use this skill to run static analysis with Bandit, Safety, and Semgrep. It detects unsafe coding patterns and audits project dependencies against vulnerability databases.

SAST, or static application security testing, detects unsafe coding patterns by analyzing source code without executing it. This skill uses tools like Semgrep and Bandit to identify potential exploits and security flaws directly in the codebase.

Yes, you can use Bandit, Safety, and Semgrep together for a pre-release security audit. This skill integrates these tools to perform comprehensive code scanning and dependency checking, flagging security risks before they reach production.

You integrate SAST and dependency checks into a CI/CD pipeline by applying this skill as an automated security gate. It scans code and dependencies during the build process to identify known vulnerabilities and unsafe patterns before release.

Yes, this vulnerability scan works with both source code and project dependencies. It performs code scanning to detect potential exploits directly in the source and dependency auditing to check against databases of known vulnerabilities.

SAST tools for vulnerability detection are limited to identifying unsafe static patterns and known CVEs in dependencies. They focus on source code analysis and dependency checks, and do not detect runtime security flaws or dynamic execution vulnerabilities.