security-scan

Automating code security scanning across your repository involves running rule-based checks against the codebase to identify vulnerabilities and log findings. This skill scans all areas, including apps, APIs, web, and infrastructure, classifying issues by domain and severity for triage.

Security rules to check in a codebase include deny-by-default, schema-at-boundary, parameterized-queries-only, error-sanitization, and no-secrets-in-output. Additional rules cover webhook-verification, rate-limit-auth, defense-in-depth-headers, and presigned-url-controls.

Triage security vulnerabilities found during a code scan by classifying each finding by domain and severity. The scan routes classified findings to the appropriate board lanes, providing actionable remediation guidance and rationale from defined references.

Yes, you can run security audits on CI for your API and web apps. The defined rule set includes audit-on-ci, ensuring findings are documented on the correct board and lane automatically during the continuous integration process.

Yes, this code scan checks for webhook verification and rate limiting. The rule set includes webhook-verification and rate-limit-auth rules, scanning the platform codebase to ensure these security controls are properly implemented and logged.

You get remediation guidance for security findings by running a scan that implements defined rules via references and runtime checks. The scan produces actionable guidance, classifying findings by domain and severity and routing them to the correct board lanes.