security-testing

OWASP Top 10 testing systematically checks for critical vulnerabilities like injection, broken authentication, and misconfiguration. This Skill applies OWASP principles to scan endpoints, validate authentication and authorization, perform dependency scanning, and detect secrets exposure across your codebase and CI/CD pipeline using integrated tools like SonarQube, Semgrep, and OWASP ZAP.

Yes. This Skill integrates security testing directly into CI/CD workflows, running automated SAST and DAST scans, dependency scanning, and secret detection on every build. It supports tools like Snyk, npm audit, TruffleHog, and OWASP ZAP to catch vulnerabilities early without manual intervention.

Security testing covers authentication and authorization validation, injection attack testing, secrets and misconfiguration detection, rate-limiting checks, and threat modeling. It combines SAST static analysis, DAST dynamic testing, and secure coding discipline to meet functional and technical security requirements.

Yes. This Skill integrates with industry-standard tools including SonarQube, Semgrep, OWASP ZAP, Snyk, npm audit, and TruffleHog, allowing you to consolidate security testing across your existing tech stack and workflows without replacing current tooling.

Automated security testing catches known vulnerabilities, misconfigurations, and exposed secrets at scale across CI/CD pipelines and development workflows. Manual review complements automation by identifying business logic flaws and complex threat scenarios, making both approaches essential for resilient applications.

Prepare your codebase, APIs, and services for assessment. Configure access to your repositories, set up tool integrations like SonarQube or Semgrep, and define your security scope. The Skill then performs systematic vulnerability checks, dependency scanning, and configuration reviews to identify gaps.