security-testing-patterns

Security testing in CI/CD involves wiring SAST and DAST tools into your pipeline stages. This Skill provides CI/CD integration examples, tooling configurations, and guidance for automating vulnerability detection on push and pull requests using tools like Semgrep and Bandit within GitHub Actions or similar platforms.

SAST analyzes source code for vulnerabilities without running it, DAST tests running applications for security flaws, and penetration testing simulates real attacks. This Skill covers the security testing pyramid approach, explaining when to apply each method and how to layer them across web, mobile, and microservice architectures.

Configure automated scanning by implementing SAST and DAST tools within your CI/CD pipeline to detect vulnerabilities on every commit. This Skill includes tooling configurations, integration patterns, and security controls validation guidance for web, mobile, and microservice environments with prioritized remediation workflows.

Yes. This Skill supports security testing across API endpoints and authentication/authorization mechanisms as part of a comprehensive vulnerability assessment strategy. It covers SAST, DAST, SCA, IAST, and penetration testing patterns applicable to API security within CI/CD pipelines.

Use the security testing pyramid framework to layer detection from unit-level security tests to red team exercises, then apply reporting and prioritized remediation guidance. This Skill provides CI/CD integration patterns for automating detection, reporting severity, and tracking remediation across your infrastructure.