security-testing-patterns

Identify and mitigate security vulnerabilities in CI/CD pipelines.

29|15|Updated Oct 17, 2025

Search Tags:#security #vulnerability #sast #ci-cd #pentesting #dast

Ready to run

npx skills add https://github.com/NickCrew/claude-cortex --skill security-testing-patterns

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-testing-patterns
Source: https://github.com/NickCrew/claude-cortex/tree/main/skills/security-testing-patterns
Command: npx skills add https://github.com/NickCrew/claude-cortex --skill security-testing-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a blueprint for implementing and integrating security testing across CI/CD, including SAST/DAST, pentesting, and vulnerability assessment.

Core Features & Use Cases

Security testing pyramid: Outline layers from unit security tests to red team exercises.
SAST & DAST: Tools and integration examples.
CI/CD integration: How to wire into pipelines.

Quick Start

Configure a GitHub Action to run Semgrep and Bandit on push and pull requests.

Frequently Asked Questions about security-testing-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I integrate security testing into my CI/CD pipeline?▼

Security testing in CI/CD involves wiring SAST and DAST tools into your pipeline stages. This Skill provides CI/CD integration examples, tooling configurations, and guidance for automating vulnerability detection on push and pull requests using tools like Semgrep and Bandit within GitHub Actions or similar platforms.

What's the difference between SAST, DAST, and penetration testing for vulnerability detection?▼

SAST analyzes source code for vulnerabilities without running it, DAST tests running applications for security flaws, and penetration testing simulates real attacks. This Skill covers the security testing pyramid approach, explaining when to apply each method and how to layer them across web, mobile, and microservice architectures.

How do I set up automated vulnerability scanning for my web and mobile applications?▼

Configure automated scanning by implementing SAST and DAST tools within your CI/CD pipeline to detect vulnerabilities on every commit. This Skill includes tooling configurations, integration patterns, and security controls validation guidance for web, mobile, and microservice environments with prioritized remediation workflows.

Can I use this approach for API and authentication security testing?▼

Yes. This Skill supports security testing across API endpoints and authentication/authorization mechanisms as part of a comprehensive vulnerability assessment strategy. It covers SAST, DAST, SCA, IAST, and penetration testing patterns applicable to API security within CI/CD pipelines.

What's the best way to prioritize and remediate security vulnerabilities across my codebase?▼

Use the security testing pyramid framework to layer detection from unit-level security tests to red team exercises, then apply reporting and prioritized remediation guidance. This Skill provides CI/CD integration patterns for automating detection, reporting severity, and tracking remediation across your infrastructure.