Devsecops skills

Integrating SAST into GitHub Actions

mukul975

Automate SAST scanning in GitHub Actions workflows.

Implementing Policy as Code

mukul975

Enforce security policies in Kubernetes and CI/CD pipelines.

Infrastructure as Code Security Scanning

mukul975

Automate security checks for your IaC deployments.

Vulnerability Dashboard with DefectDojo

mukul975

Centralize and automate your vulnerability management.

Implementing Semgrep for Custom SAST Rules

mukul975

Enhance code security with custom Semgrep rules.

Implementing Code Signing for Artifacts

mukul975

Secure your build artifacts with trusted signatures.

DevSecOps Security Scanning

mukul975

Automate security scanning in your CI/CD pipeline.

AegisOps-AI

sickn33

Automate security and financial audits in your DevOps pipeline.

SAST Configuration

wshobson

Streamline your static application security testing setup.

Runtime Application Self-Protection

mukul975

Enhance your application security with RASP deployment.

Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating.

This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into CI/CD, auditing repositories (including git history) for historically committed AWS keys, responding to a GuardDuty alert about credential use from an unexpected location, or verifying credential rotation removed all exposed keys.

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.