implementing-devsecops-security-scanning

# Implementing DevSecOps Security Scanning ## When to Use - Setting up automated security scanning in a new or existing CI/CD pipeline - Shifting security left by catching vulnerabilities before code reaches production - Meeting compliance requirements (SOC 2, PCI-DSS, ISO 27001) that mandate automated security testing - Integrating SAST, DAST, and SCA together to achieve comprehensive application security coverage - Establishing security gates that block deployments containing critical or high-severity vulnerabilities **Do not use** as a replacement for manual penetration testing. Automated scanning catches common vulnerability patterns but cannot replace human-driven security assessments for business logic flaws and complex attack chains. ## Prerequisites - CI/CD platform: GitHub Actions, GitLab CI, Jenkins, or Azure DevOps - Container runtime (Docker) for running scanning tools - A staging environment URL for DAST scanning (DAST cannot test static code) - Repository access with permissions to modify CI/CD workflow files - Tool-specific requirements: - Semgrep: free for open-source rulesets (`p/security-audit`, `p/owasp-top-ten`) - Trivy: free, no account required - OWASP ZAP: free, Docker image available - Gitleaks: free, no account required ## Workflow ### Step 1: Add Secrets Detection with Gitleaks Secrets detection runs first because leaked credentials are the highest-priority finding. Add to `.github/workflows/security.yml`: ```yaml name: DevSecOps Sec...