Results for “secrets-scanning”

Scan Docker images for vulnerabilities, misconfigurations, secrets, and license violations using Trivy, with CI/CD integration and policy enforcement.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Integrates SAST, DAST, and SCA security scanning into CI/CD pipelines using open-source tools like Semgrep, Trivy, OWASP ZAP, and Gitleaks.

Run security audits, vulnerability scans, compliance checks, and incident response workflows for application security.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Scan codebase and git history for leaked secrets — API keys, tokens, passwords, private keys. Uses whispers-style regex patterns + gitleaks. Run as /leak-check before any git push. Alerts on Claude API keys, GitHub tokens, AWS credentials, and generic high-entropy strings.

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Routes security requests to specialist skills and performs STRIDE/DREAD threat modeling with a quick secret scan.

Establishes recurring vulnerability scanning workflows using Nessus, Qualys, or OpenVAS, prioritizes findings with risk scoring and CISA KEV data, integrates with SIEM for exploitation detection, and tracks remediation via SLA-based dashboards and automated ticketing.

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Performs security scanning, compliance checks, deployment planning, and infrastructure setup, with optional dependency auditing and bundle size analysis.

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.

Implements container security with image scanning, runtime protection, image signing, and security policies using tools like Falco, Trivy, and Notary.

SENTINEL v2.0 — Quality Trader Convergence Scanner. Inverted pipeline: find ELITE/RELIABLE traders, see where they converge. When 5+ quality traders hold the same asset in the same direction, enter.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

Set up pre-commit hooks on a Python project — standard file-hygiene checks plus a security gate (gitleaks secret scanning, Trivy filesystem scan for CVEs/secrets/misconfigs, and Bandit Python SAST). Use this whenever the user wants to add, configure, or fix pre-commit hooks on a Python repo, mentions .pre-commit-config.yaml, wants secret/vulnerability/SAST scanning on commits, or is setting up code-quality guardrails — even if they just say 'add pre-commit hooks' without naming the tools. Especially for uv-based GenAI/LLM backends. Handles the setup gotchas that break first-time installs: the Trivy binary, the required data/html.tpl report template, bandit[toml] + [tool.bandit] config, and the right .gitignore entries.

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".