Results for “pipelines”

Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.

Traces software supply chain provenance from source to runtime, identifying divergence points in dependency resolution, build, packaging, and release pipelines.

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.

Authenticate Java applications with Azure services using Microsoft Entra ID, supporting credential types for local development, managed identities, service principals, and CI/CD pipelines.

Rapidly classify malware samples against known family signatures using YARA rules, covering rule writing, scanning, and integration with analysis pipelines.

Integrate Trivy vulnerability scanning into CI/CD pipelines to detect container image CVEs, Dockerfile misconfigurations, and enforce severity-based quality gates.

Deploy MISP, configure threat feeds, use the PyMISP API for programmatic access, and build automated collection pipelines that aggregate IOCs from multiple community and commercial sources.

Verify container image integrity across CI/CD pipelines using the in-toto framework to generate and check cryptographically signed attestations.

Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

Fork, sanitize, and package private projects for safe public release through a three-stage pipeline.

Systematic audit and review by Referee 2. Two modes — "deck" reviews slide presentations for rhetoric, visual quality, and compile cleanliness; "code" performs cross-language replication and econometric audit of empirical pipelines. Use when reviewing slides, auditing code, or verifying replication.

Signs and verifies software artifacts using Sigstore's keyless signing, Rekor transparency log, and Fulcio certificate authority, integrating into CI/CD pipelines and Kubernetes admission controls.

Automates enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs.

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations, detecting attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

Scan container images for vulnerabilities with Trivy and Grype, generate SBOMs, sign images with Cosign and Sigstore, configure registry access controls, and enforce security gates in CI/CD pipelines.

Integrate AFL++ coverage-guided fuzz testing into CI/CD pipelines to discover memory corruption, input handling, and logic vulnerabilities in C/C++ and compiled applications.

Discover, classify, and protect sensitive data across cloud storage, databases, and data pipelines using Amazon Macie, Azure Information Protection, and Google Cloud DLP API.

Enforce organizational security policies across Kubernetes clusters and CI/CD pipelines using Open Policy Agent (OPA) and Gatekeeper, including writing Rego policies, deploying admission controllers, and testing policies locally.

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Integrates OWASP ZAP for Dynamic Application Security Testing in CI/CD pipelines, configuring baseline, full, and API scans, interpreting findings, tuning policies, and establishing quality gates in GitHub Actions and GitLab CI.

Integrates Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines, configuring automated code scanning, tuning rules, uploading SARIF results, and establishing quality gates that block merges on high-severity vulnerabilities.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.