# Security Scanning

> CI security scanning: secrets, deps, SAST, triage, expiring exceptions

- Skill: `bobmatnyc/security-scanning-2` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add bobmatnyc/security-scanning-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bobmatnyc/security-scanning-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: bobmatnyc (https://skillmd.com/u/bobmatnyc)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/bobmatnyc/security-scanning-2

---


# Security Scanning

## Quick Start

- Secrets: fail fast; rotate on exposure.
- Dependencies: gate critical/high; automate updates.
- SAST: start high-signal; ratchet over time.
- Exceptions: require reason, owner, and expiry.

## Load Next (References)

- `references/tooling-matrix.md`
- `references/ci-workflows.md`
- `references/triage-and-remediation.md`
- `references/common-findings-and-fixes.md`
- `references/supply-chain-and-sbom.md`