# Security Automation

> Automating security scanning, compliance checks, incident response, and remediation workflows

- Skill: `ffsshhttiikk/security-automation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ffsshhttiikk/security-automation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ffsshhttiikk/security-automation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ffsshhttiikk (https://skillmd.com/u/ffsshhttiikk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ffsshhttiikk/security-automation

---


# Security Automation

## What I Do

I provide guidance on automating security processes across the software development lifecycle. This includes integrating SAST/DAST/SCA scanning into CI/CD pipelines, automating compliance checks, building security orchestration and automated response (SOAR) workflows, and implementing infrastructure security scanning.

## When to Use Me

- Integrating security scanners into CI/CD pipelines
- Automating vulnerability triage and ticket creation
- Building automated incident response playbooks
- Setting up compliance-as-code scanning
- Automating secret detection in repositories
- Creating security guardrails that do not slow down development

## Core Concepts

1. **Shift Left Security**: Integrate security testing early in the SDLC to catch vulnerabilities when they are cheapest to fix.
2. **SAST (Static Application Security Testing)**: Analyze source code for vulnerability patterns without executing the application.
3. **DAST (Dynamic Application Security Testing)**: Test running applications by sending crafted requests to find runtime vulnerabilities.
4. **SCA (Software Composition Analysis)**: Identify known vulnerabilities in third-party dependencies and licenses.
5. **Secret Detection**: Scan repositories for accidentally committed credentials, API keys, and tokens.
6. **Policy as Code**: Express security and compliance policies as executable code that can be versioned and tested.
7. **SOAR**: Security Orchestration, Automation, and Response platforms that coordinate tools and automate playbooks.
8. **Infrastructure Scanning**: Scan IaC templates and running infrastructure for misconfigurations.

## Code Examples

### 1. GitHub Actions Security Pipeline

```yaml
name: Security Scanning
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/owasp-top-ten p/python

  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy SCA
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          severity: CRITICAL,HIGH
          exit-code: 1

  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  image-scan:
    runs-on: ubuntu-latest
    needs: [sast, sca, secrets]
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t app:${{ github.sha }} .
      - name: Scan image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: app:${{ github.sha }}
          severity: CRITICAL,HIGH
          exit-code: 1
```

### 2. Automated Vulnerability Triage (Python)

```python
from typing import List, Dict, Any
from enum import Enum

class Priority(Enum):
    CRITICAL = "P0"
    HIGH = "P1"
    MEDIUM = "P2"
    LOW = "P3"

def triage_vulnerability(vuln: Dict[str, Any]) -> Priority:
    severity = vuln.get("severity", "").upper()
    is_exploitable = vuln.get("exploitable", False)
    is_internet_facing = vuln.get("internet_facing", False)
    has_fix = vuln.get("fix_available", False)

    if severity == "CRITICAL" and is_internet_facing:
        return Priority.CRITICAL
    if severity == "CRITICAL" or (severity == "HIGH" and is_exploitable):
        return Priority.HIGH
    if severity == "HIGH" or (severity == "MEDIUM" and is_internet_facing):
        return Priority.MEDIUM
    return Priority.LOW

def process_scan_results(results: List[Dict[str, Any]]) -> Dict[str, List]:
    triaged: Dict[str, List] = {p.value: [] for p in Priority}
    for vuln in results:
        priority = triage_vulnerability(vuln)
        triaged[priority.value].append(vuln)
    return triaged
```

### 3. Pre-Commit Secret Detection Hook

```yaml
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: detect-private-key
      - id: check-added-large-files
        args: ['--maxkb=500']
```

## Best Practices

1. **Fail the build** on critical and high severity findings with no known exceptions.
2. **Use baseline files** to track accepted risks and prevent alert fatigue from known issues.
3. **Run scans incrementally** on pull requests to provide fast feedback to developers.
4. **Automate secret rotation** when leaked credentials are detected.
5. **Centralize scan results** in a security dashboard for unified visibility across projects.
6. **Implement exception workflows** that require security team approval with expiration dates.
7. **Scan infrastructure-as-code** templates before applying changes to catch misconfigurations early.
8. **Integrate scanner findings** into developer workflows (IDE plugins, PR comments) for frictionless adoption.
9. **Measure mean time to remediate** (MTTR) by severity to track security posture improvement.
10. **Test your automation** by intentionally introducing known vulnerabilities to verify detection.