security-testing
Installation
SKILL.md
Security Testing Tools
Overview
Security testing spans the entire software delivery pipeline — from the moment code is written through build, deployment, and runtime in production. No single tool or technique is sufficient; effective security testing requires layering multiple approaches at different stages of the pipeline. Static analysis catches coding flaws before execution, dynamic analysis discovers runtime vulnerabilities in deployed applications, composition analysis identifies known vulnerabilities in dependencies, and runtime monitoring detects threats in production. The goal is to create a security testing strategy that is automated, continuous, and integrated into the CI/CD pipeline so that vulnerabilities are caught as early and as cheaply as possible.
Security Testing Categories
| Category | What It Tests | When | Tools |
|---|---|---|---|
| SAST (Static Application Security Testing) | Source code, bytecode, or binaries for coding flaws | During development and at commit/PR time | Semgrep, SonarQube, CodeQL, Snyk Code |
| DAST (Dynamic Application Security Testing) | Running applications for runtime vulnerabilities | Against staging or pre-production environments | OWASP ZAP, Burp Suite, Nuclei |
| SCA (Software Composition Analysis) | Third-party dependencies for known vulnerabilities | At build time and continuously in production | Snyk, Dependabot, Trivy, Grype + Syft |
| Container Security | Container images and runtime behavior | At build and in production | Trivy, Falco, Sysdig, Aqua |
| Secrets Detection | Code and history for leaked credentials | At commit time (pre-commit hooks) and in CI | TruffleHog, GitLeaks, detect-secrets |
| IaC Security | Infrastructure-as-code templates for misconfigurations | At commit/PR time and before deployment | Checkov, Trivy config, Terrascan, KICS |