Security

The security typology splits into an automatable half and a human half. This page is the automatable half, plus the tooling that supports the human half.

Everything here runs unattended in the pipeline. Anything that needs a person to launch it will be run once, in a quarter with slack in it.

Dependency scanning (SCA)

Known vulnerabilities in the libraries and base images actually shipped. The highest value per unit of effort in this entire section, because most real compromises arrive through a dependency nobody chose deliberately.

Trivy — one binary, scans dependencies, container images, filesystems and IaC. The pragmatic default: one tool covering four of the categories on this page.

Grype with Syft — if a software bill of materials is required in its own right (and increasingly it is, by regulation): Syft produces the SBOM, Grype scans it.

Dependabot or Renovate — not a scanner but the other half of the answer. Scanning tells you there is a vulnerable dependency; automated update pull requests are what make it routine to fix rather than a project. Renovate for the control, Dependabot for the zero setup.

The policy. Fails the build on critical and high in shipped artefacts. Exceptions are documented, owned and expiring — an exception with no end date is a policy that does not exist. Development-only dependencies are reported, not blocking.

Static analysis (SAST)

Injection, unsafe deserialisation, weak crypto, hard-coded credentials, path traversal.

Semgrep — fast, readable rules, and the ability to write project-specific ones. That last part is the reason to prefer it: a rule saying no controller may call the repository directly or every endpoint under /admin must carry the authorisation annotation encodes this system’s actual invariants, which no generic ruleset knows.

CodeQL — deeper, dataflow-based, free for public repositories and integrated into GitHub’s security tab. Slower; a nightly job rather than a merge gate.

The policy. Fails only on high-confidence rules; everything else is reported. This is not laxity — a tool that cries wolf gets turned off, and a tool that is off is worse than one that was never adopted.

Secret scanning

Gitleaks or TruffleHog, in two places: a pre-commit hook that prevents, and a pipeline job that catches what came from a machine without the hook. Scan the history as well as the working tree — a secret committed and then removed is still a secret that was published.

A found secret is an incident: rotate first, remove from history second. Removing it from history without rotating is theatre.

Containers and infrastructure

Trivy again for image CVEs and for Terraform, Kubernetes manifests and Helm charts: containers running as root, privileged flags, missing resource limits, permissive security groups, public buckets. Mechanical, and the source of a large share of real exposure.

Checkov or tfsec for deeper IaC policy where the estate justifies a dedicated tool.

Distroless or minimal base images. Not a scanning tool — the most effective single measure on this page. A base image with no shell and no package manager has almost no CVEs to report and considerably less to exploit.

Dynamic scanning (DAST)

OWASP ZAP in its automation mode, against a deployed candidate: missing security headers, TLS configuration, obvious injection points, cookie flags. Baseline mode in the pipeline; the full scan is slow and belongs in the release campaign.

It finds shallow issues that static tools cannot see because they only exist once assembled — and it does not find broken authorisation logic, which is the category that matters most. That stays with people, and with the ordinary test suite: user B cannot read user A’s order is a component or integration test that costs almost nothing.

For the human half

Burp Suite for the scoped penetration test — the interception proxy is the tool of the trade for authorisation and business-logic work.

A threat model, which needs a whiteboard rather than a tool. See the security typology.

The rules that keep these switched on

Fail on the unambiguous, report the rest. One noisy gate teaches a team to bypass all of them.

Fix the baseline before turning on the gate. Introducing a scanner on a codebase with 400 existing findings blocks everything and gets reverted by Thursday. Snapshot the baseline, gate on new findings, burn down the rest on a schedule.

Every finding gets an owner and a date. An unowned finding is inherited, and inherited findings are never fixed.

Scan what ships. The artefact, the image, the chart — not just the source tree. The vulnerable thing is what runs.