Security Testing

What it is

Security testing finds ways the system can be abused before an attacker does. It is layered, and each layer sees a different class of flaw.

1
  source ──► SAST ──►┐
2
  deps   ──► SCA  ──►├──► CI gate ──► build ──► DAST / pen test
3
  git    ──► secrets ►┘                          (running app)
4

5
  SAST: code you wrote   SCA: code you imported   DAST: behaviour when running

The goal is not a clean scanner report — it is a threat model: who attacks this, what they gain, and which control stops them (OWASP Top 10 is a useful starting map).

When to use it / when to avoid it

Use it for

Every commit: SAST and secret scanning are cheap and catch mistakes early
Every dependency change: SCA flags known CVEs in your supply chain
Before release: DAST against a running staging environment
Anything touching auth, payments, PII or file uploads: threat-model it explicitly

Avoid or reduce it when

You treat a scanner as proof of safety — it only finds known patterns
You run an expensive full DAST scan on every push instead of a fast subset
You gate on raw finding counts without triaging real exploitability
You scan a build artifact that is not what you actually ship

Frameworks & tools

Tool	Ecosystem	Notes
Semgrep	Multi	Fast SAST, custom rules as YAML
CodeQL	Multi	Deep semantic analysis, free for OSS on GitHub
Snyk	Multi	SCA plus SAST and container scanning
Trivy	Containers / IaC / SCA	One binary, scans images, filesystems and config
OWASP ZAP	Web DAST	Open source, scriptable, CI-friendly
Burp Suite	Web DAST	Industry-standard proxy and scanner
Gitleaks	Secrets	Detects secrets in git history and code
Dependabot	GitHub	Automated dependency update PRs

Quick setup

1
# SAST with Semgrep
2
docker run --rm -v "$PWD:/src" returntocorp/semgrep \
3
  semgrep scan --config=auto /src
4

5
# DAST with OWASP ZAP baseline scan
6
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable \
7
  zap-baseline.py -t https://staging.example.com
8

9
# Secrets with Gitleaks
10
docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest \
11
  detect --source=/repo --verbose

1
npm install -D @typescript-eslint/eslint-plugin eslint-plugin-security
2
npx snyk test          # SCA for npm dependencies

1
pip install bandit pip-audit semgrep
2
bandit -r src/         # SAST
3
pip-audit              # SCA for PyPI

1
go install github.com/securego/gosec/v2/cmd/gosec@latest
2
gosec ./...
3
govulncheck ./...      # SCA for Go modules

1
<!-- Maven: OWASP Dependency-Check -->
2
<plugin>
3
  <groupId>org.owasp</groupId>
4
  <artifactId>dependency-check-maven</artifactId>
5
  <version>9.2.0</version>
6
  <executions><execution><goals><goal>check</goal></goals></execution></executions>
7
</plugin>

1
dotnet add package Microsoft.CodeAnalysis.NetAnalyzers
2
dotnet list package --vulnerable --include-transitive

Example

1
# .github/workflows/security.yml (excerpt)
2
- name: Scan container image
3
  run: |
4
    trivy image --exit-code 1 --severity HIGH,CRITICAL ghcr.io/acme/api:ci
5
- name: Secret scan
6
  run: gitleaks detect --redact --exit-code 1

1
# semgrep rule: flag eval on user input
2
rules:
3
  - id: no-eval-on-input
4
    languages: [javascript]
5
    severity: ERROR
6
    message: Do not eval untrusted input.
7
    pattern: eval($X)

1
# bandit-friendly: parameterised query, never string-built SQL
2
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

1
// gosec G401: use SHA-256+ for hashing, not MD5
2
import "crypto/sha256"
3

4
sum := sha256.Sum256([]byte(token))
5
_ = sum

1
// CodeQL-friendly: never build SQL by concatenation
2
var query = entityManager.createQuery(
3
    "SELECT u FROM User u WHERE u.id = :id", User.class);
4
query.setParameter("id", userId);

1
// Use parameterised commands instead of string concatenation
2
using var cmd = new SqlCommand("SELECT * FROM Users WHERE Id = @id", conn);
3
cmd.Parameters.AddWithValue("@id", userId);

Anti-patterns & best practices

Layer the scanners. SAST, SCA, secrets and DAST catch different things; no single tool is sufficient.
Gate on severity, triage the rest. Fail the build on exploitable HIGH/CRITICAL, review the rest instead of ignoring everything or blocking on noise.
Scan the artifact you ship. A clean source tree does not mean a clean container.
Keep secrets out of git. Run a secret scanner in CI and rotate anything that leaks — history is forever.
Automate dependency patching. Dependabot or Renovate beats quarterly panic updates.
Threat-model, do not just scan. A scanner cannot reason about business logic flaws such as broken access control.