Setup Security Scanning

What problem does it solve?

Manual security reviews are slow, inconsistent, and often miss critical vulnerabilities or accidentally committed secrets. This skill automates comprehensive security scanning across your code, dependencies, infrastructure-as-code, and secrets, integrating directly into your CI/CD pipeline to catch issues early and continuously.

Core Features & Use Cases

• Multi-faceted Scanning: Integrates Checkov for Infrastructure-as-Code, npm audit for dependency vulnerabilities, TruffleHog/git-secrets for secret detection, and CodeQL for advanced code analysis.
• CI/CD Automation: Provides GitHub Actions workflows for continuous security checks on every pull request and scheduled, in-depth scans.
• Proactive Protection: Sets up Dependabot for automated dependency updates and pre-commit hooks to prevent secrets from ever being committed to your repository.
• Use Case: You're deploying a new application to the cloud and need to ensure your Terraform, Kubernetes manifests, and application code are free of vulnerabilities, and no sensitive credentials are accidentally committed.

Quick Start

Set up automated security scanning for your project. Configure Dependabot, add a GitHub Actions workflow for Checkov and npm audit, and install git-secrets for local secret detection.