Skill UI

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

A comprehensive checklist for validating the operational readiness of any Navan API integration before deployment to a live production environment. This guide covers critical areas including credential security (rotation, secret management), robust error handling, rate limit strategies, Single Sign-On (SSO) setup, data synchronization, and compliance auditing (PCI DSS, GDPR). Use this when ensuring mission-critical API stability.

This skill performs a proactive, comprehensive audit to quantify the business and regulatory impact of a potential data breach before it occurs. It inventories sensitive data (PII, PHI, PCI-DSS), traces complex data flows through the codebase, identifies all exposure vectors, and calculates the 'blast radius.' The output provides law-sourced figures (e.g., GDPR, CCPA, HIPAA fine maximums) alongside heuristic risk estimates, guiding proactive hardening roadmaps for compliance and security.

This skill maps engineering changes (code diffs, architecture designs, IaC) to specific financial compliance controls, such as PCI-DSS v4.0 and MAS TRM. It generates an auditable report detailing compliance gaps, required evidence, and concrete remediation steps, helping teams catch violations before formal audits.

A detailed, comprehensive reference guide covering best practices for securing modern applications. This checklist spans network architecture, API design, data encryption, authentication protocols, and regulatory compliance (GDPR, HIPAA, PCI-DSS), ensuring robust security across the entire technology stack.

This skill guides the implementation of dynamic secrets using HashiCorp Vault. It focuses on generating short-lived, ephemeral credentials for services like databases (PostgreSQL, MySQL), AWS IAM, and PKI certificates. By automating credential generation, lease management, and rotation, it eliminates the risk associated with storing long-lived static secrets, ensuring compliance with zero-trust security models (PCI-DSS, NIST).