Skill UI

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.