┌─────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌───────────┐
│  Code    │──▶│  Build   │──▶│  Test    │──▶│  Deploy  │──▶│  Monitor  │
│          │   │          │   │          │   │          │   │           │
│  SAST    │   │  SCA     │   │  DAST    │   │  Headers │   │  WAF logs │
│  Linting │   │  License │   │  Pentest │   │  TLS     │   │  Alerting │
│  Secrets │   │  SBOM    │   │  Fuzzing │   │  Config  │   │  Incident │
└─────────┘   └──────────┘   └──────────┘   └──────────┘   └───────────┘

Source code → Parser → Abstract Syntax Tree → Taint analysis → Vulnerability report
                                                │
                                     Tracks user input (sources)
                                     through code paths (propagators)
                                     to dangerous operations (sinks)

# .semgrep.yml — custom rule: detect SQL string concatenation
rules:
  - id: sql-string-concat
    patterns:
      - pattern: |
          $QUERY = f"... {$INPUT} ..."
      - metavariable-regex:
          metavariable: $QUERY
          regex: (?i)(select|insert|update|delete)
    message: "Possible SQL injection via string formatting"
    languages: [python]
    severity: ERROR

semgrep --config .semgrep.yml --config p/owasp-top-ten src/

sast:
  stage: test
  image: returntocorp/semgrep
  script:
    - semgrep --config p/owasp-top-ten --config p/python --json --output semgrep-results.json src/
  artifacts:
    reports:
      sast: semgrep-results.json
  allow_failure: false

DAST scanner → Crawls application (discovers endpoints)
             → Sends attack payloads (injection, XSS, etc.)
             → Analyses responses (error messages, timing, content)
             → Reports vulnerabilities

# Run ZAP baseline scan against a staging environment
docker run --rm \
  -v "$(pwd)/zap-report:/zap/wrk:rw" \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py \
    -t https://staging.example.com \
    -r zap-report.html \
    -c zap-rules.conf

# Scan for known vulnerabilities and misconfigurations
nuclei -u https://staging.example.com \
  -t http/technologies/ \
  -t http/misconfiguration/ \
  -t http/vulnerabilities/ \
  -severity critical,high \
  -o nuclei-results.txt

# Trivy — scan a project directory
trivy fs --severity HIGH,CRITICAL --exit-code 1 .

# Trivy — scan a container image
trivy image --severity HIGH,CRITICAL myapp:latest

# npm audit
npm audit --audit-level=high

# pip-audit
pip-audit --strict --desc

# Go
govulncheck ./...

dependency-scan:
  stage: test
  image: aquasec/trivy
  script:
    - trivy fs --severity HIGH,CRITICAL --exit-code 1 --format json --output trivy-results.json .
  artifacts:
    reports:
      dependency_scanning: trivy-results.json
  allow_failure: false

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks

# Manual scan
gitleaks detect --source . --verbose

# Discover hidden endpoints and files
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt

# Test for SQL injection (authorised testing only)
sqlmap -u "https://target.com/api/users?id=1" --batch --level=3

# Test HTTP methods
curl -X OPTIONS https://target.com/api/users -i

# Check for open redirects
curl -v "https://target.com/login?redirect=https://evil.com"

# securityheaders.com — online scanner
# https://securityheaders.com/?q=yourdomain.com

# Mozilla Observatory — comprehensive grading
# https://observatory.mozilla.org/

# Command-line check
curl -sI https://yourdomain.com | grep -iE '^(strict-transport|content-security|x-content-type|x-frame|referrer-policy|permissions-policy)'

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: default-src 'self'; script-src 'self'; frame-ancestors 'none'
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(), geolocation=()

┌────────────┐    ┌────────────────┐    ┌─────────────┐    ┌───────────┐
│ Detection   │──▶│ Containment    │──▶│ Eradication  │──▶│ Recovery  │
│             │    │                │    │              │    │           │
│ Alert fires │    │ Isolate system │    │ Fix root     │    │ Restore   │
│ User report │    │ Revoke tokens  │    │ cause        │    │ service   │
│ Log anomaly │    │ Block attacker │    │ Patch vuln   │    │ Verify    │
└────────────┘    └────────────────┘    └─────────────┘    └─────┬─────┘
                                                                  │
                                                                  ▼
                                                          ┌──────────────┐
                                                          │ Post-Mortem   │
                                                          │               │
                                                          │ Timeline      │
                                                          │ Root cause    │
                                                          │ Action items  │
                                                          └──────────────┘

## Incident Post-Mortem: [Title]

**Date:** YYYY-MM-DD
**Severity:** SEV-1 / SEV-2 / SEV-3
**Duration:** HH:MM

### Summary
One-paragraph description of what happened.

### Timeline
- HH:MM — Alert triggered
- HH:MM — Investigation started
- HH:MM — Root cause identified
- HH:MM — Fix deployed
- HH:MM — Incident resolved

### Root Cause
Technical explanation of what went wrong.

### Impact
- Users affected: N
- Data exposed: describe scope
- Financial impact: if applicable

### Action Items
| # | Action | Owner | Due Date |
|---|--------|-------|----------|
| 1 | Fix the vulnerability | @engineer | YYYY-MM-DD |
| 2 | Add regression test | @engineer | YYYY-MM-DD |
| 3 | Improve alerting | @ops | YYYY-MM-DD |