home / skills / amnadtaowsoam / cerebraskills / security-scan-policy

security-scan-policy skill

safe

/68-quality-gates-ci-policies/security-scan-policy

This skill ensures automated security scanning in CI/CD by enforcing dependency audits, SAST, and secret detection before deployment.

npx playbooks add skill amnadtaowsoam/cerebraskills --skill security-scan-policy

Review the files below or copy the command above to add this skill to your agents.

Files (1)

SKILL.md

2.2 KB

---
name: Security Scan Policy
description: Policy for automated security scanning in CI/CD pipeline including dependency audit, SAST, and secret detection
---

# Security Scan Policy

## Overview

Policy for automated security scanning - dependency vulnerabilities, code vulnerabilities, secrets - must pass before deploy

## Why This Matters

- **Prevent breaches**: Catch vulnerabilities before production
- **Compliance**: Meet security requirements
- **Automated**: Don't miss due to human error
- **Fast feedback**: Know immediately if there are issues

---

## Security Checks

### 1. Dependency Audit
```bash
# Check for vulnerable dependencies
npm audit --audit-level=high

# Must have 0 high/critical vulnerabilities
✓ 0 vulnerabilities found
```

### 2. SAST (Static Analysis)
```bash
# Scan code for security issues
npm run security:scan

# Check for:
- SQL injection
- XSS vulnerabilities
- Insecure crypto
- Hardcoded secrets
```

### 3. Secret Detection
```bash
# Scan for leaked secrets
git-secrets --scan

# Check for:
- API keys
- Passwords
- Private keys
- Tokens
```

---

## CI Pipeline

```yaml
# .github/workflows/security.yml
name: Security Scan
on: [pull_request, push]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Dependency Audit
        run: npm audit --audit-level=high
      
      - name: SAST Scan
        uses: github/codeql-action/analyze@v2
      
      - name: Secret Scan
        uses: trufflesecurity/trufflehog@main
      
      - name: Container Scan
        run: trivy image myapp:latest
```

---

## Severity Levels

| Level | Action | Example |
|-------|--------|---------|
| Critical | Block merge | RCE vulnerability |
| High | Block merge | SQL injection |
| Medium | Warning | Weak crypto |
| Low | Info only | Outdated dependency |

---

## Tools

```
Dependency: npm audit, Snyk
SAST: CodeQL, SonarQube
Secrets: TruffleHog, git-secrets
Container: Trivy, Grype
```

---

## Summary

**Security Scan:** Automated security checks

**Checks:**
- Dependency audit (npm audit)
- SAST (CodeQL)
- Secret detection (TruffleHog)
- Container scan (Trivy)

**Policy:**
- Critical/High: Block merge
- Medium: Warning
- Low: Info only

**No exceptions for Critical/High**

Overview

This skill defines an automated Security Scan Policy for CI/CD that enforces dependency audits, SAST, secret detection, and container scanning before deployment. It ensures high and critical findings block merges while medium and low findings are surfaced as warnings or info. The policy is designed to provide fast, repeatable security feedback and prevent vulnerabilities from reaching production.

How this skill works

The pipeline runs a dependency audit, a static application security test (SAST), secret detection, and container image scanning on each push or pull request. Each tool reports findings with severity levels; critical and high severities fail the job and block merges. Results are presented in the CI log and can be integrated into PR checks for visibility and remediation tracking.

When to use it

On every pull request and push to main or release branches
Before merging code that modifies dependencies, auth, or crypto logic
As part of a gated deployment pipeline to production
When introducing new infrastructure or container images
During regular security hygiene sweeps for long-lived branches

Best practices

Fail the pipeline on critical and high findings with no exception policy
Run dependency audits early and re-run on dependency updates
Combine CodeQL or SonarQube for SAST with project-specific rules
Use multiple secret scanners (git-secrets, TruffleHog) to reduce false negatives
Automate container image scans (Trivy/Grype) in the build stage and scan base images periodically

Example use cases

Block a merge when npm audit reports critical vulnerabilities in production dependencies
Detect an exposed API key accidentally committed and fail the PR using git-secrets or TruffleHog
Surface possible SQL injection in new code via CodeQL SAST scan for developer remediation
Scan built container image with Trivy to catch vulnerable OS packages before deployment
Enforce policy in GitHub Actions to provide consistent security gates across teams

FAQ

Which severities should block a merge?

Critical and high severity findings must block merges and fail the pipeline; medium and low should be warnings or informational.

Which tools are recommended?

Use npm audit or Snyk for dependencies, CodeQL or SonarQube for SAST, git-secrets and TruffleHog for secrets, and Trivy or Grype for container scans.