Security & Scanning Tools Reference

In Plain Language

Security scanning tools shift vulnerability detection to the earliest possible moments in the developer lifecycle. By automating Static Application Security Testing (SAST), Software Composition Analysis (SCA), container vulnerability scanning, and secrets management, engineering teams prevent common exploits (OWASP Top 10) before code leaves local branches.

Why Automated Security Scanners Shift Left Compliance

Fixing a critical vulnerability in production is exponentially more expensive and disruptive than catching it during a pull request review. By embedding lightweight, deterministic scanners into developer pre-commit hooks and CI pipelines, teams catch SQL injection, hardcoded secrets, and outdated dependencies automatically.

Curated Security & Scanning Tool Profiles

Aqua Trivy

OPEN_SOURCE

Comprehensive container image, file system, SBOM, and Kubernetes configuration vulnerability scanning.

Key Strengths:

  • Fast, lightweight scanner with vast vulnerability database covering OS packages and language dependencies
  • Generates CycloneDX and SPDX Software Bill of Materials (SBOM) with zero configuration
  • Scans Dockerfiles, Terraform, and Kubernetes manifests for misconfigurations against CIS Benchmarks
Regulatory Validation: Mandatory scanner for Executive Order 14028 SBOM generation and FDA cybersecurity pre-market submissions.
$ trivy image --severity HIGH,CRITICAL --format cyclonedx --output sbom.json myapp:latest
Official Documentation

Semgrep OSS & AppSec

HYBRID

Fast static application security testing (SAST) and custom secure-coding rule enforcement in developer PRs.

Key Strengths:

  • Pattern-matching syntax that reads like standard code without abstract AST query complexity
  • Runs in seconds per PR within local developer environments and CI pipelines
  • Extensive community ruleset targeting OWASP Top 10, CWE Top 25, and HIPAA privacy anti-patterns
Regulatory Validation: Automates verification of NIST SP 800-218 SSDF practice PW.5 and ISO 27001 Control A.8.28.
$ semgrep --config p/owasp-top-ten --error
Official Documentation

Automated SBOM Generation & CycloneDX Export

Under U.S. Executive Order 14028 and FDA cybersecurity guidance, all software deliverables must provide a verifiable Software Bill of Materials (SBOM) listing every direct and transitive library dependency:

Generate CycloneDX SBOM with Aqua Trivy:
$ trivy fs --format cyclonedx --output sbom-release.json .

Pre-Commit Secret Prevention with Gitleaks

Never rely on post-merge scans to detect API keys or certificates. Use pre-commit hooks to block commits containing high-entropy strings or known token patterns locally:

Run Gitleaks Pre-Commit Hook:
$ gitleaks protect --staged --verbose
Try This with AI: Custom Semgrep Security Rule Authoring

Copy this prompt into your AI coding assistant to author domain-specific security rules.

Write a custom Semgrep rule (YAML format) to detect unencrypted ePHI database column writes in a TypeScript backend. Ensure the rule flags any Prisma or TypeORM model field containing 'ssn', 'medicalRecordNumber', or 'diagnosis' that is not wrapped in a KMS decrypt/encrypt cipher call.

Community Discussion & Feedback

Attributed peer feedback and official Netspective architecture notes.

Was this documentation helpful?(100% found this helpful • 0 ratings)

Leave Feedback or Question

○ Loading user info...
0/2000 chars

Discussion (0)

Loading discussion thread...