Scan Code for Security Vulnerabilities

A Static Application Security Testing (SAST) skill for detecting vulnerabilities across Python, JavaScript/TypeScript, Java, Ruby, PHP, Go, and Rust, integrating Bandit, Semgrep, ESLint Security, SonarQube, CodeQL, PMD, SpotBugs, Brakeman, gosec, and cargo-clippy. Per-language tool commands and configs are specified exactly: Bandit run with -r . -f json and a .bandit config excluding test, venv, and build directories and skipping the B101 assert check; ESLint Security via @eslint/plugin-security and eslint-plugin-no-secrets with rules for object injection, non-literal filesystem access, eval-with-expression, and pseudo-random PRNG use; Semgrep run with --config=auto, p/security-audit, and p/owasp-top-ten rulesets plus a CI mode, alongside custom .semgrep.yml rules for SQL-injection-via-string-formatting, dangerous innerHTML assignment, hardcoded AWS credentials, path traversal, and shell=True command injection, each tagged with its CWE and OWASP category; and single-command scans for Java (mvn spotbugs:check), Ruby (brakeman), Go (gosec), and Rust (cargo clippy). Seven vulnerability patterns are each shown as a vulnerable-versus-secure code pair: SQL injection (parameterized queries or ORM filters instead of string formatting), XSS (textContent, React's auto-escaping, or DOMPurify.sanitize instead of raw innerHTML), hardcoded secrets (environment variables instead of literal keys), path traversal (os.path.realpath plus a startswith check against an allowed directory instead of raw user-supplied paths), insecure deserialization (json.loads or yaml.safe_load instead of pickle.loads or yaml.load), command injection (array-form subprocess args or shlex.quote instead of shell=True string concatenation), and insecure randomness (the secrets module instead of random for tokens and session IDs). Framework-specific hardening covers Django (DEBUG=False, a real SECRET_KEY, SecurityMiddleware, CsrfViewMiddleware, and XFrameOptionsMiddleware, SSL redirect, secure cookies), Flask (a real secret_key, Flask-Talisman for forced HTTPS, a non-wildcard CORS origin), and Express.js (helmet, a scoped CORS origin, and express-rate-limit). It also ships a full Python reference implementation: a SASTFinding dataclass (tool, severity, category, CWE, OWASP, confidence) and a MultiLanguageSASTScanner class that auto-detects languages from file globs and manifest files, runs Semgrep across all three rulesets plus Bandit and ESLint Security when applicable, and computes a 0-100 risk score from severity-weighted findings. CI/CD integration is given for both GitHub Actions (installing Bandit, Semgrep, and ESLint, running scans non-blocking, and uploading JSON reports as artifacts) and GitLab CI (the same tool sequence wired into a sast stage with a reports artifact). Ten best practices close it out: scan early via pre-commit and CI, combine multiple tools since each catches different vulnerability classes, tune false positives, prioritize CRITICAL and HIGH findings first, use framework-aware rulesets, write custom rules for org-specific policy, train developers, remediate incrementally, maintain a baseline of known issues, and keep tools updated.

Use for code-review security analysis, injection vulnerability detection, hardcoded-secret scanning, framework-specific pattern checks, custom security-policy enforcement, pre-deployment validation, legacy-code security assessment, or compliance work against OWASP, PCI-DSS, or SOC2. For narrower needs it names dedicated companion resources: security-secrets.md for advanced credential scanning, security-owasp.md for OWASP Top 10 mapping, and security-api.md for REST/GraphQL endpoint testing. Not for runtime or penetration testing, when source code or build outputs aren't accessible, or in environments that forbid third-party scanning tools - and proprietary code should never be uploaded to external scanning services without approval.

Input is a codebase, auto-detected by language via file extensions and manifest files like requirements.txt, package.json, go.mod, and Cargo.toml. Output is a structured findings report with tool, severity, CWE, OWASP category, file and line, and confidence, a severity breakdown, and a computed 0-100 risk score, exportable as CI artifacts from either GitHub Actions or GitLab CI.

rules:
  - id: sql-injection-format-string
    pattern: cursor.execute("... %s ..." % $VAR)
    message: SQL injection via string formatting
    severity: ERROR
    languages: [python]
    metadata:
      cwe: "CWE-89"
      owasp: "A03:2021-Injection"

Integrates Bandit, Semgrep, ESLint Security, SonarQube, CodeQL, PMD, SpotBugs, Brakeman, gosec, and cargo-clippy across Django, Flask, React, Express, Spring Boot, Rails, and Laravel codebases, wired into GitHub Actions or GitLab CI pipelines.

Security engineers and developers running SAST scans during code review, CI, or pre-deployment, especially teams needing exact tool commands, config files, and custom Semgrep rules rather than a general vulnerability-class overview.