Vulnerability Scanning

# .semgrep.yml
rules:
  - id: sql-injection
    patterns:
      - pattern: |
          $DB.query($QUERY + ...)
      - pattern: |
          $DB.execute(f"...")
    message: Potential SQL injection vulnerability
    languages: [python, javascript, typescript]
    severity: ERROR

  - id: hardcoded-secret
    pattern-regex: '(api[_-]?key|secret|password)\s*=\s*["\'][^"\']{8,}["\']'
    message: Potential hardcoded secret
    languages: [generic]
    severity: WARNING

# GitHub Actions SAST
name: SAST Scan
on: [push, pull_request]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/secrets
            p/owasp-top-ten

  codeql:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v2
        with:
          languages: javascript, typescript
      - uses: github/codeql-action/analyze@v2

# Check for vulnerabilities
npm audit

# Check with severity threshold
npm audit --audit-level=high

# Generate JSON report
npm audit --json > audit-report.json

# Automatically fix (when possible)
npm audit fix

# Force fix (may break compatibility)
npm audit fix --force

# Test for vulnerabilities
snyk test

# Monitor project (continuous scanning)
snyk monitor

# Test container image
snyk container test my-image:latest

# Test infrastructure as code
snyk iac test ./terraform/

# Scan filesystem
trivy fs --severity HIGH,CRITICAL .

# Scan container image
trivy image --severity HIGH,CRITICAL my-app:latest

# Scan with SBOM output
trivy fs --format spdx-json -o sbom.json .

# GitHub Actions SCA
name: Dependency Scan
on: [push, pull_request]

jobs:
  npm-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm audit --audit-level=high

  snyk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'

# Baseline scan (passive)
docker run -t owasp/zap2docker-stable zap-baseline.py \
  -t https://your-app.com \
  -r report.html

# Full scan (active)
docker run -t owasp/zap2docker-stable zap-full-scan.py \
  -t https://your-app.com \
  -r report.html

# API scan
docker run -t owasp/zap2docker-stable zap-api-scan.py \
  -t https://your-app.com/openapi.json \
  -f openapi \
  -r report.html

# Run all templates
nuclei -u https://your-app.com

# Run specific severity
nuclei -u https://your-app.com -severity critical,high

# Run specific templates
nuclei -u https://your-app.com -t cves/ -t vulnerabilities/

# Output to JSON
nuclei -u https://your-app.com -json -o results.json

# GitHub Actions DAST
name: DAST Scan
on:
  push:
    branches: [main]

jobs:
  zap-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to staging
        run: ./deploy-staging.sh

      - name: OWASP ZAP Scan
        uses: zaproxy/action-baseline@v0.7.0
        with:
          target: 'https://staging.your-app.com'
          rules_file_name: '.zap/rules.tsv'

      - name: Upload Report
        uses: actions/upload-artifact@v3
        with:
          name: zap-report
          path: report_html.html

# Trivy container scan
trivy image --severity HIGH,CRITICAL myapp:latest

# Grype container scan
grype myapp:latest

# Docker Scout (Docker native)
docker scout cves myapp:latest

# GitHub Actions container scanning
name: Container Security
on: [push]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload to GitHub Security
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

# Scan Terraform directory
checkov -d ./terraform/

# Scan with specific check
checkov -d ./terraform/ --check CKV_AWS_18

# Output to JSON
checkov -d ./terraform/ -o json > results.json

# Skip specific checks
checkov -d ./terraform/ --skip-check CKV_AWS_123

# Basic scan
tfsec ./terraform/

# Scan with severity threshold
tfsec ./terraform/ --minimum-severity HIGH

# Output to SARIF
tfsec ./terraform/ --format sarif > results.sarif

# vulnerability-tracking.yml
vulnerabilities:
  - id: CVE-2024-12345
    severity: high
    package: lodash
    affected_version: "<4.17.21"
    fixed_version: "4.17.21"
    status: remediated
    remediation_date: 2024-01-15
    ticket: JIRA-1234

  - id: SNYK-JS-EXPRESS-1234567
    severity: medium
    package: express
    affected_version: "<4.18.0"
    fixed_version: "4.18.0"
    status: accepted_risk
    justification: "Not exposed to untrusted input"
    review_date: 2024-06-15
    ticket: JIRA-1235