Security Scanning

Overview

Security scanning identifies vulnerabilities and misconfigurations in code, dependencies, containers, and infrastructure.

Scan Categories

• SAST for source code analysis
• Dependency scanning for vulnerable libraries
• Container image scanning
• IaC scanning for configuration risks

flowchart LR
    A[Commit] --> B[SAST]
    A --> C[Dependency Scan]
    A --> D[IaC Scan]
    B --> E[Security Gate]
    C --> E
    D --> E

Practical Example

# Dependency vulnerability scan
npm audit --production

Production Example

Security teams often enforce pipeline quality gates that block release on critical issues unless approved exceptions are documented.

Common Pitfalls

• Running scans only before major releases
• Ignoring false-positive tuning and triage process
• Missing remediation ownership and timelines

Key Takeaways

• Continuous scanning improves risk detection speed.
• Gates and triage workflows are both required.
• Scanning value depends on remediation discipline.