S

SAST

Anura is an open-source harness platform built by the security research community to create an independent, realistic benchmark for AI systems used in security research. It runs models and agents against real public, authorized bug bounty scopes and security artifacts, then measures what they actually discover, validate, and reject in practical investigations.

Components for running Puma Scan in GitLab CI/CD pipelines.

Codequality jobs in pipelines https://docs.gitlab.com/ee/user/project/merge_requests/code_quality.html

Go package for implementing shared vulnerability command interface for secure analyzers

Go packages to implement analyzers

A minimal custom SAST scanner that detects when web applications are configured to run in debug mode. Built in Rust as a tutorial for integrating third-party security scanners with GitLab Secure.

This GitLab CI/CD pipeline implements a complete DevSecOps and GitOps workflow for a containerized application. It performs Dockerfile linting, builds and pushes images with Kaniko, runs Gitleaks and Trivy security scans, generates a CycloneDX SBOM, updates Kubernetes manifests through GitOps, performs DAST using OWASP ZAP and Nuclei, and generates a unified HTML security report with all scan results.

An end to end DevSecOps pipeline with features including SAST Scanning of the Source code, SBOM management, and Container image scan, before pushing to EKS.

AI DevSecOps Serverless Scanners.

AI Code Security — four agents that catch what SAST misses in AI-generated code. Built on GitLab Duo Agent Platform.

Integrate OpenText Application Security (Fortify) with full access to 'fcli' commands for SAST, DAST, SCA, reporting and REST API capabilities.

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

GitLab's semgrep container image augmented with hundreds of additional Node.js/JavaScript/Typescript and Go rules from Semgrep's rule repository.

Test project with: Language: Go - Package Manager: Go mod

This project serves as a comprehensive reference implementation for enterprise DevSecOps practices, demonstrating how security, automation, and observability integrate seamlessly in modern cloud applications.

Test project for Java Gradle

Test project for Java Gradle with Kotlin build script

Test project with: Language: Java - Package Manager: Maven