S

SAST

A project containing "vulnerable" code for testing GitLab SAST functionality.

Toolkit local-first de agentes IA para OpenCode. Orquesta subagentes cloud (OpenCode Go) y locales (Ollama), con memoria persistente (engram), OCR local (uocr) y generación/edición de imágenes (ComfyUI). Incluye dos agentes primary — agente-pobre (orquestador, optimización de costo) y agente-hacker-pobre (pentesting ético autorizado + auditoría de seguridad) — con skills de SAST/pentest, y un vault Obsidian de conocimiento. TypeScript (bun) + plugins de OpenCode.

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

Anura is an open-source harness platform built by the security research community to create an independent, realistic benchmark for AI systems used in security research. It runs models and agents against real public, authorized bug bounty scopes and security artifacts, then measures what they actually discover, validate, and reject in practical investigations.

Codequality jobs in pipelines https://docs.gitlab.com/ee/user/project/merge_requests/code_quality.html

This GitLab CI/CD pipeline implements a complete DevSecOps and GitOps workflow for a containerized application. It performs Dockerfile linting, builds and pushes images with Kaniko, runs Gitleaks and Trivy security scans, generates a CycloneDX SBOM, updates Kubernetes manifests through GitOps, performs DAST using OWASP ZAP and Nuclei, and generates a unified HTML security report with all scan results.

Setup Static Application Secret Testing (SAST) in GitLab CI pipeline using NJSScan and Semgrep.

Convert from SARIF to GitLab Code Quality and SAST report.

This project sets up Static Application Security Testing (SAST) in a GitLab CI/CD pipeline using two tools:

NJSScan → A security scanner specialized for JavaScript applications. It analyzes source code and flags insecure coding patterns and vulnerabilities.

Semgrep → A lightweight, multi-language static analysis tool that uses rulesets (such as p/javascript) to detect vulnerabilities, insecure practices, and style issues across different programming languages.

An end to end DevSecOps pipeline with features including SAST Scanning of the Source code, SBOM management, and Container image scan, before pushing to EKS.

The diplom project of the Yandex practicum

Gitlab CI / CD templates for easy jobs and pipelines