Skip to main content

Pro audit program · v1.0

SAST / DAST / Secret Scanning in CI

The three scanners every CI/CD should run, with finding triage and trend tracking.

  • General target area
  • NIST SSDF / OWASP framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

The three scanners every CI/CD should run, with finding triage and trend tracking.

Risks addressed

  • Critical Secret committed to a public repo
  • Critical SQL injection ships because no SAST in CI
  • High Findings pile up without ownership u2014 scanner ignored

Controls (7)

  1. SAST on every PR

    High

    SAST on every PR

    How to test + evidence

    Testing procedure: CI runs SAST per PR; high / critical findings block the merge.

    Evidence to collect: CI workflow + last run.

  2. DAST against staging on every release

    High

    DAST against staging on every release

    How to test + evidence

    Testing procedure: DAST runs against staging; high findings block release or get explicit exception.

    Evidence to collect: CI workflow + last DAST report.

  3. Secret scanning pre-commit + push

    Critical

    Secret scanning pre-commit + push

    How to test + evidence

    Testing procedure: Pre-commit hook + repo-side push protection; positives notify security.

    Evidence to collect: Hook config + recent block.

  4. Triage SLA per severity

    High

    Triage SLA per severity

    How to test + evidence

    Testing procedure: Critical 7d / High 14d / Medium 30d. Trend reported monthly.

    Evidence to collect: Triage dashboard.

  5. False-positive feedback loop

    Medium

    False-positive feedback loop

    How to test + evidence

    Testing procedure: Engineers can mark FPs with justification; security reviews patterns weekly.

    Evidence to collect: FP register.

  6. Backlog of older findings tracked

    Medium

    Backlog of older findings tracked

    How to test + evidence

    Testing procedure: Findings older than the policy SLA show up on the team dashboard.

    Evidence to collect: Dashboard screenshot.

  7. Container image scanning before push

    High

    Container image scanning before push

    How to test + evidence

    Testing procedure: Built images scanned (Trivy / Grype / equivalent) before promotion.

    Evidence to collect: CI step + last scan.