"The SAST and the furious"
summary
Live demos use SEMGREP for PHP/JS SAST and Trivy for dependency and container scans, integrated into GitLab CI via YAML. SEMGREP flags an unsafe exec in a TYPO3 demo and Trivy reports 44 JS vulnerabilities (four criticals) from yarn; pipeline runs take ~1:02 and can block merge when set to fail on criticals. Workflow shows allow-failure-to-true rollout, later centralizing rules in one repo, and exports results as SARIF/JSON for dashboards (GitLab Ultimate adds built-in security views).
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:50What is application security
- 3:56Security scanning tools
- 5:43Introducing Semgrep
- 9:32Live Semgrep demo
- 12:46Integrating Semgrep into pipelines
- 18:13Supply chain attacks
- 20:39Introducing Trivy
- 22:28Live Trivy demo
- 24:56Integrating Trivy into pipelines
- 28:30Fixing vulnerabilities live
- 36:00Generating security reports
- 38:25Are you secure yet?
- 39:47Q&A
related talks
17mShift-Left Security in Practice with Gitlab
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
26mSecurity Automation For GraphQL
19mApplication Security at High Velocity
34mKeep your code safe during the development path using OS tools
32mSAST and Sensibility: A Rubyist’s Guide to Static...
43mDevSecOps on steroids - Powered by your Selenium tests
31mFrom Noise to Notes: Orchestrating SAST with Developers... (Adrián Puente Z.)