SAST & DAST — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— SAST & DAST
🔍SAST Scan
🔑Secret Scan
🕷️DAST Attack
🚦Security Gate
🎯 Next: Test →
Step 1 / 4
Speed
CodeQL Static Analysis
Initialize CodeQL with security-extended Queries💡 Analogy
Like reading every recipe in a cookbook and flagging any that say "add raw chicken to the salad" — finding dangerous patterns before the dish is cooked.
CodeQL compiles the code into a database, then runs hundreds of queries to detect vulnerability patterns without executing the code.
Console Output
> CodeQL initializing database for TypeScript...
> Running security-extended queries (847 checks)
> Found: 2 results
>   - sql-injection: src/routes/user.ts:24 (High)
>   - xss: src/templates/comment.tsx:15 (Medium)
> Results uploaded to GitHub Security tab
●.github/workflows/security.yml
CodeQL Static AnalysisL20–33
1# GitHub Actions: DevSecOps Pipeline — SAST + DAST
2# .github/workflows/security.yml
3 
4name: Security Scan
5 
6on:
7  push:
8    branches: [main, 'release/**']
9  pull_request:
10 
11jobs:
12  # ─── SAST: CodeQL Static Analysis ──────────────
13  sast:
14    name: CodeQL SAST
15    runs-on: ubuntu-latest
16    permissions:
17      security-events: write
18      contents: read
19    steps:
20      - uses: actions/checkout@v4
21 
22      - name: Initialize CodeQL
23        uses: github/codeql-action/init@v3
24        with:
25          languages: typescript, javascript
26          queries: security-extended  # More thorough than default
27 
28      - name: Build
29        run: npm ci && npm run build
30 
31      - name: Analyze
32        uses: github/codeql-action/analyze@v3
33        with:
34          upload: true  # Results appear in GitHub Security tab
35 
36  # ─── Secret Scanning ────────────────────────────
37  secrets:
38    name: Secret Detection
39    runs-on: ubuntu-latest
40    steps:
41      - uses: actions/checkout@v4
42        with:
43          fetch-depth: 0  # Full history for pre-commit scan
44 
45      - name: Gitleaks
46        uses: gitleaks/gitleaks-action@v2
47        with:
48          config: .gitleaks.toml  # Custom rules for your org
49 
50  # ─── IaC Security Scan ─────────────────────────
51  iac:
52    name: Checkov IaC Scan
53    runs-on: ubuntu-latest
54    steps:
55      - uses: actions/checkout@v4
56      - uses: bridgecrewio/checkov-action@v12
57        with:
58          directory: ./infrastructure
59          framework: terraform,bicep
60          soft_fail: false   # ← Fail CI on policy violations
61          output_format: sarif
62          output_file_path: checkov.sarif
63 
64  # ─── DAST: OWASP ZAP Authenticated Scan ────────
65  dast:
66    name: OWASP ZAP DAST
67    needs: [sast, secrets]  # Run only after build passes
68    runs-on: ubuntu-latest
69    services:
70      app:
71        image: myapp:${{ github.sha }}
72        ports: ['3000:3000']
73    steps:
74      - name: ZAP Authenticated Scan
75        uses: zaproxy/action-full-scan@v0.10.0
76        with:
77          target: 'http://localhost:3000'
78          rules_file_name: '.zap/rules.tsv'
79          cmd_options: '-a'   # Include alpha/beta rules
80 
80 lines
Timeline — 4 Steps
CodeQL Static Analysis
Initialize CodeQL with security-extended Queries💡 Analogy
Like reading every recipe in a cookbook and flagging any that say "add raw chicken to the salad" — finding dangerous patterns before the dish is cooked.
CodeQL compiles the code into a database, then runs hundreds of queries to detect vulnerability patterns without executing the code.
Console Output
> CodeQL initializing database for TypeScript...
> Running security-extended queries (847 checks)
> Found: 2 results
>   - sql-injection: src/routes/user.ts:24 (High)
>   - xss: src/templates/comment.tsx:15 (Medium)
> Results uploaded to GitHub Security tab

Was this page helpful?

Discussion

Initialize CodeQL with security-extended Queries

💡 Analogy

Like reading every recipe in a cookbook and flagging any that say "add raw chicken to the salad" — finding dangerous patterns before the dish is cooked.

CodeQL compiles the code into a database, then runs hundreds of queries to detect vulnerability patterns without executing the code.

Console Output

> CodeQL initializing database for TypeScript...
> Running security-extended queries (847 checks)
> Found: 2 results
>   - sql-injection: src/routes/user.ts:24 (High)
>   - xss: src/templates/comment.tsx:15 (Medium)
> Results uploaded to GitHub Security tab

Initialize CodeQL with security-extended Queries

💡 Analogy

Like reading every recipe in a cookbook and flagging any that say "add raw chicken to the salad" — finding dangerous patterns before the dish is cooked.

CodeQL compiles the code into a database, then runs hundreds of queries to detect vulnerability patterns without executing the code.

Console Output

> CodeQL initializing database for TypeScript...
> Running security-extended queries (847 checks)
> Found: 2 results
>   - sql-injection: src/routes/user.ts:24 (High)
>   - xss: src/templates/comment.tsx:15 (Medium)
> Results uploaded to GitHub Security tab