Application Security Toolkit

## Overview

A unified AppSec workflow that covers code, dependencies, and running targets — three complementary scanning approaches in one plugin.

- **sast-semgrep** — Static analysis: scans source code for vulnerabilities with OWASP Top 10 and CWE mapping
- **dast-nuclei** — Dynamic scanning: probes running web apps, APIs, and infrastructure for known CVEs and misconfigurations
- **sca-trivy** — Composition analysis: checks dependencies, container images, and IaC for CVEs, license risks, and SBOM generation

## Quick Start

1. Install the plugin: `npx skillstore add @application-security-toolkit`
2. Run sast-semgrep against your codebase to find code-level vulnerabilities
3. Use sca-trivy to scan container images and dependencies for known CVEs
4. Point dast-nuclei at a **staging** target to detect runtime vulnerabilities

## Authorization Boundaries

**Critical: DAST scanning sends live requests to targets.** Follow these rules:

- **Never run dast-nuclei against production** without explicit written authorization from the target owner
- DAST scans should target staging/dev environments by default
- Use Nuclei's rate limiting controls (`-rate-limit`, `-bulk-size`) to avoid overwhelming targets
- sast-semgrep and sca-trivy are read-only and safe to run on any codebase without special authorization
- When scanning third-party dependencies with sca-trivy, only local/cached artifacts are analyzed — no external probing

## Failure Handling & Rollback

**Principle: Report first, never auto-fix. Human review is mandatory.**

- All three tools produce **reports only** — they do not modify source code or patch vulnerabilities automatically
- Findings should be triaged by severity (Critical > High > Medium > Low) before taking action
- **False positives are expected**, especially with SAST pattern matching. Always verify findings before creating fix PRs
- For CI/CD integration: set severity thresholds (`--severity critical,high`) to fail builds only on confirmed high-impact issues
- sca-trivy SARIF output can be imported into GitHub Security tab for team-wide visibility
- Keep scan results as artifacts — do not discard reports even if all findings are resolved

## Key Commands

- `/sast-semgrep` — Run Semgrep static analysis with OWASP/CWE framework mapping
- `/dast-nuclei` — Launch Nuclei template-based scanning against a target URL
- `/sca-trivy` — Scan dependencies, containers, or IaC for CVEs and license issues

## Tips

- Run sast-semgrep and sca-trivy in CI on every PR; reserve dast-nuclei for scheduled security reviews on staging
- Combine sca-trivy SBOM output with sast-semgrep findings for a complete supply chain risk picture
- Create custom Semgrep rules and Nuclei templates for organization-specific security patterns