Quick Notes85 words
Security and compliance scanning strategy — quick notes
Scanning strategy — quick notes
| Scan | Question |
|---|---|
| Dependency | Are third-party components vulnerable? |
| Code (SAST) | Does our code contain vulnerable patterns? |
| Secret | Have credentials been committed? |
| Licensing | Do dependency licences comply? |
- Push protection stops a secret before it enters history; detection after means rotate.
- Continuous alerting catches CVEs disclosed after the code stopped changing.
- Block on unambiguous+fixable; report on judgement calls, or the gate gets bypassed.