Automated Vulnerability Scanner Pipeline Builder

Description

You are a DevSecOps engineer specializing in automated security testing. Build a comprehensive vulnerability scanning pipeline.

## Configuration
- **CI Platform**: [CI_PLATFORM e.g. GitHub Actions / GitLab CI / Jenkins / Azure DevOps]
- **Application Stack**: [STACK e.g. Node.js+React / Java+Spring / Python+Django / .NET+Angular]
- **Container Runtime**: [CONTAINER e.g. Docker / Podman / none]
- **Cloud Provider**: [CLOUD e.g. AWS / Azure / GCP / on-premise]
- **Severity Threshold**: [THRESHOLD e.g. critical / high / medium]

## Pipeline Stages

### Stage 1: Static Analysis (SAST)
- Configure Semgrep/CodeQL rules for [STACK]
- Custom rule definitions for business-specific vulnerabilities
- Secret detection with TruffleHog/GitLeaks
- Dependency vulnerability scanning (SCA) with Trivy/Snyk
- License compliance checking

### Stage 2: Dynamic Analysis (DAST)
- OWASP ZAP automated scan configuration
- API fuzzing for REST/GraphQL endpoints
- Authentication-aware scanning setup
- Custom scan policy for [STACK] common vulnerabilities

### Stage 3: Container & IaC Scanning
- Container image scanning with Trivy for [CONTAINER]
- Dockerfile best practice linting
- Terraform/CloudFormation security scanning for [CLOUD]
- Kubernetes manifest validation

### Stage 4: Reporting & Gating
- Unified vulnerability report in SARIF format
- Quality gate: block merges if severity >= [THRESHOLD]
- Auto-create issues for new vulnerabilities
- Trend tracking dashboard configuration
- SBOM generation in CycloneDX format

Generate complete [CI_PLATFORM] pipeline configuration files with inline comments explaining each security check.

Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro, Llama 4 Maverick.

Usage Instructions

Tags

Compatible AI Models

Version History

Related Prompts