Compliance Report

pitimon

Generate a compliance mapping report for scan findings. Maps vulnerabilities to NIST SP 800-53, OWASP Top 10, MITRE ATT&CK, and CIS Benchmarks.

Auto-Fix

pitimon

Automatically apply security fixes from scan results. Reads findings, generates patches, presents for approval, applies edits, and re-scans to verify.

full-pipeline

pitimon

Run all security scans in parallel — SAST, SCA, Container, IaC, Secrets, SBOM. Produces unified report with compliance mappings and gate decision.

sbom-generate

pitimon

Generate Software Bill of Materials using Syft. Produces CycloneDX or SPDX format SBOMs for compliance and supply chain visibility.

Container Scan

pitimon

Scan Docker container images for vulnerabilities using Trivy. Checks OS packages, language libraries, and Dockerfile misconfigurations.

devsecops-setup

pitimon

Initialize DevSecOps security scanning for the current project. Detects technology stack, configures scan profiles, installs runner prerequisites.

iac-scan

pitimon

Scan Infrastructure as Code files for security misconfigurations using Checkov. Supports Terraform, Kubernetes, Helm, CloudFormation, and more.

sca-scan

pitimon

Scan project dependencies for known vulnerabilities using Grype in a Docker container. Identifies CVEs in packages, libraries, and transitive dependencies.

Security Gate

pitimon

Evaluates scan results against a severity policy and makes a pass/fail deployment decision. Reads the latest scan results and compares them against role-based thresholds.

dast-scan

pitimon

Run Dynamic Application Security Testing using OWASP ZAP in a Docker container. Tests running web applications for vulnerabilities. REQUIRES explicit user approval for target URL.

Incident Response

pitimon

Generate incident response playbooks and coordinate responses to critical security findings. Follows the NIST SP 800-61 Rev.2 framework.

SAST Scan

pitimon

Run Static Application Security Testing (SAST) using Semgrep in a Docker container. Identifies code vulnerabilities, injection flaws, and security anti-patterns.

Secret Scan (GitLeaks)

pitimon

Scan for leaked secrets and credentials using GitLeaks in a Docker container. Detects API keys, passwords, tokens, and other sensitive data in source code and git history.