8.6Pipeline Architecture

  Developer Commits Code
           |
           v
  +------------------+
  | Pre-commit Hooks |   <-- GitLeaks (secrets), Semgrep (quick scan)
  | (< 30 seconds)   |       Runs before code leaves developer machine
  +--------+---------+
           |
           v
  +------------------+
  | SAST + SCA       |   <-- Semgrep (full), Snyk (deps), CodeQL (deep)
  | (2-5 minutes)    |       Runs on every PR
  +--------+---------+
           |
           v
  +------------------+
  | DAST             |   <-- OWASP ZAP against ephemeral environment
  | (10-30 minutes)  |       Runs after SAST passes (why scan if code is broken?)
  +--------+---------+
           |
           v
  +------------------+
  | Container Scan   |   <-- Trivy (image vulnerabilities)
  | (2-5 minutes)    |       Runs on every built image
  +--------+---------+
           |
           v
  +------------------+
  | AI Security      |   <-- Prompt injection, jailbreak, data leakage tests
  | Tests            |       Runs when AI code or prompts change
  | (5-15 minutes)   |
  +------------------+