46 / 70 · 07 Security Testing for AI Apps · SAST, DAST, and SCA in CI: Shift-Left Security Pipeline← prev⊞ allnext →☰ Read as one page
8.2Tool Landscape
| Category | Tool | What It Does | Integration Point | Cost |
|---|---|---|---|---|
| SAST | Semgrep | Pattern-based code analysis | Pre-commit hook, CI | Free (open source rules) |
| SAST | CodeQL | Deep semantic code analysis | GitHub Actions (native) | Free for public repos |
| DAST | ZAP (OWASP) | Active web vulnerability scanning | CI (against staging) | Free/open source |
| DAST | Burp Suite | Comprehensive web security testing | Manual + CI (Enterprise) | Commercial |
| SCA | Snyk | Dependency vulnerability scanning | CI, IDE, registry | Freemium |
| SCA | Dependabot | Automated dependency updates | GitHub native | Free |
| Secrets | GitLeaks | Detect secrets in git history | Pre-commit hook | Free/open source |
| Container | Trivy | Container image vulnerability scanning | CI | Free/open source |