App Security

Audit TLS protocols, cipher suites and certificate chains with the sslyze library

Test Python projects for typosquatting and dependency confusion with pip-audit

Build data flow diagrams and STRIDE or LINDDUN threat models in OWASP Threat Dragon

Run authenticated Nessus scans to find CVEs, default credentials and missing patches

Scan web servers with Nikto for dangerous files, outdated versions and CGI flaws

Triage Burp and ZAP findings to confirm real issues and rank fixes by risk

Score vulnerabilities with CVSS v4.0 to rank remediation by severity

Scan container images, filesystems and SBOMs for CVEs with Anchore Grype

Add Trivy scans to CI/CD to block vulnerable images and Dockerfile misconfigs

Scan Docker images with Trivy for CVEs, secrets and license issues in SARIF

Scan Terraform, Kubernetes manifests and images with Trivy before deployment

Scan servers, network devices and workstations for vulnerabilities with Nessus

Score Kubernetes manifests with Kubesec to flag privilege risks before deploy

Sign and scan registry images with Cosign and Trivy to block unsigned deploys

Configure Harbor with Trivy scanning, Cosign trust policies and project RBAC

Harden GitHub Actions with SHA pinned actions, minimal tokens and safe expressions

Prioritize vulnerabilities with CISA SSVC decisions using KEV and EPSS data

Verify Sigstore signatures and SLSA provenance for CI build artifacts with cosign

Design secure APIs with authentication, authorization, input checks and rate limits

Test REST and GraphQL APIs for auth, authorization, rate limit and input flaws

Build STRIDE and LINDDUN threat models with CVE and exploit-data dependency screens

Set up static analysis security scanners and write custom rules for your code

Manage CI/CD secrets with Vault, AWS Secrets Manager and other secret stores

Run a security audit covering web, API, scanning and hardening checks

Run application security scans, vulnerability assessments and compliance checks

Scan npm, PyPI and CI pipelines for compromised packages and malicious versions

Learn common web vulnerability classes like injection, access control and misconfigs

Prioritize vulnerabilities by attack surface, OWASP 2025 and supply chain risk

Filter unsafe user content with Google Model Armor from the command line

Create a Google Model Armor filtering template for prompts and responses

Sanitize a user prompt through a Model Armor template before sending it

Sanitize a model response through a Model Armor template before showing it

Vet secrets, push targets, destructive git commands and new dependencies before acting

Review code against a security checklist to find vulnerabilities

Assess AI and LLM systems for prompt injection, jailbreaks and tool abuse

Audit dependencies for CVEs, license conflicts and safe upgrade paths

Audit .env files for committed secrets and plan credential rotation

Set up secrets management with Vault, AWS, Azure and GCP secret stores

Block risky code edits like injection, XSS and unsafe eval before writing

Run SAST and DAST scans and plan CVE remediation for applications

Run STRIDE threat models and DREAD risk scores on system designs

Scan agent skills for malicious code before you install them from untrusted sources

Review Python, JavaScript and TypeScript code against language-specific security practices

Map who owns sensitive code in a git repo and measure bus factor risk

Write a repo-grounded threat model with trust boundaries, abuse paths and mitigations

Audit a game for save tampering, cheat vectors and network exploits before release

Scan agent skills for malicious patterns, prompt injection and over-permissions

Model compromise scenarios for your own assets and keep a scored risk register

Choose and use TLS, encryption, hashing and key management correctly