SAST (Semgrep)
Static analysis for OWASP Top 10, secrets, deserialization, and crypto misuse. Outputs JSON/SARIF/HTML for CI and IDEs.
Services
Everything is serverless on Google Cloud. Trigger on demand, pay per use, and ship fixes faster with clear artifacts.
DAST (OWASP ZAP)
Baseline passive scans against live endpoints with respectful crawl and production‑safe defaults.
Dependencies (Trivy)
CVE detection for app deps and containers. Pin versions, apply vendor fixes, and track severity over time.
Automated Reporting
SECURITY_SUMMARY.md plus detailed HTML/JSON/SARIF artifacts in GCS. Download locally for handoff.
Serverless Orchestration
Cloud Build workers are isolated and ephemeral. Idle infra cost is $0 until triggered.
Integration Ready
Trigger from CI, webhooks, or schedules. Optional Slack/Jira notifications and policy gates.