Free DIY Continuous Security guide: build SAST, DAST, SCA and secrets scanning with GitHub and free tools
evilsocket · x · 2026-10-19
The full content of a BSidesNYC security engineering workshop is now public at seceng.guide, showing how to build a continuous security function from scratch using only GitHub and free tools.
- SAST: Semgrep wired into CI for code and PR scanning, plus testing your own SAST Action
- DAST: Nuclei, ZAP and Nmap for runtime scanning of the deployed app, with hands-on labs
- SCA: Dependabot for third-party dependency vulnerabilities
- Secrets: TruffleHog for secret leakage scanning
- AI SAST: Claude used for code security review
The tutorial uses a fictional Rails app, "Jester Social", casting readers as its first security hire and walking through each control with forkable labs.
More from coding & agent
- os-taxonomy gains 427 stars in a day, passing 5.8k on GitHub — withmarbleapp · 2026-10-19
- Headroom: open-source context compression cuts coding agent tokens by 20% — headroomlabs-ai · 2026-10-19
- Graph engineering plus tiny-model routing sorts 1,000 articles overnight for 4 cents — blaizedsouza · 2026-10-19
- He built a local photo search app with Claude — 8s per 1k photos, open-sourced — chasedev21 · 2026-10-19
- Every built a custom AI app to redact interview transcripts for its OpenAI 'How Codex Happened' story — every · 2026-10-19
- Running multiple AI agents across ~22 repos: one dev's plan to stop collisions — Aruscha · 2026-10-19