Add practical guidance for integrating security tools into CI workflows

[BhagyaC]

The current page lists free application security tools for open source projects, including SAST, DAST, IAST, dependency analysis, code quality tools, secrets detection, and CI/CD security tools. It also lists GitHub code scanning as a free SAST option for open source projects that can use GitHub Actions and CodeQL.

The page would benefit from a short vendor-neutral section that explains how maintainers can introduce these tools into CI workflows and how they can move from default rules to project-specific checks.

Proposed addition

Add a section titled:

Integrating security tools into CI workflows

The section should explain:

1. Security checks can run on pull requests and pushes.
2. Maintainers can start with a small set of high-confidence checks.
3. Projects can combine multiple tool categories over time:
   • SAST for source-code patterns.
   • SCA/dependency checks for vulnerable components.
   • Secrets detection for exposed credentials.
   • DAST for running web applications.
   • IaC and CI/CD checks for infrastructure and workflow configuration.
4. Maintainers can later add custom rules or queries for project-specific risks.
5. Custom checks should include documentation, tests, and clear rationale so future maintainers can review them.

Suggested minimal example

Add one short GitHub Actions example, such as a CodeQL code scanning workflow, and link to the official GitHub documentation for more detailed configuration.

The page should not duplicate full CodeQL, Semgrep, ZAP, or dependency scanning documentation. It should provide a short starting point and link to the relevant tool documentation.

Acceptance criteria

• The new section stays vendor-neutral.
• The new section explains how CI can run security checks on pull requests and pushes.
• The new section maps existing OWASP tool categories to CI use cases.
• The new section includes one minimal workflow example.
• The new section links to official documentation for CodeQL custom queries, CodeQL query packs, Semgrep custom rules, and GitHub code scanning.
• The section explains that custom rules and queries should be documented and tested.

References

• OWASP Free for Open Source Application Security Tools: https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools
• OWASP Source Code Analysis Tools: https://owasp.org/www-community/Source_Code_Analysis_Tools
• OWASP GitHub Actions Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
• GitHub Docs, About code scanning with CodeQL: https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql
• GitHub Docs, CodeQL custom queries: https://docs.github.com/en/code-security/concepts/code-scanning/codeql/custom-codeql-queries
• GitHub Docs, CodeQL query packs: https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-query-packs
• Semgrep Docs, Custom rules: https://semgrep.dev/docs/writing-rules/overview

[kevinollyn]

Good Day Than k you for getting back to me, This information i ask you guys the 1 time before than i had all the information, clips pics was link address ens was done because i knew that you will cover up and ask me to do this so that when i lock into these side information will be erase. Even before you guys started blog or AI the pages or some pages i it was already send to my attorney i will be speaking to you guys soon as i see that request that i asked was not attend to. Today i'm having meeting with all member, government to work on this matter because this has physically and mentally broke my children they starting there counselling classes and i promise you guys action will be taken against you i will not leave this problem open like this because i see she is still working for you and it looks like she is climbing the ladder will her kids is waiting for her and you guys are keeping her away from her responsibility. Thank you for the effort much appreciated Regards

…

On Wed, Apr 29, 2026 at 6:48 AM Bhagya C ***@***.***> wrote: *BhagyaC* created an issue (OWASP/www-community#1267) <#1267> The current page lists free application security tools for open source projects, including SAST, DAST, IAST, dependency analysis, code quality tools, secrets detection, and CI/CD security tools. It also lists GitHub code scanning as a free SAST option for open source projects that can use GitHub Actions and CodeQL. The page would benefit from a short vendor-neutral section that explains how maintainers can introduce these tools into CI workflows and how they can move from default rules to project-specific checks. Proposed addition Add a section titled: Integrating security tools into CI workflows The section should explain: 1. Security checks can run on pull requests and pushes. 2. Maintainers can start with a small set of high-confidence checks. 3. Projects can combine multiple tool categories over time: - SAST for source-code patterns. - SCA/dependency checks for vulnerable components. - Secrets detection for exposed credentials. - DAST for running web applications. - IaC and CI/CD checks for infrastructure and workflow configuration. 4. Maintainers can later add custom rules or queries for project-specific risks. 5. Custom checks should include documentation, tests, and clear rationale so future maintainers can review them. Suggested minimal example Add one short GitHub Actions example, such as a CodeQL code scanning workflow, and link to the official GitHub documentation for more detailed configuration. The page should not duplicate full CodeQL, Semgrep, ZAP, or dependency scanning documentation. It should provide a short starting point and link to the relevant tool documentation. Acceptance criteria - The new section stays vendor-neutral. - The new section explains how CI can run security checks on pull requests and pushes. - The new section maps existing OWASP tool categories to CI use cases. - The new section includes one minimal workflow example. - The new section links to official documentation for CodeQL custom queries, CodeQL query packs, Semgrep custom rules, and GitHub code scanning. - The section explains that custom rules and queries should be documented and tested. References - OWASP Free for Open Source Application Security Tools: https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools - OWASP Source Code Analysis Tools: https://owasp.org/www-community/Source_Code_Analysis_Tools - OWASP GitHub Actions Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html - GitHub Docs, About code scanning with CodeQL: https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql - GitHub Docs, CodeQL custom queries: https://docs.github.com/en/code-security/concepts/code-scanning/codeql/custom-codeql-queries - GitHub Docs, CodeQL query packs: https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-query-packs - Semgrep Docs, Custom rules: https://semgrep.dev/docs/writing-rules/overview — Reply to this email directly, view it on GitHub <#1267>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BZ3Y7WEVDTSTBEESJNUQEKL4YGCR3AVCNFSM6AAAAACYKHR7WWVHI2DSMVQWIX3LMV43ASLTON2WKOZUGM2DOOJWGA4DSMY> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>