DevSecOps Pipeline Security: Automating DAST/SAST in CI/CD Workflows

What is DevSecOps?

DevSecOps integrates security into every phase of the software development lifecycle. Rather than treating security as a final gate, it becomes a shared responsibility throughout development.

Shift-Left Security

Moving security testing earlier ("shifting left") catches vulnerabilities when they're cheaper to fix:

• Design: Threat modeling
• Code: SAST scanning
• Build: Dependency checking
• Test: DAST scanning
• Deploy: Configuration validation
• Runtime: Monitoring and WAF

CI/CD Integration Examples

GitHub Actions

- name: SuperClue DAST scan
  env:
    SUPERCLUE_API_KEY: ${{ secrets.SUPERCLUE_API_KEY }}
  run: |
    jq -n --arg url "$STAGING_URL" '{type: "dast", target: $url}' > payload.json
    curl --fail-with-body -sS -X POST "https://superclue.io/api/cicd/scan" \
      -H "X-API-Key: $SUPERCLUE_API_KEY" \
      -H "Content-Type: application/json" \
      --data-binary @payload.json -o scan_results.json

GitLab CI

superclue-dast:
  stage: test
  image: alpine:3.20
  before_script:
    - apk add --no-cache curl jq
  script:
    - |
      jq -n --arg url "$STAGING_URL" '{type: "dast", target: $url}' > payload.json
      curl --fail-with-body -sS -X POST "https://superclue.io/api/cicd/scan" \
        -H "X-API-Key: $SUPERCLUE_API_KEY" \
        -H "Content-Type: application/json" \
        --data-binary @payload.json -o scan_results.json

Both examples call SuperClue's CI/CD API with an API key you create in the dashboard. A pipeline scan runs SuperClue's basic DAST checks (security headers, server banner, HTTPS, and TRACE), or its 10-rule SAST scan if you send "type": "sast" with source code as the target. It does not run the full 350-module scan, and the DAST target must be a domain you have verified in your SuperClue account. Add a step that reads scan_results.json and fails the build on critical findings.

Best Practices

1. Fail builds on critical vulnerabilities
2. Track security metrics over time
3. Automate remediation where possible
4. Educate developers on secure coding

SuperClue CI/CD Features

• REST API for programmatic scanning
• Webhook notifications
• JIRA/GitHub integration
• Build gating: your pipeline fails the build when a scan returns critical findings