Security Testing
Security scans MUST be run as part of post-generation verification (agenticdevelopercookbook://guidelines/testing/post-generation-verification). These are CLI tools Claude Code can invoke directly.
Static Analysis (SAST):
- Semgrep — all languages:
semgrep scan --config=auto . - Bandit — Python:
bandit -r src/ - CodeQL — deep analysis (Swift, Kotlin, C#, Python, TS, Go)
Dependency Scanning:
- Python:
pip-audit - Node.js:
npm audit - .NET:
dotnet list package --vulnerable - All: Snyk CLI (
snyk test)
Dynamic Analysis (DAST):
- OWASP ZAP — scan running web services:
zap-cli quick-scan http://localhost:8888
See agenticdevelopercookbook://guidelines/implementing/security/* (Security Guidelines) for the full security reference.