SAST, dependency scanning et secret detection

Vue d'ensemble de la securite GitLab

GitLab integre des outils de securite directement dans le pipeline CI/CD :

• SAST (Static Application Security Testing) — Analyse statique du code source
• DAST (Dynamic Application Security Testing) — Tests sur l'application deployee
• Dependency Scanning — Vulnerabilites dans les dependances
• Secret Detection — Detection de secrets dans le code
• Container Scanning — Vulnerabilites dans les images Docker
• License Compliance — Conformite des licences

Activer SAST

# .gitlab-ci.yml
include:
  - template: Security/SAST.gitlab-ci.yml

variables:
  SAST_EXCLUDED_PATHS: "spec, test, tests"
  SAST_EXCLUDED_ANALYZERS: "eslint"

# Les rapports apparaissent dans la merge request
# et dans Security Dashboard

Dependency Scanning

include:
  - template: Security/Dependency-Scanning.gitlab-ci.yml

variables:
  DS_EXCLUDED_PATHS: "vendor/"
  DS_MAX_DEPTH: 2

Secret Detection

include:
  - template: Security/Secret-Detection.gitlab-ci.yml

variables:
  SECRET_DETECTION_EXCLUDED_PATHS: "tests/"
  SECRET_DETECTION_HISTORIC_SCAN: "true"    # Scanne tout l'historique Git

Regles de detection courantes

• Cles AWS (AKIA...)
• Tokens GitLab (glpat-...)
• Cles privees SSH/PGP
• Mots de passe dans les URLs
• Tokens Slack, API keys generiques