Every tool from this course, in one place.

Bookmark this slide — for each category, be able to say in one sentence what it catches and where in the pipeline it runs.

Semgrep / SonarQube

SAST

OWASP ZAP

DAST

Snyk / Dependabot

SCA

Trivy / Grype

Container + SBOM

Gitleaks / TruffleHog

Secret scanning

HashiCorp Vault

Secrets management

tfsec / Checkov

IaC scanning

OPA / Gatekeeper

Admission policy

Falco

Runtime detection

Syft

SBOM generation

cosign / Sigstore

Artifact signing

SLSA

Supply-chain maturity

one-liners

semgrep --config=p/security-audit --error .
npm audit --audit-level=high && pip-audit
trivy image --exit-code 1 --severity CRITICAL,HIGH myapp:latest
gitleaks detect --source . --verbose
tfsec . && checkov -d .
syft myapp:latest -o cyclonedx-json > sbom.json
cosign sign myregistry.io/myapp:latest && cosign verify myregistry.io/myapp:latest
kubectl auth can-i delete secrets --as=system:serviceaccount:ns:sa -n ns

If you can name the tool category for every stage of the pipeline, you can explain this entire course.