In the cloud-native world, API security is an important concern as most microservices are exposed externally to users and to other internal services via APIs. Traceable AST complements the API Catalog in using the DNA to build intelligently targeted scans for detecting vulnerabilities at the API layer. It also helps close the loop of exploits found in production by running security scans in pre-prod environments. It helps in finding vulnerabilities in the early stages of SDLC, giving developers and Product security engineers more time and context to prioritize mitigation of vulnerabilities and build secure APIs.

Traceable’s GitHub action can be used to continuously test your software builds for active vulnerabilities and get comprehensive reports which will help in deciding if a build should pass or not based on new or existing vulnerabilities exposed by the new code. It runs AST scans on triggers and maps scan results which include a list of vulnerabilities with severities based on CVSS and CWE scores to help categorize issues correctly and get a comprehensive understanding of risks added by new code added in the relevant builds.

• Extensive security testing coverage for microservices and APIs.
• Generate tests from live functional traffic for targeted security testing based on actual payloads
• Insertion into DevSecOps with Scan initiation and Vulnerability Management from scan findings.
• Inserts security seamlessly into existing functional tests in the same pipeline with full automation.
• Risk-based prioritization using asset inventory, threat intel, and predictive modeling.
• Make a decision around passing or failing the build based on security issues introduced in it.

1. Here is the sample GitHub actions workflow which shows how you can configure the AST GitHub action.

name: Test Traceable AST Init Action And Traceable AST Run Action
on:
  push:
    branches:
      - main
  pull_request:

jobs:
  AstScan:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Init scan action
        uses: traceableai/ast-action
        with:
          step_name: 'init'
          client_scan_token: ${{ secrets.CLIENT_SCAN_TOKEN }}
          traffic_env: 'crapi-demo-1'
          traceable_server: ${{ secrets.TRACEABLE_SERVER }}
      - name: Run a loop as functional test (This is sample)
        run: |
          for ((i=1;i<=100;i++)); 
          do 
             echo $i
          done
      - name: Run scan action
        uses: traceable-github-actions/traceable-ast
        with:
          step_name: 'run'
          client_scan_token: ${{ secrets.CLIENT_SCAN_TOKEN }}
          traffic_env: 'crapi-demo-1'
          cli_version: '1.0.0-rc.3'

2. As you can see in the above workflow, we have initiated the scan with initiate scan action step which takes client_scan_token, traffic_env, and traceable_server as input.
3. In the next step we are executing functional tests and then running the scan in the step after that which take client_scan_token,traffic_env, and cli_version as input.