<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Secure Development Lifecycle

## semgrep — SAST
```bash
semgrep --config=auto --config=p/owasp-top-ten --json src/
```

## trivy — Dependency Scanning
```bash
trivy fs --security-checks vuln --severity HIGH,CRITICAL .
trivy image --severity HIGH,CRITICAL myapp:latest
```

## OWASP ZAP — DAST
```bash
docker run ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t URL -J report.json
```

## snyk — SCA
```bash
snyk test --severity-threshold=high
snyk monitor
```

## nuclei — Vulnerability Scanning
```bash
nuclei -u URL -t http/vulnerabilities/ -severity critical,high
```

## pip-audit / npm audit — Language-Specific
```bash
pip-audit --strict --desc
npm audit --audit-level=high
```
