# DevSecOps Pipeline Tool Reference
| Stage | Tool | Purpose |
|-------|------|---------|
| Pre-commit | gitleaks, pre-commit hooks | Secrets prevention |
| SAST | Semgrep, CodeQL, SonarQube | Static code analysis |
| SCA | Snyk, npm audit, pip-audit, OSV Scanner | Dependency vulnerabilities |
| DAST | Nuclei, ZAP, Burp Suite | Dynamic testing |
| Container | Trivy, Grype, Docker Scout | Image scanning |
| IaC | Checkov, tfsec, KICS | Infrastructure-as-code |
| Secrets | TruffleHog, detect-secrets | Secret detection |
| SBOM | Syft, CycloneDX | Bill of materials |
| License | FOSSA, license-checker | License compliance |
