<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Continuous Security Testing

## semgrep — Static analysis in CI/CD

```bash
# CI mode with auto-config
semgrep ci --config auto

# OWASP scan with SARIF output
semgrep scan --config p/owasp-top-ten --sarif

```

## trivy — Vulnerability scanner for containers and dependencies

```bash
# Filesystem dependency scan
trivy fs --severity CRITICAL,HIGH .

# Container image scan
trivy image --severity CRITICAL app:latest

```

## zap — OWASP ZAP dynamic application security testing

```bash
# Full DAST scan
zap-full-scan.py -t URL -r report.html

# API-specific scan
zap-api-scan.py -t openapi.json -f openapi

```
