SAST, DAST, SCA, secrets and SBOM scanning, infrastructure as code, fuzzing, compliance, test-data privacy and multi-tenant isolation.
Compliance testing for GDPR, CCPA/CPRA, HIPAA, PCI DSS v4.0, SOC 2 and ISO/IEC 27001: control tests, audit-trail tests, and evidence collection. Scores existing tests and evidence against a framework's criteria, packages SOC 2 Type II evidence for auditors, and runs an adversarial readiness review.
Coverage-guided fuzzing with libFuzzer, AFL++, cargo-fuzz, Go native fuzzing, Atheris and Jazzer, plus sanitizer crash triage. Covers fuzzer choice, corpus management, sanitizer integration, and ASan / UBSan / MSan crash classification with bulk triage. A builder agent (fuzz-target-author) scaffolds a fuzz harness from a function signature. Binary and system-level fuzzing, distinct from qa-property-based and qa-api-testing/schemathesis-fuzzing.
Infrastructure-as-code testing: Checkov and Trivy misconfiguration scans, OPA, Conftest and Cedar policy tests, Helm chart tests, Terraform plan review. Trivy config is the tfsec successor, with the legacy tfsec workflow in references. A review agent (terraform-plan-reviewer) flags destructive and security-degrading plan changes. Cross-scanner IaC triage is handled by security-finding-triager in qa-security-scanning.
Tenant isolation testing for B2B SaaS: cross-tenant leak tests with a CI gate, row-level security, and tenant onboarding and offboarding tests. Includes silo / pool / bridge isolation models and a Postgres-first RLS reference. A review agent (tenant-leak-critic) traces tenant-id propagation through a diff to find leak risks.
Security scanning across SAST, DAST, SCA, secrets and SBOM: Semgrep, CodeQL, SonarQube, ZAP, Nuclei, Snyk, OSV-Scanner, gitleaks, Syft and Trivy. Also covers language-native SAST linters, Dependabot and Renovate, package-manager audits, reachability and CVE exploitability triage, secret rotation, and VEX. A gate agent (security-finding-triager) normalizes, dedupes and waiver-checks multi-scanner output, including IaC findings from qa-iac, into one BLOCK / PASS verdict per domain. Every scanner skill includes a false-positive triage section.
Test data privacy: detect and mask PII with Presidio, verify k-anonymity on masked datasets, and generate synthetic patient records with Synthea. The masking pipeline runs detect, mask and verify, with PII-category, masking-technique and Faker-substitution catalogs in references.
