qa-security-scanning

This plugin provides unified security scanning across five domains—SAST (semgrep, SonarQube, CodeQL, language-native tools), DAST (ZAP, Nuclei), SCA (Snyk, OSV, npm/pip/maven audit), secrets (gitleaks, trufflehog), and SBOM/container scanning (Syft, Trivy)—with 21 scanner skills and one cross-domain agent that normalizes, deduplicates, and gates multi-scanner output into a single BLOCK/PASS verdict per domain. Every scanner skill includes mandatory false-positive triage guidance with suppression patterns and review cadences to prevent scanners from becoming shelf-ware.