Secure Language Stacks

Security toolchain reference for the top 15 GitHub languages. Each stack provides scanner configs, reusable CI templates (Concourse + GitHub Actions), and nexus-agents skills.

Languages

Language	Category	SAST	SCA	Secrets	DAST	Container
TypeScript	compiled	semgrep, eslint-security	trivy, npm-audit	gitleaks	zap	trivy
JavaScript	interpreted	semgrep, eslint-security	trivy, npm-audit	gitleaks	zap	trivy
Python	interpreted	semgrep, bandit	trivy, pip-audit	gitleaks	zap	trivy
Java	compiled	semgrep, spotbugs	trivy, dependency-check	gitleaks	zap	trivy
Go	compiled	semgrep, gosec	trivy, govulncheck	gitleaks	--	trivy
Rust	compiled	semgrep	trivy, cargo-audit	gitleaks	--	trivy
C++	compiled	semgrep, cppcheck	trivy	gitleaks	--	trivy
Kotlin	compiled	semgrep, detekt	trivy, dependency-check	gitleaks	zap	trivy
Swift	compiled	semgrep	trivy	gitleaks	--	--
SQL	infrastructure	semgrep, sqlfluff	--	gitleaks	--	--
Ruby	interpreted	semgrep, brakeman	trivy, bundler-audit	gitleaks	zap	trivy
PHP	interpreted	semgrep, phpstan	trivy, composer-audit	gitleaks	zap	trivy
Shell	interpreted	semgrep, shellcheck	--	gitleaks	--	--
HCL	infrastructure	semgrep, tfsec	trivy	gitleaks	--	--
YAML	infrastructure	semgrep	--	gitleaks	--	--

Usage

As a Reference

Browse stacks/{language}/ for scanner configs, CI templates, and security guidance.

With nexus-agents

Each stack includes a skill file (skills/secure-{lang}.md) loadable by nexus-agents for automated security scanning guidance.

CI Integration

Copy pipeline templates from stacks/{language}/pipelines/ into your project:

• Concourse: pipelines/concourse/pipeline.yml
• GitHub Actions: pipelines/github-actions/security.yml

Both reference shared reusable templates in shared/.

Validation

pnpm install
pnpm validate   # Validate all stack.yaml files
pnpm matrix     # Generate compatibility matrix

Contributing

See docs/CONTRIBUTING.md.

Architecture Decisions

• ADR-0001: Stack Schema Design

License

MIT