// tool reference · Governance & Advisory

DevSecOps Configuration Assistant Pro

リリース可否を総合判定する、説明可能な CI/CD セキュリティゲート。

Open DevSecOps Configuration Assistant →

What it does

Designs pipeline security: where to place SAST and DAST, how to gate on severity, secret scanning, and supply-chain controls — without turning CI into a 40-minute wait.

When to use it

Adding security to CI; deciding what should block a merge versus warn.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
format	select	任意	Pipeline platform.
max_critical	number	任意	Gate threshold.
allow_secrets	checkbox	任意	Allow-list behaviour for secret scanning.
authorized	checkbox	required	Authorisation confirmation.

What you get back

A pipeline design with gates and rationale.

活用例

Input

format = GitHub Actions   max_critical = 0

Output (abridged)

PIPELINE DESIGN

PRE-COMMIT (local, seconds)
  - secret scan. The cheapest place to catch a key is before it exists
    in history. After a push, rotation is the only remedy.

PR (blocking, target <5 min)
  - SAST on the DIFF, not the repo. Full-repo SAST on every PR is how
    teams learn to skip the pipeline.
  - Dependency audit -- fail on CRITICAL (max_critical = 0).
  - IaC scan if infra/ changed.

MAIN (non-blocking)
  - Full SAST, DAST against staging, container scan.

GATE RATIONALE
  Block on: criticals, secrets, KEV-listed dependencies.
  Warn on:  everything else.
  A gate that blocks on 'medium' gets disabled within a month. A gate
  nobody disables is worth more than a strict one nobody runs.

How it works

AI generation over a DevSecOps reference model.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

A design, not a working pipeline. It cannot see your build times or flakiness -- tune thresholds against reality before enforcing them.

プライバシー

Sent to the AI provider.

Standards

OWASP DevSecOpsSLSA conceptsNIST SSDF