Getting Started: DevSecOps Engineer

​

1. Generating API Credentials

1. Navigate to Platform > Administration > API Keys.
2. Generate a Service Account token with scoped permissions (e.g., scans:trigger, findings:read).
3. Store the token in your CI/CD secrets manager (GitHub Secrets, GitLab CI Variables, HashiCorp Vault).

​

2. Integrating into GitHub Actions

name: Snapsec Security Gate
on:
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Snapsec Scan
        uses: snapsec/security-action@v2
        with:
          api-key: ${{ secrets.SNAPSEC_API_KEY }}
          project-id: "proj_api_gateway_v2"
          fail-on-severity: "high"
          wait-for-completion: true

​

3. Webhook Subscriptions

• finding.created: Trigger instant alerting on newly identified Critical issues.
• assessment.completed: Notify team Slack channels with assessment summary cards.
• sla.breached: Escalate overdue vulnerabilities to engineering managers.