search

ShiftLeftSecurity / sast-scan

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.
https://discord.gg/DCNxzaeUpd
Apache License 2.0
804 stars 111 forks source link

Test and document scan in offline/airgap mode #82

Open prabhu opened 4 years ago

prabhu commented 4 years ago

Scan should work offline (without internet connectivity) for SAST scanning. For dependency scanning, it has to pull vulnerability databases from NVD and GitHub. This issue involves testing scan without internet connectivity and documenting the experience.

gitnachogo commented 3 years ago

Is it necessary to test all the sast scanners integrated? I've tried --type java without internet connectivity and it has worked pretty well.

prabhu commented 3 years ago

It will be nice to document which domain names are accessed by scan so that they can be opened. Like NVD, GitHub, npm, jitpack and so on