search

fastify / demo

MIT License
30 stars 15 forks source link

Using static security analysis tool? #42

Open jean-michelet opened 1 month ago

jean-michelet commented 1 month ago

Maybe we should use Snyk or another tool to look at the source code during CI (and to run locally).

mcollina commented 1 month ago

Agreed.

fernan-x commented 1 month ago

Do you already use another security analysis tool within the ecosystem ?

You mention Snyk, but there is also OWASP Dependency-Check or Sonar Cube community edition.

I'll be happy to help integrate one of them. Or help to dig into the differences between them to help taking a decision.

jean-michelet commented 1 month ago

Or help to dig into the differences between them to help taking a decision.

Go ahead 👍

Checking dependencies with vulnerabilities is good, detect insecure patterns trough static code analysis is good too.

lirantal commented 1 month ago

Jumping in to clarify that Snyk scans both dependencies as well as first-party code (static analysis)

gurgunday commented 1 month ago

Jumping in to clarify that Snyk scans both dependencies as well as first-party code (static analysis)

Nice!

jean-michelet commented 1 month ago

Do you want to work integrating Snyk @fernan-x?

fernan-x commented 1 month ago

Sure, I have some free time tomorrow.

nvuillam commented 3 weeks ago

You should have a look at megalinter :)

https://megalinter.io/latest/

100% free and open-source :)