Discussion: Transition to Free Security Tools

[scherersebastian]

We are considering a switch to a new security toolchain using free, open-source tools to enhance our security practices while managing costs. Your input is crucial in making this decision.

Proposed Toolchain

The new toolchain includes:

• Trivy: Container and application vulnerability scanner.
• KICS: Security scanner for Infrastructure as Code (IaC).
• GitGuardian: Sensitive data monitoring for repositories.
• CodeQL: Static code analysis for identifying vulnerabilities.
• OWASP Zap: Web app penetration testing.
• Dependabot: Dependency scanning and automated dependency updates.

Request for Comments

Please share your thoughts. Your insights will help shape our security strategy.

[DnlZF]

Workshop result:
We agree with the proposed tools.

[scherersebastian]

I will take care of all tools except OWASP ZAP #18 .
@RoKrish14 can you please create the action for OWASP ZAP?

[RoKrish14]

@scherersebastian : PR has been created to add the OWASP ZAP details #23 .

[scherersebastian]

@RoKrish14 Awesome!
As soon as I have the time ... I will review it and give you feedback - I will make it a priority.

[scherersebastian]

PR was closed