SAST on Romano Roth

GitHub DevSecOps Part 5: Static Application Security Testing (SAST)

Wed, 01 Feb 2023 00:00:00 +0000

SCA covered our dependencies. License compliance covered what we are allowed to ship. SAST is where we point the scanners at the code we wrote ourselves. In Part 5 of our GitHub DevSecOps series, Patrick Steger and I add Static Application Security Testing to the pipeline — and find out the hard way that on GitHub it takes three Actions, not one.

GitLab DevSecOps Part 5: Static Application Security Testing (SAST)

Wed, 31 Aug 2022 00:00:00 +0000

Software composition analysis takes care of the libraries you pull in. But what about the code your own team writes? That is where Static Application Security Testing comes in. In Part 5 of our GitLab DevSecOps series, Patrick Steger and I add SAST to the pipeline, plant a few realistic vulnerabilities in our Spring Boot sample, and watch GitLab pick them up.