↓ Skip to main content
Romano Roth
  1. Tags/

Semgrep

GitHub DevSecOps Part 5: Static Application Security Testing (SAST)

·5 mins
DevSecOps GitHub CI/CD DevOps SAST Static Application Security Testing Application Security CodeQL Semgrep SpotBugs
SCA covered our dependencies. License compliance covered what we are allowed to ship. SAST is where we point the scanners at the code we wrote ourselves. In Part 5 of our GitHub DevSecOps series, Patrick Steger and I add Static Application Security Testing to the pipeline — and find out the hard way that on GitHub it takes three Actions, not one.

GitLab DevSecOps Part 5: Static Application Security Testing (SAST)

·4 mins
DevSecOps GitLab CI/CD DevOps SAST Static Application Security Testing Application Security Semgrep SpotBugs
Software composition analysis takes care of the libraries you pull in. But what about the code your own team writes? That is where Static Application Security Testing comes in. In Part 5 of our GitLab DevSecOps series, Patrick Steger and I add SAST to the pipeline, plant a few realistic vulnerabilities in our Spring Boot sample, and watch GitLab pick them up.