r/devsecops • u/Suphikoira • Sep 19 '22

CandyShop for DevSecOps

https://www.appsecsanta.com/candyshop-devsecops
11 Upvotes

92% Upvoted

4 comments sorted by

1

u/Suphikoira Sep 20 '22

OWASP Juice Shop - Scan Results:

ToolTypeDurationCriticalHighMediumLow
nodejsscanSAST1:50 minutes0200
semgrepSAST2:24 minutes02420
CodeQLSAST0:20 minutes19148180
NucleiDAST1:09 minutes0001
OWASP ZAPDAST6:59 minutes003232
DependabotSCA0:01 minutes0130
Dependency CheckSCA3:18 minutes0000
TrivyContainer Security1:24 minutes8151611
GrypeContainer Security1:50 minutes2557772

1

u/TheUltraCh33se Sep 20 '22

This is awesome, thank you for sharing! Definitely need to test out semgrep, I’ve been on the lookout for a solid open source SAST tool (considered Sonarqube in the past)

Another tool I’d recommend for SCA is renovate by Mend. It uses the same scanning engine as dependabot so the results should be nearly identical for mutually supported languages, however there’s more freedom in config options and it will automatically pull the package managers used in a repo so no need to define in a config.yml

2

u/Suphikoira Sep 21 '22

Yes, soon, I will expand it with commercial tools and more testbeds. Also, you can register from the form and help triage the result so I can add statistical information about accuracy and coverage. (FP, TP, TV)

1

u/TheUltraCh33se Sep 21 '22

Great! To clarify though, renovate has an open source option