0

As part of our development, we also want to test vulnerabilities for our Scrum teams in addition to load testing our websites. This should be planned in accordance with the sprint planning, found errors are prioritized accordingly.

We have looked at various tools, but have some idea what the tool should:

  • Different scan methods during internal test (distinction between development and rolled-out projects)
  • A fullscan on appropriately published projects
  • Note in case of false flags
  • Integration into a CI process
  • Detailed reporting system
  • Open source would be optimal

Does anyone of you have any tools in use?

Improve this question
2
  • 1
    Have you tried bdd security
    – PDHide ♦
    Jun 20, 2019 at 14:33
  • No, I did not know that before. But I find this very interesting, thank you very much for this information
    – Mornon
    Jun 29, 2019 at 12:06

1 Answer 1

Reset to default
1

SonarQube also checks for security vulnerabilities (check beforehand if your application language is supported), see https://www.sonarqube.org/features/security/ .

  • You can define different rule-sets to scan a project
  • Users can mark issues as false-positives to discard them from future checks
  • It can be easily integrated into your CI tool
  • It has pre-defined reports such as OWASP / SANS security reports
  • It is open-source
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.