0

As part of our development, we also want to test vulnerabilities for our Scrum teams in addition to load testing our websites. This should be planned in accordance with the sprint planning, found errors are prioritized accordingly.

We have looked at various tools, but have some idea what the tool should:

  • Different scan methods during internal test (distinction between development and rolled-out projects)
  • A fullscan on appropriately published projects
  • Note in case of false flags
  • Integration into a CI process
  • Detailed reporting system
  • Open source would be optimal

Does anyone of you have any tools in use?

  • 1
    Have you tried bdd security – PDHide Jun 20 '19 at 14:33
  • No, I did not know that before. But I find this very interesting, thank you very much for this information – Mornon Jun 29 '19 at 12:06
1

SonarQube also checks for security vulnerabilities (check beforehand if your application language is supported), see https://www.sonarqube.org/features/security/ .

  • You can define different rule-sets to scan a project
  • Users can mark issues as false-positives to discard them from future checks
  • It can be easily integrated into your CI tool
  • It has pre-defined reports such as OWASP / SANS security reports
  • It is open-source
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.