What’s next?

For us, not much on this front. In its current state, SecureDevelopment.com is essentially a proof of concept and a project we use internally. We’re really excited about where this space is heading, and we’d love to work on automated testing more, but right now we’re focused on security testing by humans.

We do think that a strong case could be made for the rules and vulnerability repositories that underlie SAST and dependency scanning being public and open source, where they are most functional and accessible to receive contributions from a multitude of people and companies. Many, many more scanners could be added to Salus.

Limitations

As a weekend project and proof of concept, we don’t afford SecureDevelopment.com a significant server budget. If you’re going to be sending a bunch of reports, please give us a heads up!

Ignoring false positives is still a lot of work. We have a few ideas on how to handle this: at the API level or by using a configuration generator for Salus itself, which would enable adding ignore rules for specific scanners.

We provide GitHub a pass/fail result, but don’t otherwise communicate the outcome. The report artifact could be submitted, a PR updated and/or annotated, and a deploy API that has the potential for integration is also available.

'}],fetch:[],error:null,serverRendered:!0,routePath: