3 ms·
So I'm guessing they'll be merging what they have now with Semmie's tool? Because they've had the free vulnerability check for a while now.
by Dirlewanger 7y ago
So I'm guessing they'll be merging what they have now with Semmie's tool? Because they've had the free vulnerability check for a while now.
- tptacek 7y agoDifferent things. Github has features that scan repos for "known-vulnerable" dependencies. They do not have features that scan for new vulnerabilities.
- thomasahle 7y agoYes and no. LGTM is about known vulnerabilities. It doesn't (currently) use artificial intelligence to discover new vulnerabilities, but it allows writing complicated yet efficient patterns for vulnerabilities found by human intelligence. So it's more advanced than simple "know bad dependencies", but it's also not quite "new vulnerabilities".