3 ms·
GitLab has had this as part of their autodevops for a while now. My experience with their solution has been: - 'unusual' repo structures throw it off, silentl
by Normal_gaussian 6y ago
GitLab has had this as part of their autodevops for a while now.
My experience with their solution has been:
- 'unusual' repo structures throw it off, silently doing essentially nothing.
- noise is real
- It caught some genuine vulnerabilities
I'm not sure if github also offers the secret detection, license scanning and dependency scanning that gitlab does.
- thinkharderdev 6y agoThe pretty well describes pretty much every static analysis, automated security scanning tool I've ever used. They generally work ok if you use a common framework in a standard configuration using a standard project layout (once tuned properly to filter out false positives). Once you get to that point you can actually pay attention to the alerts and may even catch some significant issues.