Hey everyone, I'm pretty new to the SAST world, coming from a monitoring/Observability background. I've been trying to get Checkmarx to scan our React SPA properly, but I keep missing some client-side vulnerabilities. The default scan seems to treat it like a simple JS file.
After some trial and error (and a lot of dashboard screenshots for my own tracking 😅), I found a config that works much better for our Create React App setup.
The key was making sure Checkmarx understands the project structure and dependencies. Here’s the `CxScanConfig.xml` snippet that helped:
```xml
./src
*.test.js,*.snap
All
Js_Framework_Support
```
Also, make sure to run `npm install` or `yarn install` before the scan so it can resolve the imports. Without the node_modules, it can't trace the data flow through libraries like React Router or axios.
Has anyone else run into this? Would love to know if there are better practices for Vue.js projects too.