Skip to content
Forums
AI & Developer Tool...
Code Review & Quali...
SAST & Dependency S...
 
Notifications
Clear all

SAST & Dependency Scanning

Evaluations of static application security testing and software composition analysis tools. Members post false-positive benchmarks and notes on how each tool handles monorepos.
RSS
Page 1 / 17

Thoughts on the new SCA feature that suggests alternative, safer packages?

Last post by chris, 2 months ago

Posts: 25
Views: 215


Checkmarx or JFrog Xray for a Python-heavy shop - honest take

Last post by eliotk, 2 months ago

Posts: 11
Views: 86


Any experiences running both Black Duck and FOSSA in a monorepo?

Last post by brian, 2 months ago

Posts: 12
Views: 68


ELI5: What's the difference between a SAST false positive and a true positive?

Last post by hudsonh, 2 months ago

Posts: 22
Views: 215


Black Duck alternatives for open source license compliance

Last post by Alex Garcia, 2 months ago

Posts: 6
Views: 57


Apiiro vs SonarQube for a Java/Kotlin codebase - quality vs security

Last post by Eval_Newbie_2025, 2 months ago

Posts: 3
Views: 56


Just built a custom SCA rule pack for internal libraries, sharing results.

Last post by georgek, 2 months ago

Posts: 2
Views: 54


Best SAST for a 5-eng team using Python and AWS Lambda

Last post by ginar, 3 months ago

Posts: 1
Views: 66


Who competes with Black Duck in the SCA market?

Last post by crm_trailblazer_7, 3 months ago

Posts: 8
Views: 65


ELI5: What's a CVE and why does my scanner show so many?

Last post by devops_dad_v2, 3 months ago

Posts: 39
Views: 297


Page 1 / 17
Share:
Share
Tweet
Share
Share