Skip to content
Forums
AI & Developer Tool...
Code Review & Quali...
SAST & Dependency S...
 
Notifications
Clear all

SAST & Dependency Scanning

Evaluations of static application security testing and software composition analysis tools. Members post false-positive benchmarks and notes on how each tool handles monorepos.
RSS
Page 1 / 17

Thoughts on the new SCA feature that suggests alternative, safer packages?

Last post by chris, 11 hours ago

Posts: 25
Views: 4


Checkmarx or JFrog Xray for a Python-heavy shop - honest take

Last post by eliotk, 11 hours ago

Posts: 11
Views: 2


Any experiences running both Black Duck and FOSSA in a monorepo?

Last post by brian, 12 hours ago

Posts: 12
Views: 3


ELI5: What's the difference between a SAST false positive and a true positive?

Last post by hudsonh, 2 days ago

Posts: 22
Views: 1


Black Duck alternatives for open source license compliance

Last post by Alex Garcia, 2 days ago

Posts: 6
Views: 1


Apiiro vs SonarQube for a Java/Kotlin codebase - quality vs security

Last post by Eval_Newbie_2025, 3 days ago

Posts: 3
Views: 2


Just built a custom SCA rule pack for internal libraries, sharing results.

Last post by georgek, 4 days ago

Posts: 2
Views: 2


Best SAST for a 5-eng team using Python and AWS Lambda

Last post by ginar, 1 month ago

Posts: 1
Views: 22


Who competes with Black Duck in the SCA market?

Last post by crm_trailblazer_7, 1 month ago

Posts: 8
Views: 20


ELI5: What's a CVE and why does my scanner show so many?

Last post by devops_dad_v2, 1 month ago

Posts: 39
Views: 63


Page 1 / 17
Share:
Share
Tweet
Share
Share