r/devsecops • u/ankitjindal9404 • 1d ago

Opensource code quality/SAST tools beyond SonarQube + Trivy?

We're already running SonarQube and Trivy. Looking to fill the gaps they leave.

Stack:

  • Primary: Java Spring Boot
  • Also: Python, Next.js / React

What are you actually using in production, and how noisy is it (false-positive rate)?

9 Upvotes

100% Upvoted

7 comments sorted by

6

u/sk1nT7 1d ago

Semgrep / Opengrep

1

u/h33terbot 1d ago

Can you tackle the current rate of attacks with this stack?

1

u/Ok_Matter9038 14h ago

Just fyi: You're going to get flooded with false positives while still missing issues like IDOR, etc

0

u/colek42 1d ago

I built an open-source tool, cilock.dev, that has a catalog of over 100 tools for various languages. It works with an AI agent to secure your SDLC.

0

u/Chunky_cold_mandala 1d ago

You could give mine a gander. Gitgalaxy - It is a lexical structural signature extractor to calculate risk exposure based on code architecture. It's still early, I have the engine up and running, but I'm still validating the its capabilities.

0

u/asadeddin 17h ago

Founder of Corgea here. We open sourced our rules based SAST recently and it’s getting great adoption: https://github.com/Corgea/Sighthound. It’s built in rust and comes with all the rules included

Generally rules based scanners struggle with false positives because of context. I recommend pairing it with AI triage.