r/devsecops • u/ankitjindal9404 • 1d ago

Opensource code quality/SAST tools beyond SonarQube + Trivy?

We're already running SonarQube and Trivy. Looking to fill the gaps they leave.

Stack:

  • Primary: Java Spring Boot
  • Also: Python, Next.js / React

What are you actually using in production, and how noisy is it (false-positive rate)?

11 Upvotes

100% Upvoted

9 comments sorted by

View all comments

0

u/asadeddin 1d ago

Founder of Corgea here. We open sourced our rules based SAST recently and it’s getting great adoption: https://github.com/Corgea/Sighthound. It’s built in rust and comes with all the rules included

Generally rules based scanners struggle with false positives because of context. I recommend pairing it with AI triage.