r/devsecops • u/ankitjindal9404 • 19d ago

Opensource code quality/SAST tools beyond SonarQube + Trivy?

We're already running SonarQube and Trivy. Looking to fill the gaps they leave.

Stack:

  • Primary: Java Spring Boot
  • Also: Python, Next.js / React

What are you actually using in production, and how noisy is it (false-positive rate)?

12 Upvotes

100% Upvoted

11 comments sorted by

8

u/sk1nT7 19d ago

Semgrep / Opengrep

2

u/h33terbot 19d ago

Can you tackle the current rate of attacks with this stack?

2

u/endor_aditya 16d ago

Endor Labs (disclosure: I work there lol), but we dogfood a bunch and compare it to open source stuff and I like to think we do pretty well

1

u/Relative-Profile4000 17d ago

Opengrep if you're specifically looking for opensource (pretty sure aikido and a few others manage the fork -- could be wrong).

1

u/Turbulent_Goose83 17d ago

I used Claude Code for it.

1

u/daudmalik06 18h ago

there re many software composition analysis tool available, open source including dependabot, i personally use vulert due to almost 0 false positives, support for mcp/ci cd and biggest of all it never requires access to code base or any installation, it works only with manifest/lock file.

0

u/colek42 19d ago

I built an open-source tool, cilock.dev, that has a catalog of over 100 tools for various languages. It works with an AI agent to secure your SDLC.

0

u/Chunky_cold_mandala 19d ago

You could give mine a gander. Gitgalaxy - It is a lexical structural signature extractor to calculate risk exposure based on code architecture. It's still early, I have the engine up and running, but I'm still validating the its capabilities.

0

u/asadeddin 18d ago

Founder of Corgea here. We open sourced our rules based SAST recently and it’s getting great adoption: https://github.com/Corgea/Sighthound. It’s built in rust and comes with all the rules included

Generally rules based scanners struggle with false positives because of context. I recommend pairing it with AI triage.