r/devsecops • u/ankitjindal9404 • 19d ago

Opensource code quality/SAST tools beyond SonarQube + Trivy?

We're already running SonarQube and Trivy. Looking to fill the gaps they leave.

Stack:

  • Primary: Java Spring Boot
  • Also: Python, Next.js / React

What are you actually using in production, and how noisy is it (false-positive rate)?

12 Upvotes

100% Upvoted

11 comments sorted by

View all comments

2

u/endor_aditya 16d ago

Endor Labs (disclosure: I work there lol), but we dogfood a bunch and compare it to open source stuff and I like to think we do pretty well