Probably:
Previous efforts:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| In Progress | None | T371814 [EPIC] Universal Security Dashboard | |||
| Resolved | mmartorana | T377769 Research and determine initial security tools |
@acooper - For now, we have selected osv-scanner and Semgrep as the initial tools, as they address the majority of our needs across many languages for SCA and SAST in the first phase or MVP.
We will revisit this later to explore integrating additional tools and use cases.
For now, I’m marking this as resolved.
To be clear, I'd like to be able to use Semgrep's common-clause-licensed rule sets for this. Since this won't be running in a production capacity in wmcs, I don't think that should be an issue, but we never really received clarity from WMF Legal on the matter (T304737).
This assumption would also (likely) obviate the need for an additional secret-scanning tool since semgrep offers this policy.