This is a companion to an existing epic (T371814) to build the core infrastructure for the Universal Security Dashboard.
The goal of this epic is to select which tools will be most effective for our use case and recommend ways to tune and customize the tools as required.
These tools would then be implemented on the USD infrastructure so that they are able to run against multiple code repos.
Related work: T377769
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T382500 [EPIC] Select and Tune Security Tools for Universal Security Dashboard | |||
| Resolved | Mstyles | T382501 Evaluate osv-scanner against LibUp | |||
| Open | None | T382521 Customize osv-scanner and assess suitable coverage for USD | |||
| Open | None | T382523 Investigate semgrep commercial security rules and recommend configuration for USD | |||
| Open | None | T382525 Investigate suitability of semgrep supply chain (commercial version) for USD | |||
| In Progress | None | T382534 Set up a test environment to evaluate the products | |||
| In Progress | None | T382536 Set up and automate scanning tool evaluation pipeline | |||
| Open | None | T383724 Investigate using SonarCloud for USD |
IMO, T342468 is a very important (and likely challenging) task that will be critical to the success of the Universal Security Dashboard. And would likely fit under this epic.