5 Open Source Security Tools All Developers Should Know About
summary
Five concrete tools that shift security left: gitLeaks for secret scanning (demo finds an AWS access key in a Dockerfile), OWASP Dependency-Check for package CVEs, KICS for infrastructure-as-code checks (finds DynamoDB not encrypted and S3 logging disabled), and Trivy for containers (demo reports four high/critical image vulns). A GitHub Actions workflow runs each tool in parallel, produces varied outputs and duplicates, and needs orchestration—so a plan-as-code orchestrator comments on PRs, runs locally/CI, and preserves repo privacy.
AI-written summary · about
chapters (11)
- 0:00Start
- 5:22Why Do You Need To Secure
- 7:01Usability
- 9:13Tools for Secret Detection
- 11:01Dependency Check
- 14:04Three Infrastructure Misconfiguration
- 14:40Tfsec
- 16:51Container Scanning
- 18:21Runtime Scanning
- 20:09Demo
- 23:14Secret Scanner
related talks
20m5 Open Source Cloud Native Security Tools
46m5 Open Source Security Tools All Developers Should Know About
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
39mSecurity Tooling in Your DevOps Pipeline
42mContinuous Security: Integrate security tools into your DevOps Pipeline
44mAn intro to improving the security of your code with free analysis tools
24mHow to Find Secure Software in Open Source Repositories
32mHow to fit Sec into DevOps without Security team