Secure or Insecure Code, That Is the Question
summary
The talk explains continuous code inspection to find and prevent defects and vulnerabilities early using tools like Jenkins and SonarQube. It covers techniques such as static analysis in the IDE, pull-request analysis, and pipeline checks, and also shows how to scan open-source dependencies for known vulnerabilities so both your code and third-party libraries are safer.
AI-written summary · about
chapters (14)
- 0:00Welcome
- 2:14Unsafe code cases
- 6:11Why secure code fails
- 7:58Key books and solutions
- 10:10Code review challenges
- 13:01Continuous code inspection
- 17:36Practical improvement examples
- 21:37Secure code tools
- 27:40Dependency analysis
- 31:22Branch control and quality
- 36:14Pull request analysis
- 38:01Quality thresholds
- 39:06Code quality visibility
- 40:08Summary and tips
related talks
54mSecure Software Development
42mContinuous Security: Integrate security tools into your DevOps Pipeline
40mIs Your Code Secure?: Automatic Security Analysis Tools and Systems
33mSecurity as Code: A DevSecOps Approach
37mSecurity as Code: A DevSecOps Approach
52mSecurity as Code: A DevSecOps Approach
39mContinuous Security at the Next Level
44mAn intro to improving the security of your code with free analysis tools