5 Open Source Security Tools All Developers Should Know About
summary
Five open source starters: Semgrep, OSV Scanner, KICS, Trivy and ZAP, each chosen for measurable strengths — Semgrep scans 30+ languages with a median full-project time of ~20 seconds and ~30M scans, OSV aggregates advisories across 13 languages, KICS covers ~18 IaC frameworks, Trivy has ~60M downloads and generates SBOMs, ZAP provides ~250 DAST rules. Rollout advice: start small, don't block builds; scale pain points appear past ~3 repos and require consolidating outputs and triaging backlog vs new findings.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 1:50Five security tool categories
- 3:11Evaluating open source tools
- 10:17Code scanning with Semgrep
- 15:36Dependency scanning with OSV
- 18:30Infrastructure as code scanning
- 22:34Container scanning with Trivy
- 25:04Runtime scanning with ZAP
- 27:59Scaling security programs
- 31:12Challenges of open source tools
- 36:16Key performance indicators
- 43:04Q&A session
related talks
39m5 Open Source Security Tools All Developers Should Know About
20m5 Open Source Cloud Native Security Tools
33mFree SOC? — how open source tools can come to our aid
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default
43mApplication Security is a Community Effort
35mOpen source security: Opportunity or oxymoron?
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
37mBringing Security to Your Open Source Project