Skip to content

Move Container Scanning in Software Composition Analysis group

Fabio Busatto requested to merge move-container-scanning-in-sca-group into master

Software Composition Analysis is about dealing with external dependencies that are used by the app.

Container Scanning is about dealing with vulnerabilities in Docker images that are used as the base system to build the app environment. So, it is a sort of "system dependency", but not so far away from library dependency.

We can consider to keep it as a separate category, but group it under the Software Composition Analysis group.

This will bring the structure of the Secure stage to have three groups, that can map 1:1 to the three teams approved in the FY2020 plan.

  1. SAST
    1. SAST
    2. Secret Detection
  2. DAST
    1. DAST
    2. IAST
    3. Fuzzing
  3. Software Composition Analysis
    1. Dependency Scanning
    2. Container Scanning
    3. License Management
Edited by Fabio Busatto

Merge request reports