devsecops.md

DevSecOps

trivy

Tool to check vulnerabilities in docker images, git repo, filesystems, etc.

• https://trivy.dev/

Scan a docker image:

trivy image alpine:latest

Scan a git repository:

trivy repo /opt/my_application/
# or using the trivy docker image:
docker run -v /opt/my_application/:/scan aquasec/trivy repo /scan

DepFuzzer

Tool from Synactiv to check for dependency confusion vulnerabilities in code repositories.

• https://github.com/synacktiv/DepFuzzer

Usage for a python project:

git clone https://github.com/synacktiv/DepFuzzer
cd DepFuzzer
docker build -t depfuzzer:latest .
docker run --rm -it -v /opt/my_application/:/host depfuzzer --provider pypi --path /host