community
community copied to clipboard
Replace AppScan Static Code Analysis
I don't find the AppScan Code Analysis tool user friendly. Can this be replaced with another tool.
I see possible options like Veracode https://www.veracode.com/products/binary-static-analysis-sast
I see that we already run Veracode's Dynamic code tool so it seems like we have a license https://github.com/zowe/security-reports/blob/master/Veracode/DetailedReport_Zowe_12_Jun_2022.pdf (Access required)
@timgerstel Tim updated the security team that we do run another Static Code Scan using Polaris and Mark @MarkAckert said that we also run sonarCloud. We need to decide if a formal adoption by squad is needed.
No objections to closing the issue and removing the static code scan analysis.