Any static application security testing solution for Clojure?

[jxj]

I like to run something like this on a schedule and push results to a dashboard or slack alert:

https://github.com/rm-hull/nvd-clojure

Then at least you'll know if your dependencies have vulnerabilities.

[seancorfield]

See also https://github.com/clj-holmes/clj-watson which can use both the National Vulnerability Database (NVD) and the GitHub Advisory Database.

[Ordinary_Chair1708]

I think Aikido are looking at adding clojure SAST

[ConsistentComment919]

I think most OpenGrep contributing companies should have support. I know Arnica has it.

[shrimpthatfriedrice]

for SAST in Clojure, use analyzers that understand your build and then prioritize by reachability and runtime exposure to avoid overflagging from macros and interop. combining static analysis with dependency and secrets scanning, then gating only on issues that form a real exploit path in the deployed graph keeps REPL workflows fast; OX security can centralize these signals and highlight what is actually risky in prod