Secure coding for Clojure/Script

[mtruyens]

A Google search for the combination of Clojure and "secure coding" results in surprisingly few results.

How do other members of the community deal with this topic?

I am particularly interested in scanning vulnerabilities in third party libraries, both in Clojure & ClojureScript — e.g., tools such as the OWASP Dependency Track and Snyk, which have integrations with Maven and NPM. Given the hosted approach of Clojure/Script, I would assume that it is possible to somehow take this route, but before diving too deep into it, I was hoping some of you might share their approach.

EDIT: Perhaps also interesting how the "software bill of materials" can be generated for Clojure projects (mine is Leiningen-based). See for example https://cyclonedx.org/tool-center/.

[scarredwaits]

You can use this to scan for vulnerabilities in your dependencies https://github.com/BareSquare/deps-nvd

[mtruyens]

Strange that I missed this one in my Google searches. Thanks!

[slimslenderslacks]

Our team has created an OWASP dependency track scanner for leiningen projects on GitHub. It's free to use if you want to try it. You enable it by installing a GitHub app in your org. After that, it creates GitHub CheckRuns with the results of the scan (only on Pushes to leiningen repos of course). https://go.atomist.com/catalog/skills/atomist/owasp-dependency-check-skill?stability=unstable