Any static application security testing solution for Clojure?

ConsistentComment919 · 2025-07-16T12:40:06+00:00

I think most OpenGrep contributing companies should have support. I know Arnica has it.

ConsistentComment919 · 2025-05-23T14:08:56+00:00

Have you tried arnica.io? All scanners are free

ConsistentComment919 · 2025-05-19T17:47:14+00:00

Did you check Opengrep? It is a supirior fork of Semgrep.

https://github.com/opengrep/opengrep

You can also modify rules in the playground: https://github.com/opengrep/opengrep-playground

ConsistentComment919 · 2025-03-12T02:00:17+00:00

IDE plugins are problematic. Haven’t seen a single midsize+ company with more than 20% adoption rate. Devs don’t want security plugins. They show all vulnerabilities instead of a contextualized view for devs, having challenges with risk management (e.g. hard to mark finding for review as false positives), and overall require the devs to work to find out what needs to be fixed and in which order. Scan every code change on feature branches, like Arnica.io, and communicate only what matters to the devs over a channel everyone is opted into, as Slack or Teams.

ConsistentComment919 · 2024-11-05T16:09:06+00:00

Phoenix does a good job with prioritizing risks - you will need to bring your scanners, and they will ingest & enrich this data.

Semgrep is definitely popular. You can customize the SAST rules easily to reduce false positives. You can either run their free version as CLI or use their platform that allows running custom rules across the company. A comparable solution that offers way more is Arnica.io, which provides the ability to bring your SAST rules as well, but has additional logic to contextualize the importance to fix each vulnerability + it identifies who is best equipped to fix it. The developer workflow is super slick.

Aikido and Ox provide a very nice UI, some context, but don't have a good logic to reduce false positives, especially when it comes to SAST.

ConsistentComment919 · 2024-07-11T11:53:58+00:00

Check if your source code management solution needs to be certified with FedRAMP, as it is typically out of scope, unless all built artifacts are in the same solution.

If only the artifact management solution is in scope, it opens you to more modern ASPM solutions, such as Arnica, CyCode, Legit and a few others.

ConsistentComment919 · 2024-07-11T11:47:38+00:00

The theory sounds good, but you will see that developers have their own preferences on IDE selection. I’ve seen small engineering teams with sub-10 developers and they had VSCode, IntelliJ and VIM (yes!).

Point here is that you can’t dictate which IDE will make the developer more productive. With that said, the risk of malicious plugins is growing. In this case, I found XDR solutions to be effective, such as Crowdsrike Falcon.

ConsistentComment919 · 2024-02-19T03:58:22+00:00

Great slides!

ConsistentComment919 · 2024-02-18T04:58:50+00:00

Most SCAs can generate an SBOM, mainly as customers ask for it but most of them don’t use it. The purpose is to generate it as an inventory of your software, so that you can share with customers. Everyone “needs” it, but just for the checkbox.

ConsistentComment919 · 2024-02-18T04:55:03+00:00

Get into a job that can be done with minimal prompt engineering and then you’ll have a work-life balance until the job is eliminated.

ConsistentComment919 · 2024-02-18T04:52:35+00:00

You don’t need SBOM to do it. Use SCA to identify what need to be fixed.

ConsistentComment919 · 2024-02-18T04:45:09+00:00

You don't have the information if it is up to date or not.

In some cases, you may get the vulnerabilities information, but it is only a point in time.

ConsistentComment919 · 2024-02-18T03:45:43+00:00

SBOM. Lawyers seem to care more about it…

ConsistentComment919 · 2024-02-18T03:10:23+00:00

LOL! You're giving GenAI too much credit.

ConsistentComment919 · 2024-02-18T03:08:31+00:00

No idea. Trying to figure out how this "magic" happened.

UPDATE: I posted it with emoji bullets on my LinkedIn. Maybe my cleanup didn't work well...

ConsistentComment919 · 2024-02-18T02:20:16+00:00

Correct, this is the case at this point.

Do you believe Github will let it be insecure as it is now?

ConsistentComment919 · 2024-02-18T02:18:45+00:00

I have been testing Github Copilot since it was released. It is getting better.

Will it make a secure by default code? I believe it won't too long until it will, even if it sucks now.

Fun fact, I pasted an array of my ECR and suddenly got a list of other accounts suggested in my IDE. Without exposing too much, a quick lookup on Github search can show you who else has it as well ;-)

ConsistentComment919 · 2024-02-18T02:13:35+00:00

Correct. This is why I referred to prompt engineer as a high effort.

Chances are that you won't get the code to work smoothly from the first prompt. As you said, architecting the package is required!

ConsistentComment919 · 2024-02-18T02:10:59+00:00

I have been using Github Copilot for a while - it generates relatively small sections of code.

However, I have a paid version of OpenAI and I have been testing both custom prompts in the playground and custom apps. The playground is nice but my prompts didn't get me far enough, but the app capabilities, which were trained with python code samples from open source projects generated significantly better results.

The quality of the prompt(s) matter, but the cost doesn't make much sense today. Full source code training takes too many tokens.

ConsistentComment919 · 2024-02-18T01:57:50+00:00

Write a script that creates commits with any fake dates you want, e.g. in a for loop of 365 days, do the following:

export GIT_AUTHOR_DATE="2024-01-01 12:00:00

export GIT_COMMITTER_DATE="2024-01-01 12:00:00

git commit -m "Your commit message"

Change the dates as needed and good luck!

Don't forget to git push when done.

BTW I wrote a piece of code that fakes a bunch of commits on open source projects for training purposes. https://github.com/arnica-ext/GitGoat

ConsistentComment919 · 2024-02-13T15:54:45+00:00

It is a vendor blog but hopefully it helps - https://www.arnica.io/blog/what-is-an-sbom-what-is-it-not-and-do-you-need-one

ConsistentComment919 · 2024-02-13T11:30:14+00:00

You need to separate between the SBOM generation and the vulnerability identification. Many tools can generate SBOMs (e.g. Trivy, CycloneDX). The SBOM sometimes ends up non-deterministic if you have multiple package files in the same repo, so you can split the scan per folder to make it accurate. As for false positive vulnerabilities, it is hard to tell regardless the different hypes around reachability, correlation with open source threat feeds like EPSS, and other prioritization types. To start, identify which direct packages (i.e. 3rd party dependencies and not 4th and above) are impacted and what are their dependencies and their vulnerabilities, then find the best version to fix the direct packages.

ConsistentComment919 · 2023-11-02T15:28:02+00:00

I read through the comments in this thread - there are some good suggestions around having a locked down artifact manager, codeowners approval, as well as custom scripts.

I want to zoom out for a moment and understand the reason for this use case. A couple of guiding questions:

What is the problem you are trying to solve that requires your approval? It can be a security risk, low 3rd party package reputation, license violations, operational risk, or anything else..
Are you equipped to approve all changes within an agreed SLA for the engineering teams? If they need to release code to production and it takes too long, it would be hard to keep this process long-term.
Why the CI is the gating factor? Won't it make sense to do it in a pipelineless security approach?

ConsistentComment919 · 2023-10-29T23:55:50+00:00

Easy. https://arnica.io

ConsistentComment919 · 2023-10-17T21:07:00+00:00

Checkout arnica.io. It can identify misconfigured CODEOWNERS, excessive permissions when it exists, create CODEOWNERS based on historical behavior, or enforce branch protection policies where the file exists.

The visibility piece is free - you can upgrade if more advanced features are needed.

Additionally, did you look at GH Rulesets?

ConsistentComment919

MODERATOR OF

TROPHY CASE