When it comes to security tools, you're typically balancing two things: how much time it takes for a tool to run to get deeper results vs. the quality of results returned.
As you might expect, faster tools scan just the source code in a single repo (without looking in the open-source libraries and SDK used) and may detect easy-to-find vulnerabilities. In contrast, tools that give better results and can find more challenging vulnerabilities with fewer false positives require more time to complete their scans.
Source : https://dzone.com/articles/battle-between-linters-scanners-data-flow-analysis
No comments:
Post a Comment