tsunami-security-scanner VS docker-gvm

https://github.com/google/tsunami-security-scanner (I bet it would be easy to write a plugin for https://github.com/projectdiscovery/nuclei as well.)

To see if there are injection points statically, I work on a tool (https://github.com/returntocorp/semgrep) that someone else already wrote a check with: https://twitter.com/lapt0r/status/1469096944047779845 or look for the mitigation with `semgrep -e '$LOGGER.formatMsgNoLookups(true)' --lang java`. For the mitigation, the string should be unique enough that just ripgrep works well too.

Thanks to you I just reenabled Tsunami https://github.com/google/tsunami-security-scanner. Also had software called something like vuln (blue logo with a yellow eye in the middle) running. but the hard disk of the server died --sadly and I can't remember how it was called.-- https://vuls.io/

Tsunami - General purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

I've been tinkering with gvm today thanks to https://github.com/isaudits/docker-gvm/ to get running very conveniently. The goal is to scan for vulnerabilities and ideally to do so periodically. I imagine most of us here have a different security challenge than most. We decided not to delegate to someone else our data, for privacy and other reason. We do not usually have particularly valuable information but because we rely on infrastructure that is always connected and often in affordable data centers, we do risk having our resources abused (crypto mining, bittorrent seeding, etc) and maybe riskier threats e.g ransomware. For most I imagine having a backup to restore to the previous working state is sufficient.