An Incomplete List of Practical Security for Mortals

• cats

  4 941 2.7 Java

  CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. CATS automatically generates, runs and reports tests with minimum configuration and no coding effort. Tests are self-healing and do not require maintenance. (by Endava)

  

  focus on negative and boundary testing, not only on happy scenarios; CATS is a good option for API testing

• Zed

  17 10,896 6.6 Java

  The OWASP ZAP core project

  

  consider adding some security testing inside the pipeline

• InfluxDB

  www.influxdata.com

  sponsored

  Access the most powerful time series database as a service. Ingest, store, & analyze all types of time series data in a fully-managed, purpose-built database. Keep data forever with low-cost storage and superior data compression.

  

• Vault

  59 27,777 9.9 Go

  A tool for secrets management, encryption as a service, and privileged access management

  

  do not store secrets (passwords, api keys, ssh keys, private keys, etc) in source files or in version control; use proper Secrets Vault systems

• SonarQube

  16 7,799 9.9 Java

  Continuous Inspection

  

  some good tools for security code analysis: Veracode, Checkmarx, Sonarqube

• SLF4J

  13 2,143 8.8 Java

  Simple Logging Facade for Java

  

  use an abstraction over the actual logging implementation; for example in Java: slf4j with logback as implementation

• Spotbugs

  2 3,066 9.4 Java

  SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

  

  some good tools for general code analysis (Java): Sonarqube, PMD, SpotBugs

• semgrep

  16 8,224 9.9 OCaml

  Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

  

  Automate everything. Automation makes it predictable and consistent. The CI/CD pipeline should be the place where you automate all checks that will assess your (micro)service from a quality perspective. Tools like Semgrep can bring automation with less effort for standards not obviously suited for automation.

• Sonar

  www.sonarsource.com

  sponsored

  Write Clean Java Code. Always.. Sonar helps you commit clean code every time. With over 600 unique rules to find Java bugs, code smells & vulnerabilities, Sonar finds the issues while you focus on the work.

  

• PMD

  3 4,317 9.9 Java

  An extensible multilanguage static code analyzer.

  

  some good tools for general code analysis (Java): Sonarqube, PMD, SpotBugs

• Logback

  5 2,695 9.3 Java

  The reliable, generic, fast and flexible logging framework for Java.

  

  use an abstraction over the actual logging implementation; for example in Java: slf4j with logback as implementation

Suggest a related project