Merge branch 'main' into master

2022-09-05 11:09:02 +05:30
parent d14e8af6e3 a0becf432a
commit 44f6e35784
239 changed files with 5906 additions and 471 deletions
@@ -0,0 +1,7 @@
+{
+    "name": "Anchore Syft SBOM Scan",
+    "organization": "Anchore",
+    "description": "Produce Software Bills of Materials based on Anchore's open source Syft tool.",
+    "iconName": "anchore",
+    "categories": ["Code Scanning", "dockerfile", "dependency-management"]
+}
@@ -1,7 +1,7 @@
 {
  "name": "APIsec Scan",
  "creator": "APIsec",
-  "description": "APIsec addresses the critical need to secure APIs before they reach production. APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs. Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities.",
+  "description": "APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs.",
  "iconName": "apisec",
  "categories": [
    "Code Scanning",
@@ -0,0 +1,10 @@
+{
+    "name": "clj-holmes",
+    "creator": "Matheus Bernardes",
+    "description": "A Static Application Security Testing tool to find vulnerable Clojure code via rules that use a simple pattern language.",
+    "iconName": "clj-holmes",
+    "categories": [
+        "Code Scanning",
+        "clojure"
+    ]
+}
@@ -0,0 +1,9 @@
+{
+    "name": "clj-watson",
+    "description": "Scan Clojure/Clojurescript projects for vulnerable direct/transitive dependencies.",
+    "iconName": "clj-watson",
+    "categories": [
+        "Code Scanning",
+        "Clojure"
+    ]
+}
@@ -1,7 +1,7 @@
 {
    "name": "cloudrail",
    "creator": "Indeni Cloudrail",
-    "description": "Cloudrail can be used to scan your infrastructure-as-code files for potential security and compliance issues. The Cloudrail action is often used as part of both CI workflows (on pull_request) and on CD workflows to identify potential issues.",
+    "description": "Cloudrail can be used to scan your infrastructure-as-code files for potential security and compliance issues.",
    "iconName": "cloudrail",
    "categories": ["Code Scanning", "HCL"]
 }
@@ -0,0 +1,7 @@
+{
+    "name": "Contrast Scan",
+    "creator": "Contrast Security Inc",
+    "description": "Scans Pull Requests on each push for the introduction and/or resolution of vulnerabilities to the repository.",
+    "iconName": "contrast",
+    "categories": ["Code Scanning", "java", "javascript", "dotnet"]
+}
@@ -0,0 +1,7 @@
+{
+    "name": "Red Hat CodeReady Dependency Analytics",
+    "creator": "Red Hat",
+    "description": "Scan your project's dependencies with CodeReady Dependency Analytics.",
+    "iconName": "openshift",
+    "categories": ["Code Scanning", "Go", "Python", "Node.js", "Java"]
+}
@@ -0,0 +1,16 @@
+{
+    "name": "Dependency Review",
+    "description": "Scans Pull Requests on each push for the introduction and/or resolution of vulnerable dependencies to the repository",
+    "iconName": "octicon mark-github",
+    "categories": [
+      "Dependency review",
+      "Dependency graph",
+      "Go",
+      "Java",
+      "JavaScript",
+      "TypeScript",
+      "Python",
+      "Ruby",
+      "Actions",
+      "PHP"]
+}   
@@ -3,7 +3,6 @@
    "creator": "Detekt",
    "description": "Static code analysis for Kotlin",
    "iconName": "detekt",
-    "categories": ["Code Scanning", "Kotlin"]
+    "categories": ["Code Scanning", "Kotlin"],
+    "enterprise": false
 }
-
-    
@@ -0,0 +1,11 @@
+{
+    "name": "ESLint",
+    "description": "A tool for identifying and reporting the problems found in ECMAScript/JavaScript code.",
+    "iconName": "eslint",
+    "categories": [
+        "Code Scanning",
+        "JavaScript",
+        "EcmaScript",
+        "TypeScript"
+    ]
+}
@@ -0,0 +1,15 @@
+{
+  "name": "Frogbot Scan and Fix",
+  "description": "Automatically creates pull requests with fixes for vulnerable project dependencies. Uses JFrog Xray to scan the project. Included as part of JFrog's free subscription.",
+  "iconName": "frogbot",
+  "categories": [
+    "Code Scanning",
+    "Go Module",
+    "Maven POM",
+    "NPM Config",
+    "Gradle",
+    "C#",
+    "Python"
+  ],
+  "creator": "JFrog"
+}
@@ -0,0 +1,15 @@
+{
+  "name": "Frogbot Scan Pull Request",
+  "description": "Automatically scans new pull requests for security vulnerabilities. Uses JFrog Xray to scan the project. Included as part of JFrog's free subscription.",
+  "iconName": "frogbot",
+  "categories": [
+    "Code Scanning",
+    "Go Module",
+    "Maven POM",
+    "NPM Config",
+    "Gradle",
+    "C#",
+    "Python"
+  ],
+  "creator": "JFrog"
+}
@@ -0,0 +1,6 @@
+{
+    "name": "Haskell Dockerfile Linter",
+    "description": "A smarter Dockerfile linter that helps you build best practice Docker images.",
+    "iconName": "hadolint",
+    "categories": ["Code Scanning", "Dockerfile"]
+}
@@ -0,0 +1,24 @@
+{
+  "name": "NeuraLegion",
+  "creator": "NeuraLegion",
+  "description": "Scans any target, whether Web Apps, APIs (REST. & SOAP, GraphQL & more), Web sockets or mobile, providing actionable reports",
+  "iconName": "neuralegion",
+  "categories": [
+    "Code Scanning",
+    "C",
+    "C#",
+    "C++",
+    "Go",
+    "Java",
+    "JavaScript",
+    "Kotlin",
+    "Objective C",
+    "PHP",
+    "Python",
+    "Ruby",
+    "Rust",
+    "Scala",
+    "Swift",
+    "TypeScript"
+  ]
+}
@@ -0,0 +1,6 @@
+{
+  "name": "PHPMD",
+  "description": "A spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD.",
+  "iconName": "phpmd",
+  "categories": [ "Code Scanning", "PHP" ]
+}
@@ -0,0 +1,18 @@
+{
+    "name": "pmd",
+    "creator": "pmd",
+    "description": "PMD is a static source code analyzer. It supports Java, JavaScript, Apex and Visualforce, Modelica, PLSQL, Apache Velocity, XML, XSL, Scala.",
+    "iconName": "pmd",
+    "categories": [
+        "Code Scanning", 
+        "Java", 
+        "JavaScript", 
+        "Apex", 
+        "Modelica", 
+        "PLSQL", 
+        "Apache Velocity",
+        "XML",
+        "XSl",
+        "Scala"
+    ]
+}
@@ -0,0 +1,6 @@
+{
+  "name": "puppet-lint",
+  "description": "Puppet Lint tests Puppet code against the recommended Puppet language style guide.",
+  "iconName": "puppet-lint",
+  "categories": [ "Code Scanning", "Puppet" ]
+}
@@ -0,0 +1,7 @@
+{
+    "name": "Pyre",
+    "creator": "Meta",
+    "description": "Pyre is a performant type checker for Python compliant with PEP 484. Pyre can analyze codebases with millions of lines of code incrementally – providing instantaneous feedback to developers as they write code.",
+    "iconName": "pyre",
+    "categories": ["Code Scanning", "Python"]
+}
@@ -0,0 +1,7 @@
+{
+    "name": "Pysa",
+    "creator": "Meta",
+    "description": "Python Static Analyzer (Pysa) is a security-focused static analysis tool that tracks flows of data from where they originate to where they terminate in a dangerous location.",
+    "iconName": "pysa",
+    "categories": ["Code Scanning", "Python"]
+}
@@ -0,0 +1,9 @@
+{
+    "name": "rust-clippy",
+    "description": "A collection of lints to catch common mistakes and improve your Rust code.",
+    "iconName": "rust",
+    "categories": [
+        "Code Scanning",
+        "rust"
+    ]
+}
@@ -0,0 +1,7 @@
+{
+    "name": "OSSF Scorecards",
+    "creator": "Open Source Security Foundation (OpenSSF)",
+    "description": "Scorecards is a static supply-chain security analysis tool to assess the security posture of your project",
+    "iconName": "scorecards",
+    "categories": ["Code Scanning"]
+}
@@ -1,7 +0,0 @@
-{
-    "name": "Scan",
-    "creator": "ShiftLeft",
-    "description": "Scan is a free open-source security tool for modern DevOps teams from ShiftLeft.",
-    "iconName": "shiftleft",
-    "categories": ["Code Scanning"]
-}
@@ -0,0 +1,11 @@
+{
+    "name": "Sobelow",
+    "creator": "nccgroup",
+    "description": "Sobelow is a security-focused static analysis tool for the Phoenix framework.",
+    "iconName": "sobelow",
+    "categories": [
+      "Code Scanning",
+      "Elixir"
+    ]
+  }
+  
@@ -0,0 +1,7 @@
+{
+    "name": "SonarCloud",
+    "creator": "Sonar",
+    "description": "Static analysis of code for vulnerability detection, covering 26+ languages. Start cleaning your code in minutes!",
+    "iconName": "sonarcloud",
+    "categories": ["Code Scanning","abap","apex","c","cobol","cpp","cloudformation","csharp","css","flex","go","java","javascript","kotlin","objectivec","php","plsql","ruby","scala","swift","terraform","tsql","typescript","vb","vba","xml"]              
+}
@@ -0,0 +1,7 @@
+{
+    "name": "SOOS DAST Scan",
+    "creator": "SOOS",
+    "description": "SOOS DAST is the easy-to-integrate no-limit web vulnerability scanner. Integrate SOOS DAST with your CI pipeline to find vulnerabilities by scanning a web app or APIs.",
+    "iconName": "soos",
+    "categories": ["Code Scanning"]
+}
@@ -0,0 +1,7 @@
+{
+    "name": "Veracode Static Analysis",
+    "creator": "Veracode",
+    "description": "Get fast feedback on flaws with Veracode Static Analysis and the pipeline scan. Break the build based on flaw severity and CWE category.",
+    "iconName": "veracode",
+    "categories": ["Code Scanning", "javascript", "python", "java", "php", "c#", "c", "c++", "ruby", "swift", "go", "kotlin", "scala", "groovy", "tsql", "plsql", "perl", "cobol"]
+}