Security SDLC Labs
Open-source tools that connect security scanning to the systems producing artifacts and infrastructure. Currently Sonatype Nexus Repository and HCP Terraform, both scanning with Checkmarx One. Apache-2.0 licensed.
Security scanners and the systems that build and deploy software usually come from different vendors. Where the two meet, a supported integration often does not exist, so the points where artifacts enter a repository or infrastructure gets applied are left uncovered by tooling the organization already runs.
This lab builds and maintains those integrations. The first two connect Sonatype Nexus Repository and HCP Terraform to Checkmarx One, against documented product version ranges.
Both are in production use. Public release is in preparation.
Scans artifacts as they are proxied through Sonatype Nexus Repository, using Checkmarx AST for software composition analysis. It flags vulnerabilities, malicious packages and license violations, and can block non-compliant artifacts before they reach a build.
Ships two parallel distributions covering the OrientDB and H2/PostgreSQL generations of Nexus, so installations partway through that migration keep working.
A Run Task endpoint that intercepts HCP Terraform plans, scans the proposed infrastructure in Checkmarx One, and returns findings to the run. Failures appear in the plan output rather than in a report read later.
Founder & maintainer
Works with organizations on Secure SDLC implementation, from program strategy and executive reporting through to the technical controls that carry it out. The tools published here come out of that work, built to close gaps encountered in production environments.
Employed by Checkmarx. This lab is personal work, built and maintained on personal time. The tools here are not Checkmarx products and are not supported by Checkmarx.
Report a vulnerability privately to security@security-sdlc-labs.org, or through private vulnerability reporting on the relevant repository.
Issues and discussion belong on the repositories at github.com/Security-SDLC-Labs.