starter.wiki

Security

Vulnerability Scanning

Choose vulnerability-detection routes across dependencies, source, containers, and infrastructure as code with explicit triage and remediation ownership.

Recommendation

Route scanning by artifact, then centralize triage rather than pretending one scanner covers everything.

Use a developer security platform for broad consolidation, Dependabot for GitHub-native dependency alerts and updates, Semgrep for code and policy analysis, and Trivy for open-source artifact scanning.12

For: Application, platform, DevSecOps, and security teams adding vulnerability detection to repositories, builds, artifacts, and delivery workflows

Main trade-off

Automated scanning expands detection coverage while adding repository and artifact access, advisory or rule dependence, false positives, duplicate findings, compute cost, developer interruption, policy tuning, triage backlog, remediation, and disclosure obligations.1234

Choose the control and ownership model

Start from the threat, protected asset, evidence obligation, or enforcement point before comparing products.

  1. Artifact surface

    Inventory manifests, lockfiles, source languages, generated code, containers, base images, OS packages, registries, repositories, and IaC formats.4

  2. Detection boundary

    Verify advisory databases, reachability, source semantics, rule packs, data handling, image layers, misconfiguration checks, secrets, update cadence, and blind spots.14

  3. Trust and access

    Review repository permissions, source upload, local scanning, telemetry, private registries, artifacts, data retention, regions, plugins, and supply-chain integrity.12

  4. Triage and remediation

    Define ownership, severity, exploitability, deduplication, false positives, baselines, exceptions, SLAs, fixes, verification, disclosure, metrics, and backlog limits.12

Decision routes

Each route addresses a bounded security job and retains an explicit verification and failure boundary.

A team wants several developer-security surfaces in one platform

Evaluate Snyk.

Snyk is the developer-security platform route when dependency, source, container, and infrastructure-as-code products should share integrations, policy, findings, and reporting.

Verify: Verify exact language and artifact coverage, scanners, advisory sources, fix behavior, repository access, false positives, policy, modules, usage, pricing, data, and exit.1

GitHub-native dependency alerts and update pull requests are the immediate need

Use Dependabot within its scope.

Dependabot is the GitHub-native dependency route when supported manifests, dependency graph, alerts, security updates, and version-update pull requests fit the repository workflow.

Verify: It does not replace SAST, container, IaC, runtime, or manual review; verify ecosystem support, private registries, grouping, compatibility, noise, merge safety, and repository policy.2

Security-focused source and policy analysis is the primary route

Evaluate Semgrep.

Semgrep is the code-and-policy route when supported language analysis, managed or custom rules, secrets or supply-chain modules, and developer workflow fit.

Verify: Keep non-security linting separate and verify language semantics, framework coverage, rule provenance, data handling, false positives, CI access, policy, modules, and commercial boundaries.3

Open-source scanning of images, filesystems, repositories, or IaC fits

Evaluate Trivy.

Trivy is the open-source artifact route when teams want one CLI and scanner for supported vulnerabilities, misconfigurations, secrets, licenses, images, filesystems, repositories, or infrastructure definitions.

Verify: The team owns databases, updates, cache, scanner configuration, suppressions, policy, CI integration, artifact coverage, false positives, triage, remediation, and operations.4

Boundary: Linters & Static Analysis owns non-security code quality, CI/CD executes pipeline stages, a WAF mitigates selected request exposure, and penetration testing or a secure-development program is broader than scanning.

Differences that change the control

Compare enforcement, evidence, operating ownership, failure behavior, sensitive-data exposure, and exit rather than marketing breadth.

Surface
Dependencies, source code, container artifacts, filesystems, repositories, and IaC definitions require different analysis.4
Detection basis
Advisories, dependency graphs, source rules, semantic or data-flow analysis, package databases, and misconfiguration policies have different blind spots.13
Workflow
Alerts, pull requests, IDE feedback, CI checks, artifact gates, dashboards, suppressions, policies, and exports shift developer and security work differently.2
Proof boundary
A passing scan reflects configured coverage at a point in time; it does not prove secure design, runtime safety, complete code coverage, or remediation.12

Official resources

Verify current control boundaries, telemetry or evidence handling, deployment, limits, pricing, policy, and operating responsibilities in first-party material.

DocumentationSnyk documentation
DocumentationTrivy documentation

Sources

Official documentation supports product boundaries and verification points; the route recommendation remains a bounded editorial judgment.

  1. 1
    Snyk documentation

    Snyk · Accessed Official

  2. 2
    GitHub Dependabot documentation

    GitHub · Accessed Official

  3. 3
    Semgrep documentation

    Semgrep · Accessed Official

  4. 4
    Trivy documentation

    Aqua Security · Accessed Official

  5. 5
    NIST Secure Software Development Framework

    NIST · Accessed Official

  6. 6
    NIST Application Container Security Guide

    NIST · Accessed Official