Thread by @JohannesMalsam

🎉 Day of Learning @RedHat

I'm going to explore scanning @stackrox code with Sonarcloud.

Very curious about the findings.

#programming #opensource

@RedHat @stackrox Had to fork the repos. I need to be owner of the github organization to allow Sonarcloud scanning.

Scanning in progress for:
- The Managed Service
- The Core Stackrox Product

Looks decent for the managed service repo:
github.com/johannes94/acs…

The scan for the core product is concerning:
github.com/stackrox/stack…

But at first sight it looks like there are a lot of false positives in the Security Review Section

Apparently there is no bulk review feature for Security Hotspots in Sonarcloud.

Need to close ~300 "Make sure using this hardcoded IP address is safe here." in *_test.go files. One by one 🤯

+1 for this feature request rb.gy/c73tb

Apparently there is no bulk review Security Hotspots feature in Sonarcloud.

Need to close 300 "Make sure using this hardcoded IP address is safe here." one by one 🤯

+1 to this feature request community.sonarsource.com/t/bulk-change-…

Security Review is in much better shape after cleaning up the warnings about hardcoded IP addresses in test files.

Next I looked into bugs, we've got quiet a lot in the fronted code. I'm not experienced enough in TS/JS to make sense of them. Maybe also false positives? Forwarded it to our UI team.

I guess I found at least 1 thing where I can tell for sure that this is a bug 😂: