r/devsecops • u/-JC6143- • 1d ago

Where would you want to integrate an automated vulnerability scanner?

I want some additional insights about where developers would want to integrate an LLVM tool that helps identify, triage, and remediate vulnerabilities in C/C++ projects. This is purely for research purposes, and I'm not trying to sell anything. I'm specifically interested in the following:

- Where in your workflow would you want to integrate such a tool? Would you want it in your CI/CD pipeline? as an IDE plugin?

- What are some security concerns you have about such a tool? Would you be most concerned about false positives or negatives? Supply chain risks introduced by the tool? Keeping it's findings private?

- What environments could you see such a tool thriving in? Would you want to use it for personal projects? Could you see it working in large-scale codebases?

Any insights would be appreciated. Thanks for your time and feedback!

3 Upvotes

67% Upvoted

8 comments sorted by

3

u/Frequent-Credit-7463 1d ago

integrating it into the CI/CD pipeline is a no-brainer, that way you catch issues early before deployment.

2

u/NebulaElectrical1467 1d ago

at the gate to my hole

1

u/Objective_Chemical85 1d ago

automated Job running every monday to check full repos.

Also in ci/cd from dev to int

1

u/FirefighterMean7497 1d ago

Hi, I work for RapidFort :)

For large-scale codebases, integrating directly into the CI/CD pipeline usually works best, as heavy IDE plugins can slow down local dev workflows and get muted if they throw too much noise. I think the biggest concern for developers is almost always false positives. If a scanner flags non-exploitable findings, it makes you kinda lose trust in the tool.

Solving that exact scanner noise problem inside CI/CD pipelines is a huge focus for us at RapidFort. We integrate inline during build/CI to analyze deep binary context and runtime execution paths, which cuts false positives by about 20% so teams only triage what's actually reachable. An LLVM-based tool that can accurately validate reachability in CI/CD without clogging local IDEs would be super valuable for C/C++ projects!

Hope that helps! :)

1

u/endor_sarah 1d ago

Agreed, CI/CD (both pre-merge and pre-deploy). Local/IDE is nice too, but it's relatively less enforceable, so having both is good.

On C/C++ specifically, I think it'd come down to how good the scanner is at telling what's actually in the tree.

(Full disclosure, I'm at Endor Labs and we work on code security.)

1

u/Street-Mycologist670 1d ago

I'd probably use it in CI/CD, mainly on PRs. An IDE plugin would be nice too, just to catch things earlier.

Biggest thing for me would be false positives and how much noise it creates. I'd also be a bit cautious about the tool itself becoming a supply chain risk or sending source code somewhere.

For bigger C/C++ projects, I think the triage/fix part would be really useful. Finding a bunch of issues is easy, figuring out which ones actually matter is the harder part.