Their scanning tools are "source available", but they're definitely not open-source. The license is gonna be a non-starter, but how they built their SAST tool [0] is actually quite interesting.
It just uses existing open-source analysis tools, but orchestrates them all into a single tool by coordinating a bunch of docker images.
Comments
They’ve had SAST tools for a few releases, but high up in the paid license types. With GitHub providing for free, they may need to move them into CE.
Their scanning tools are "source available", but they're definitely not open-source. The license is gonna be a non-starter, but how they built their SAST tool [0] is actually quite interesting.
It just uses existing open-source analysis tools, but orchestrates them all into a single tool by coordinating a bunch of docker images.
[0] https://gitlab.com/gitlab-org/security-products/sast