Skip to content

Commit bc24d30

Browse files
committed
docs(readme): reorder sections
1 parent 48f27b2 commit bc24d30

File tree

1 file changed

+25
-17
lines changed

1 file changed

+25
-17
lines changed

README.md

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,29 @@ A framework for code security that provides abstractions for static analysis too
2626
<img src="docs/assets/overview.svg" alt="CodeSecTools Overview" style="width: 75%; height: auto;" />
2727
</div>
2828

29+
## Features
30+
31+
- **Standardized SAST Tool Integration**: Provides a common abstraction layer for integrating various SAST tools. Once a tool is integrated, it automatically benefits from the framework’s core functionalities.
32+
- **Unified Dataset Integration**: Uses a similar abstraction for handling datasets, allowing for consistent benchmarking of SAST tools across different sets of codebases, whether they are collections of individual files or entire Git repositories.
33+
- **Project Analysis and Benchmarking**: Users can analyze their own projects or benchmark SAST tools against curated datasets to evaluate their effectiveness, including metrics like true positives, false positives, and false negatives.
34+
- **Concurrent Analysis for Cross-Verification**: CodeSecTools can run multiple SAST tools simultaneously on the same project. This allows for the aggregation and cross-verification of results, increasing confidence in the identified vulnerabilities by highlighting findings reported by multiple tools.
35+
- **Automated Reporting and Visualization**: The framework can generate detailed reports in HTML format and create graphs to visualize analysis results, helping to identify trends such as the most common CWEs or the files with the highest number of defects.
36+
2937
> [!WARNING]
3038
> This project provides wrappers and scripts to integrate with various third-party static analysis security testing (SAST) tools and datasets. It is important to note that this project **does not include** these third-party tools or datasets, unless otherwise specified. When a tool or dataset is included, its associated license file is also provided.
3139
>
3240
> Users of this project are solely responsible for reviewing, understanding, and complying with the licenses and terms of use associated with any third-party tools or datasets they choose to use through this framework. The respective licenses and terms can be found on the official websites or in the documentation of each tool or dataset.
3341
42+
## SAST Tool Integration Status
43+
44+
|SAST Tool|Languages|Maintained|Continuous Testing|Last Test Date|
45+
|:---:|:---:|:---:|:---:|:---:|
46+
|Coverity|Java|⚠️<br>(Deprioritized)|❌<br>(Proprietary)|October 2025|
47+
|Semgrep Community Edition|C/C++, Java|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
48+
|Snyk Code|C/C++, Java||❌<br>(Rate limited)|November 2025|
49+
|Bearer|Java|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
50+
|SpotBugs|Java|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
51+
|Cppcheck|C/C++|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
3452

3553
## Installation
3654

@@ -57,24 +75,14 @@ cd CodeSecTools
5775
pip install .
5876
```
5977

60-
## Features
61-
62-
- **Standardized SAST Tool Integration**: Provides a common abstraction layer for integrating various SAST tools. Once a tool is integrated, it automatically benefits from the framework’s core functionalities.
63-
- **Unified Dataset Integration**: Uses a similar abstraction for handling datasets, allowing for consistent benchmarking of SAST tools across different sets of codebases, whether they are collections of individual files or entire Git repositories.
64-
- **Project Analysis and Benchmarking**: Users can analyze their own projects or benchmark SAST tools against curated datasets to evaluate their effectiveness, including metrics like true positives, false positives, and false negatives.
65-
- **Concurrent Analysis for Cross-Verification**: CodeSecTools can run multiple SAST tools simultaneously on the same project. This allows for the aggregation and cross-verification of results, increasing confidence in the identified vulnerabilities by highlighting findings reported by multiple tools.
66-
- **Automated Reporting and Visualization**: The framework can generate detailed reports in HTML format and create graphs to visualize analysis results, helping to identify trends such as the most common CWEs or the files with the highest number of defects.
67-
68-
### SAST Tool Integration Status
78+
- Update the project:
79+
80+
- Pull the latest changes:
81+
```bash
82+
git pull
83+
```
6984

70-
|SAST Tool|Languages|Maintained|Continuous Testing|Last Test Date|
71-
|:---:|:---:|:---:|:---:|:---:|
72-
|Coverity|Java|<br>(Proprietary)|<br>(Proprietary)|October 2025|
73-
|Semgrep Community Edition|C/C++, Java|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
74-
|Snyk Code|C/C++, Java||<br>(Rate limited)|November 2025|
75-
|Bearer|Java|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
76-
|SpotBugs|Java|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
77-
|Cppcheck|C/C++|||[Latest PR](https://github.com/OPPIDA/CodeSecTools/actions/workflows/ci.yaml)|
85+
- Reinstall (in case dependencies changed)
7886

7987
## Usage
8088

0 commit comments

Comments
 (0)