Scanning for package vulnerabilities using WhiteSource Bolt
WhiteSource Bolt can be used to scan packages for vulnerabilities directly from the build pipeline. It is a developer tool for scanning for security vulnerabilities in application code, as well as open source applications and packages. It offers extensions that can be installed through the Azure DevOps marketplace and through GitHub. WhiteSource Bolt can be downloaded free of charge, but this version is limited to five scans per day, per repository.
Important Note
For more information about WhiteSource Bolt, you can refer to the following website: https://bolt.whitesourcesoftware.com/.
In this section, we are going to install the extension in our Azure DevOps project and implement the tasks that come with it into our existing build pipeline. Let's get started:
- Open a browser and navigate to https://marketplace.visualstudio.com/.
- Search for WhiteSource Bolt in the search box and select the WhiteSource...
