tool-template.md

[Tool name]

Description

[Brief description of what the tool is, the problems it solves, etc. Limited to 1000 characters]

URL

[URL where more info can be found or the tool downloaded]

Pipeline Position

[AppSec Pipeline position. Can be 1 or more of: Intake, Triage, Test, Deliver]

Tool Type

[One or more of the following: Management, Workflow, DAST, SAST, CI/CD]

License

[The license the tools is under. Can be commercial or a FLOSS license like Apache, GPL, MIT, etc]

API Coverage

[The percent of the overall functionality that is available via an API that allows for automation such as “65%”]

API Type

[One or more of the following: REST, SOAP, Language Library/Module/package/etc such as “REST, Java library”]

API Docs

[URL(s) to API documentation - one per line with an empty line between them]

Scaling Architecture

[One or more of the following SaaS, Horizontal-Scaling, On Prem, Containerized, See Notes]

Run as a Service

[Yes or No with optional modifiers of Commercial SaaS, FLOSS SaaS, Containerized, See Notes]

Pipeline Example

[Provide a link to a documented example or case study]

Client Libraries

[URL(s) to any client libraries for programming languages]

CI/CD Plugins

[URL(s) to existing plugins to CI/CD software such as Jenkings, Bamboo, Travis-CI, …]

Data Sent to the Cloud

[Yes or No - If Yes, what data gets sent to the cloud. Limited to 500 characters]

Notes:

[Any clarifying notes about the tool, its use, or other relevant information. Limited to 3000 characters]

Last Evaluated

[Date in RFC 2822, aka Linux command ‘date -R’ format such as “Thu, 15 Oct 2015 18:41:31 -0500”]