Roadmap
What is missing
This is a list of gaps rather than a list of promises. Nothing here has a date on it, because this is written by one person and a date would be a guess. Items are removed when they are built, not ticked, so what is on the list is what is actually left.
-
Deep static analysis for Java, PHP and Ruby
NextFree semgrep reads one file at a time, so a tainted value that crosses a function boundary into another file is invisible to it. Go and Python already have a second engine that analyzes a whole package. The other three do not, and it is the clearest gap in the product.
-
Blocking a merge, and a secret at push
NextEverything here reports and nothing blocks. GitHub Advanced Security refuses a push carrying a secret and can hold a pull request that adds an alert, and that changes behavior in a way a report never does. The pieces are here, a pre commit hook and a command a required check can hold a merge on, but a person has to wire them up and a developer can skip a hook. What is missing is enforcement this product sets up and owns, without giving up being read only everywhere else.
-
A pipeline that blocks on a regression, not on history
NextA build can be failed on any critical today, which on a repository with a backlog fails every build immediately and gets switched off. It should fail on what this change introduced.
-
The twenty minutes after a live credential is found
LaterA verified credential is the strongest signal the product produces and the response to it is still a person reading an email. What it should be is a runbook per provider, the blast radius already assembled, and the rotation order written down before anybody is panicking.
-
A GitHub App across every organization it is installed on
LaterAn App is the right credential for a large estate, and today the scanner uses one installation at a time. An App installed on twenty six organizations should be twenty six units of work with twenty six rate limit budgets, not one run repeated.
-
Subversion with its history
LaterA Subversion connection scans the current checkout, which covers the code analysis, the dependencies and the licenses. What is missing is the history, which is where most leaked credentials are. It needs a different walk, not the git one.
-
Several of these behind a load balancer
LaterThe database half is already there without anybody planning it: every table is InnoDB with a primary key, which is what a cluster needs. The application half is not, and the scan lock is the reason.
-
Answering the security questionnaire a customer sends
LaterThe product already holds most of the evidence somebody assembles by hand once a quarter: the bill of materials, the VEX statements, the exception register and the audit trail. There is a report engine now, which is the half of this that was missing, so what is left is knowing which questions get asked and writing the answers into it.
-
Dynamic testing against a running application
LaterEverything here reads code at rest. A running application answers different questions. It is real work and it is honestly further away than the rest of this list.
The long version
The full roadmap lives in documentation/roadmap.md in the
repository. It is longer than this, and for each item it works out the
shape the answer should take and which files it touches, so that the
decision is made before somebody starts rather than during.
What is already built is on the comparison page
Forty capabilities scored against five products people pay for, including the ones this loses.