Replacing Checkmarx with Open Source — Designing an AppSec Stack from SAST, SCA, IaC, and Secrets

No single open-source tool replaces Checkmarx one to one. The realistic answer is a loosely coupled multi-engine setup: place a dedicated OSS scanner in each functional category and bind them with a management layer like DefectDojo. This article walks through the Semgrep CE versus Opengrep split in SAST, Trivy-centered SCA, Checkov and KICS for IaC, Gitleaks and TruffleHog for secrets, and DefectDojo's deduplication and Jira sync, as of 2026, along with the limits such as legacy languages and supply-chain risk.

Comparing Open-Source DAST Tools — Binding ZAP, Nuclei, Wapiti, and Nikto into a DevSecOps Pipeline

DAST (dynamic application security testing) hits a running app from the outside with simulated attacks to surface runtime-specific vulnerabilities that SAST and SCA miss. Open-source DAST has moved from 'one tool does everything' to 'divide the work among lightweight tools.' Centered on the all-around ZAP, template-driven Nuclei, lightweight-CLI Wapiti, and server-exposure-focused Nikto, this article adds the SQLi specialist sqlmap and the XSS specialist Dalfox, plus the free-but-not-OSS Dastardly and StackHawk, and lays out 2026 selection criteria alongside SPA/API coverage, phased CI/CD integration, and false-positive tuning.

Is Gemini CLI Still Open Source — Reading the Apache 2.0 Code and the Backend Terms as Two Layers, and the Adoption Risk After the Antigravity CLI Transition

Google announced the transition from Gemini CLI to the closed-source Antigravity CLI and cut off free, individual access on 2026-06-18. Yet the Gemini CLI code itself stays Apache 2.0 and the repository keeps shipping releases. Whether to adopt it becomes clear once you read it as two layers: the code license and the backend service terms. This article lays out what happened, the irrevocability of Apache 2.0, the mutability of the service terms, the governance reality, the technical incompatibilities of migration, and the alternatives and defenses, as of 2026.

gh-security-scan: An AI Coding Assistant Skill for Cross-Organization Supply Chain Attack Investigation

Supply chain attacks like the axios npm account takeover are becoming more frequent. Investigating their impact across an entire organization is time-consuming manual work. We built gh-security-scan, an AI coding assistant skill that automates cross-organization security investigation. It supports Claude Code, Codex, and Gemini CLI.