With a 742% average annual increase in software supply chain attacks reported by Sonatype, application security has become a top concern for businesses. Today Vaadin is excited to announce AppSec Kit, a new Acceleration Kit designed to enhance the security of your web applications built with Vaadin. AppSec Kit is currently available for Vaadin 7 and Vaadin 8 and will be included with Extended Maintenance and with Ultimate subscriptions. We plan to offer AppSec Kit for additional versions of Vaadin later this year.

With AppSec Kit, developers can now easily identify and manage vulnerabilities within their open-source dependencies directly from Vaadin Development Tools. Because AppSec Kit identifies vulnerabilities in the local development environment, even before code is checked in, developers can resolve issues more quickly and with less friction, resulting in saved time and money.

False positives frequently cause frustration for developers, often leading to wasted time and effort in investigating non-existent vulnerabilities. In a recent MergeBase survey, 72% of respondents indicated that false positives damage team productivity.  AppSec Kit tackles this issue head-on by flagging false positives within the Vaadin Framework accompanied by the analysis by the Vaadin security team. This reduces wasted time by enabling your developers to focus solely on issues that arise from your own application’s dependencies.

By facilitating early issue detection and reducing false positives, AppSec Kit enables developers to fix issues more quickly and avoid alert fatigue, strengthening application security and maximizing efficiency.

How AppSec Kit works

AppSec Kit offers seamless security integration into the development of your Vaadin-based applications. It provides:

Comprehensive dependency visibility

Managing dependencies is a crucial aspect of any software project, but it can be a complex and time-consuming task. AppSec Kit provides dependency visibility, generating a Software Bill of Materials (SBOM) that offers a comprehensive view of all the direct and transitive dependencies used in your application. The SBOM is generated automatically each time you do a development build or can be initiated on-demand. This allows you to have complete visibility of the contents of your application.

Earlier remediation of vulnerabilities

AppSec Kit further streamlines the remediation process by regularly scanning the SBOM and cross-referencing it with multiple industry-standard vulnerability databases, including National Vulnerability Database and GitHub Security Advisories. It identifies known vulnerabilities in both direct and transitive dependencies and includes detailed information, including severity and patch versions. Reports on the results are displayed in Vaadin Development tools, ensuring smooth integration into your Vaadin application development process. This enables you to address vulnerabilities earlier in the development process, ensuring the security of your web applications without compromising development speed.

Fewer false positives

By identifying and highlighting any false positives associated with Vaadin Flow and its dependencies, AppSec Kit makes it easier for developers to identify the vulnerabilities that need addressing. AppSec Kit flags any “false positive” vulnerabilities that were identified in the dependencies of the Vaadin platform and shows the analysis from Vaadin’s security team describing why it was considered a false positive. This allows your team to focus on the vulnerabilities that matter and avoid distractions caused by false alarms.

Your developers can also flag false positives for dependencies within your application and add their own analysis. All of these analyses are saved in local fields and can be checked into your source control system for sharing with other developers or your security team.

Complementary to your existing vulnerability scanning tools

Already using a vulnerability scanning tool? AppSec Kit complements existing scanning tools you have in place. It enables developers to identify issues earlier, during builds in the local Vaadin development environment, facilitating prompt fixes.

Furthermore, AppSec Kit allows developers to prioritize their efforts by providing a vetted list of false-positive vulnerabilities in Vaadin’s platform dependencies. In addition, you have the flexibility to incorporate the vetted list of Vaadin false-positives into your current vulnerability scanning tools. This extra capability gives you the option to manage the list according to your own terms.

Strengthen your Vaadin application security with AppSec Kit

Web application security is a critical aspect of modern software development. AppSec Kit allows developers to strengthen the defenses of their web applications by identifying and addressing vulnerabilities in third-party dependencies. By integrating AppSec Kit into your development workflow, you can proactively protect your applications from potential security breaches and protect sensitive user data.

AppSec Kit currently supports Vaadin 7 and Vaadin 8. It will be included for all customers who have purchased Extended Maintenance or an Ultimate subscription. If you fall into this group, access will be added to your subscription in the next month. We plan to offer AppSec Kit for additional versions of Vaadin later this year.

To learn more about how AppSec Kit can benefit your web applications, read our documentation or contact our sales team.