Problem Statement

• The AI Innovation team will be responsible for remediating CVEs introduced in their sdg_hub repository such that Red Hat AI 3.0 products which ultimately consume some form of sdg_hub do not contain those CVEs. However, the AI Innovation Team needs the ability to proactively detect CVEs so that CVEs are detected as early on as possible in the release lifecycle to give themselves ample time handle those CVEs

Goals

• Identify specific SAST tools/integrations that we want to leverage in sdg_hub

• • Note #1: Since sdg_hub is a Python-based library, we need to ensure that Python packages consumed by sdg_hub are scanned for CVEs by at least one SAST tool/integration.
  • Note #2: Consider the ways in which these tools can notify the sdg_hub maintainers. (Ideally, we do not want this information publicly disclosed.)
• Work with AI Innovation team to understand their needs around SAST /vulnerability detection

Acceptance Criteria

• At least one SAST tool/integration is identified

Out of Scope

• Installing or integrating these tools is out of scope for this card. This work will be completed in another Jira card.