DefectDojo: Managing Findings From Every Security Scanner
DefectDojo solves the problem that appears once you are running more than one security scanner: a pile of overlapping reports in different formats and no way to tell what is new, what is fixed, and what you already decided to accept.
What it does
It imports findings from over a hundred tools, including Trivy, Grype, and Gitleaks, normalises them into a common model, and tracks each finding as an object with a lifecycle.
The important behaviour is deduplication. The same vulnerability found by three scanners, across ten scans over two months, is one finding with a history rather than thirty rows. Without that, scanner output volume makes the whole exercise unmanageable.
Why raw scanner output does not scale
Run a scanner weekly and you get a report weekly. Nothing tells you which findings are new since last week, which were fixed, or which you previously assessed as not applicable.
So the same false positive gets re-triaged every week until people stop reading the reports entirely. That is the actual failure mode of security scanning, and it is a workflow problem rather than a tooling one.
DefectDojo gives each finding a state: active, verified, false positive, risk accepted, mitigated. Decisions persist across scans.
Structure
Findings are organised by product and engagement, which maps onto real work: a product is a thing you maintain, an engagement is an assessment of it over a period.
Metrics follow from that: findings over time, mean time to remediate, what is overdue.
Automation
An API for importing scan results, so a CI pipeline can push findings automatically. This is how it is meant to be used, since manual imports do not survive contact with a busy month.
Is it overkill for a homelab
Usually yes, and that is a fair assessment. For a handful of containers, running Trivy occasionally and acting on what it says is proportionate.
It becomes worthwhile when several people are involved, when you need to demonstrate that findings were triaged rather than ignored, or when the volume has already made spreadsheets untenable.
Running it
Docker Compose with PostgreSQL and Celery workers. It is a Django application and behaves like one.
License
DefectDojo is released under the BSD-3-Clause License.