Quarterly update for 2025-Q1

[mtesauro]

It’s that time again - your latest update on all things DefectDojo

What’s been happening?

We hit the ground running in 2025. Here's a quick recap which may be missing some items (my apologies).

Community Contributor Rewards Program
During the DefectDojo Office Hours for March, we announced the new Community Contributor Rewards Program. In case you missed the office hours video call, you can watch the recording on our Youtube Channel. For those that haven’t heard the details:

• DefectDojo wanted to go beyond a 👍 or “Thanks” for our contributors so we created the rewards program.
• If you’ve contributed to DefectDojo, you’re eligible to get rewarded.
• There are various levels of reward based on contributions - get the details here.

The other thing I covered in the March Office Hours was what DefectDojo Pro means for the community. Here’s a brief summary of what I said:

• Instead of this being a ‘nights and weekends’ project, we now have full-time engineers working making open source DefectDojo even more awesome
• Because there’s a DefectDojo Inc., we now have people to
  • answer community questions on our Slack channel
  • respond to Github discussions
  • triage and help with Github issues
• We’ve hired a contractor to start work on updating the UI of DefectDojo - they start next week!

Other notable changes to DefectDojo since our last update:

• Excel and CSV exports now include tags
• Multiple updates to the Jira integration - PR search here
• Several community contributed UI accessibility updates here & here 🎉
• Automatically keeping sample data current and updates to built-in regulations
• Many updates to our Ruff linter rules to increase code quality throughout DefectDojo
• Mark Async imports as deprecated in code and docs in preparation for removal
• Loads of software updates from dependabot & renovate

What’s being planned?

Here’s a brief overview of some items that are either being worked on or are planned for the near future:

• Continue to update, upgrade and generally improve our documentation
• While @paulOsinski has been doing much of this, we love documentation PRs
• All the content for the docs site is in this repo in the docs directory
• We’re also adding videos about DefectDojo to our Youtube Channel regularly
• Nightly images - we’re looking at adding nightly images based on the dev branch
• We’re also working on providing hardened images - look for early access versions coming soon.

There’s also an effort to make DefectDojo easier to use and run. Beyond the updates to the UI, we’re looking at clearing up some existing functionality that’s making DefectDojo confusing or frustrating to the community:

• Finding templates - these were originally created to make manually entering findings easier (like when you’re pen testing). They gained a dual use tied to CWE matching over time. A feature should have one clear use, not two. We’ll be cleaning this up.
• Copy engagement works for some, but not all, use cases. It’s also been used where reimport or dedup at the engagement level is a much better workflow. We’re looking at the best way forward here as well.
• API integrations continue to be problematic since it’s not possible to replicate issues unless a contributor happens to have a license for that scanner. Even then, the back and forth to figure out the issue can be extensive. This isn’t a great experience for the community user or contributors. We’re looking at only supporting things we can write tests for - look for more updates on this as we work on the best solution.

That’s all I have as a wrap up for the first quarter of 2025. Keep your eyes open for more good things to come as our top-notch community continues to increase DefectDojo’s awesomeness!

As always, you can see all my past updates here.

Cheers!