I'm doing a CASA Tier 2 security self-assessment for an app as required by Google, since the app requests permission from users to access sensitive data from their Google account via OAuth. I'm using the Fluid Attacks standalone scanning tool (gitlab:fluidattacks/universe@trunk) to run a SAST scan on a node.js app which incorporates approximately 16,000 npm packages.
The scan has been running for nearly a week on an AWS t2.medium ec2 instance, and it has still not completed. The log output showed that it analyzed the packages fairly quickly and started the file scanning. Periodically it reports that a file is too big to scan and is being skipped. So I think it hasn't hung, although it's been a day or two since I saw one of those messages. It's running in a docker container, and I don't see any Results file yet on the file system inside the container. I started another scan on a separate ec2 instance a day later than the first one, with only 7,000 npm dependencies, and it's showing the same sort of log output and has not completed.
Can anyone validate whether this is within the normal range of expectations? The documentation said the scan could take a while, but I wasn't expecting a week. I'm wondering how long I should let it run before I decide it's just not working.
