InMeetCyberbyJost Faganel·Oct 31Semgrep and SonarQube found zero of 232 access-control bugsBoth scored 0% on the vulnerability class attackers chain most. If a rule-based scanner is your main control, your backlog records what it…
Idov3r·Oct 4Your SAST tool isn’t dumb. It just has trust issues.Every developer has had this moment: the scanner flags a line, you look at it, and you think “that’s obviously fine.”
Amar Kumar·Sep 14AndroidScan: I Built a Local Static Analysis Tool for Android AppsCan we check an Android app for common security, bug, and code-quality issues without uploading the code anywhere?
Brett Crawley·Aug 20src2sink: The ground truth your LLM SAST is missingOpen-sourcing a deterministic cross-repo, cross-service taint metabase: sources to sinks across your whole estate, as context for AI SAST
Sandeepkomal·Aug 19DAST, SAST and SCA: A Practical Guide to Application Security Testing.Modern applications are built using source code, open-source libraries, APIs, containers, and cloud infrastructure. Every layer can…A response icon1A response icon1
Brett Crawley·Aug 3Catasto: Your Tools See Repositories. Attackers See an Estate.Introducing estate-graph analysis and Catasto: open-source tooling for vulnerability classes that only exist beyond repository boundaries
Prianshu Bhaskar·Jul 24The Bug That Passed SAST, DAST, and a Pen Test — and What Only Threat Modeling Could Have AskedPart of my Application Security Fundamentals series.
Prianshu Bhaskar·Jul 13Understanding How SAST Works Behind the ScenesA bug caught in your IDE might cost you a few minutes to fix. The same bug discovered in production could lead to an incident, an unhappy…
