AppSec

How a Jenkins Scanner Catches Vulnerabilities in Your Pipeline

A Jenkins scanner is any security tool wired into a Jenkins job to inspect code, dependencies, or containers before they ship. Here is how to pick one and run it well.

What a Dependency Scanner Does and Which One to Pick

A dependency scanner reads your lockfiles, resolves the full dependency tree, and matches every package against known vulnerability data. Here is how that works and what separates a good one from a noisy one.

What Is a DAST Assessment? A Practical Security Guide

A DAST assessment tests a running application from the outside to find exploitable flaws. Here is how it works, what it catches, and where it fits alongside SAST and SCA.

Disaster Recovery Testing Methods That Actually Prove You Can Recover

A walk through the disaster recovery testing methods teams rely on, from tabletop walkthroughs to full failover, and how to pick the right one for each system.

jQuery 3.6.0 Vulnerabilities: What Scanners Flag and How to Fix

jQuery v3.6.0 vulnerabilities show up in scan reports constantly, yet the core library has no CVE of its own at that version. Here is what your scanner is actually reacting to and how to clear it.

OWASP Top 10 Vulnerabilities 2023: A Retrospective That Still Applies

There was no new web OWASP Top 10 in 2023 — but the OWASP Top 10 vulnerabilities 2023 story is really about the 2021 web list holding firm and the API Security Top 10 getting a major refresh.

Mar 18, 20258 min read

Web Vulnerability Scanning: How It Works and What It Finds

A practitioner's guide to web vulnerability scanning: what scanners actually test, where they fall short, and how to fit them into a delivery pipeline without drowning in noise.

API Scanner Tools: How They Work and How to Choose One

An API scanner tool probes your endpoints for authentication gaps, injection flaws, and data exposure before attackers do. Here is how the scanning works and what to look for when picking one.

Dependency Vulnerability Scanner: How It Works and What to Use

A dependency vulnerability scanner reads your lockfiles, maps every direct and transitive package to known CVEs, and tells you what to upgrade first. Here is how the good ones work.

Java Security Scanner: How It Works and What to Use

A Java security scanner combines static analysis of your own code with dependency scanning of your Maven and Gradle tree. Here is how each layer works and how to wire them into a build.

Mar 18, 20255 min read

SAST Testing Tools: How to Choose and Use Them Effectively

A practitioner's guide to SAST testing tools: what static analysis actually catches, where it falls short, and how to wire it into a pipeline without drowning developers in noise.