Match the mistake to the input. A key in a commit is a secrets scanner job, an old library is SCA, a stale base image is container scanning, an unsafe query is SAST, a risky Terraform setting is IaC scanning, and a console hotfix is CSPM. Here are six short scenarios, with what catches each and what would miss it.
The six scenarios
1. A developer commits a cloud access key
Catches it: secrets scanning, ideally push protection before it lands, or history scanning after. Misses it: SCA and container scanning, unless the key is baked into an image. Next step: rotate the key, as GitHub advises, then check access logs.
2. The app uses a library version with a known flaw
Catches it: SCA, from the lockfile. Also catches it: container scanning, if the library is in the built image. Misses it: SAST, which does not read third party code in the way SCA does.
3. The base image has a vulnerable system package
Catches it: container scanning. Trivy's documentation describes scanning OS packages managed by dpkg, yum and apk. Misses it: SCA, since no manifest of yours lists that package.
4. A handler builds a database query from user input
Catches it: SAST, which OWASP says can detect well known flaws such as SQL injection. Might miss it: the same tool, if data flow is complex or the build is incomplete. Add testing for confidence.
5. A Terraform change makes a storage bucket public
Catches it: IaC scanning in the pull request, before apply. Also catches it: CSPM, after the resource exists. Misses it: SAST and SCA entirely.
6. An engineer opens a firewall rule in the console during an incident
Catches it: CSPM, as drift in the live account. Misses it: IaC scanning, because the change never passed through code. The fix belongs in code, so the next apply does not undo it or leave a gap.
What the scenarios teach
Every mistake has one tool that catches it cleanly and several that cannot. If you only run one or two classes, you can list your blind spots in advance. Take the scenarios above, remove the tools you do not run, and see which mistakes would reach production unnoticed.
Try it on your team
Pick your three most likely mistakes, write the scenario, and confirm in a test branch that the intended tool really fires. Many teams discover that a scanner is installed but not configured to read the right directory.
Where Safeguard fits
For scenario 2, Safeguard's dependency scanning and reachability analysis show whether the vulnerable library's code is actually called. A free scan is available.
Quick check
Which scanner catches a console hotfix?
CSPM, since it reads the live account. IaC scanning only reads code.
Why test that a scanner actually fires?
Misconfigured paths or exclusions can leave a tool installed but blind.
Sources
Last reviewed: 19 October 2026.
