PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How HackerOne Reinvented Security for Developers

hackerone.com | blog | #ai-security | #devsecops | #code-review | #sast | #application-security | #hackerone | #developer-tools | #human-in-the-loop | #code-security | #sca | #pull-request
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's Code Security pairs SAST, SCA, IaC and secrets scanning with an AI Context Engine, surfacing human-validated findings in pull requests while Hai Hotspots probes architectural risks.
Published
Collected

Related coverage

blog · projectdiscovery.io
Continuous PR Security Review
Post-mortem vulnerabilities often look harmless in the diff—they only surface at runtime. ProjectDiscovery says LLM code review hits just 63% precision, so PRs need validation on a running app.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · about.gitlab.com
Unblock agentic software delivery with governed code review
Client-side review helps the author move faster. Repo-side review on Duo Agent Platform certifies every merge request against rules you set once, at a flat $0.25 rate per review.
blog · about.gitlab.com
When to use SAST versus an LLM security scanner
AI-based review and SAST catch different classes of bugs and both have benefits. Here's how to decide which one runs where, and when your team needs both.
blog · hacktron.ai
Could Modern Code Review Have Prevented wp2shell?
We recreated the WordPress pull requests behind CVE-2026-63030 and CVE-2026-60137 to test whether today's code reviewers and SAST tools would catch both vulnerabilities.
blog · netspi.com
Getting Started on Your Application Security Journey
Four myths hold back application security programs, from 'AppSec teams are optional' to 'DevOps shops do not need one'; successful journeys start with a central governing team and defect discovery.
Back