PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Ultimate SAST Guide: What Is Static Application Security Testing?

aikido.dev | blog | #secure-coding | #sast | #static-analysis | #sdlc | #guide
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

SAST guide: static analysis scans source code for insecure patterns—unsanitized input in SQL queries, improper crypto, unsafe auth flows—catching issues while code is written, before they reach CI.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · borghq.io
SAST and Business Logic Vulnerabilities: What Static Analysis Can Reach
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · ethiack.com
Identifying Vulnerabilities in SaaS: The Guide Updated for 2023
2023-updated guide to SaaS vulnerability identification: why SaaS is a prime target, and how EASM, SAST, DAST, IAST, SCA and pentesting fit together — plus AI's effect on attack and defense.
blog · netspi.com
Please Stop Giving Me Your Passwords
A code review found 30 hardcoded database passwords across 20 accounts; the article shows how flaws like XXE turn leaked source into direct DB access and outlines safer secret distribution options.
blog · netspi.com
The Way Back Machine – Microsoft Word for Windows 1.1a
After Microsoft open-sourced Word for Windows 1.1a, a CheckMarx scan of the 1980s C++ codebase surfaced strcpy-style unsafe functions and 123 gotos—showing how far secure coding has come.
blog · netspi.com
Code Review – is automated testing enough?
Automated scanners like Fortify and Checkmarx satisfy PCI DSS 6.3.2 but miss flaws found in manual review, especially authentication bugs, and false positives often overwhelm developers.
Back