PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Visma’s Ioana Piroska on Securing the Development Lifecycle Through Bug Bounties

hackerone.com | blog | #bug-bounty | #sast | #customer-story | #dast | #sdlc | #visma
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Visma security analyst Ioana Piroska explains how the Northern European software provider layers bug bounties on its Application Security Program, complementing SAST, DAST, and internal pentesting.
Published
Collected

Related coverage

blog · borghq.io
What Is Code-Aware Application Security Testing?
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · bugbunny.ai
SAST and DAST: How to Combine Static and Dynamic Testing
SAST analyzes code before it runs; DAST tests a deployed app by sending requests. Neither sees authorization or business logic, so pair both with manual validation and unified triage.
blog · ethiack.com
Identifying Vulnerabilities in SaaS: The Guide Updated for 2023
2023-updated guide to SaaS vulnerability identification: why SaaS is a prime target, and how EASM, SAST, DAST, IAST, SCA and pentesting fit together — plus AI's effect on attack and defense.
blog · netspi.com
Five Signs Your Application Security Assessment Process Needs a Reboot
NetSPI lists five signs of an overly manual application security assessment process, from email scoping to copy-paste reporting, arguing automation can cut administrative overhead by 40-60%.
research · xbow.com
Tales from the Trace: How Agentic AI Merges Static and Dynamic Testing
The first Tales from the Trace shows XBOW combining source-code analysis with dynamic testing (via DVWA), guiding attacks with static knowledge and confirming them at runtime.
tool · projectdiscovery.io
Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught
Part 2 of the vibe coding benchmark dissects three AI-built apps (healthcare, banking, insurance), detailing what Neo caught, what Claude Code got wrong, and what both missed on AI-generated code.
Back