Blog
Clear articles on application security topics: what each type of analysis does, what it finds and where it stops.
New seriesSifted · SCA
The code we write is only the tip of the iceberg. Russian-doll dependencies, recent attacks (xz, chalk, OpenAI) and what an SCA tool does, in plain language.
What is really inside the building blocks your application reuses.
In the same series : SCA: from inventory to priority
In the same series : Choosing an SCA tool without being fooled
The code we write is only the tip of the iceberg. Russian-doll dependencies, recent attacks (xz, chalk, OpenAI) and what an SCA tool does, in plain language.
Five levels of analysis on one fictional application, then under the hood: rebuilding the tree, CPE versus purl, comparing versions, reachability, EPSS, VEX and the Cyber Resilience Act.
Compare SCA tools on your artifacts: a trial protocol, hidden dependencies, false positives, reachability, exports and real operating costs.
The over-obedient barista, twenty-five years of SQL injection, and how SAST tracks data to dangerous operations. With a game to take over the counter.
A lab with five configurations, then the engine: AST, SSA, taint sensitivities, Rice's theorem, what tools detect and what they miss.
Compare SAST engines on your code: a repeatable trial, precision and recall, five decisive tests, integration and the real cost of adoption.
No article matches these filters.
Upcoming series: Secrets, IaC, Cloud, DAST, Pentest, Correlation, Architecture.
Follow the blog with the RSS feed.