RSRushabh Shahindepwarden.hashnode.dev·4d ago · 6 min readWhat is SAST? A developer's guide to static application security testingStatic Application Security Testing (SAST) is the practice of analyzing source code — or bytecode, or compiled binaries — for security vulnerabilities without executing the program. A SAST tool reads 00
RSRushabh Shahindepwarden.hashnode.dev·6d ago · 4 min readWhat Log4Shell taught us about open-source supply-chain securityOn 9 December 2021, a security researcher publicly disclosed a critical remote code execution vulnerability in Apache Log4j 2, a Java logging library used by hundreds of millions of systems worldwide.00
RSRushabh Shahindepwarden.hashnode.dev·Oct 3 · 5 min readOpen-source license compliance for developers: MIT, Apache 2.0, GPL and beyondMost developers have read the words "MIT License" at least a hundred times and couldn't explain what they actually permit or require. That's fine until the day someone in Legal asks you to audit the l00
RSRushabh Shahindepwarden.hashnode.dev·Sep 30 · 4 min readOpenSSF Scorecard explained: catching risk in packages that don't have a CVE yetMost dependency scanners only tell you about vulnerabilities that already have an advisory filed against them. That's useful, but it's inherently reactive — it only catches risk after someone has foun00
RSRushabh Shahindepwarden.hashnode.dev·Sep 27 · 8 min readCVSS, EPSS and KEV: how to actually prioritize dependency vulnerabilitiesEvery week a dependency scanner finds dozens of vulnerabilities. Every week most developers ignore them, because there's no time to fix 200 issues and no obvious way to know which 3 actually matter. T01I
