--- title: "Rushabh Shah (@rushabh5000) | Hashnode" description: "Rushabh Shah (@rushabh5000) writes on Hashnode. Read their latest articles and follow their work." url: "https://hashnode.com/@rushabh5000" --- @rushabh5000 # Rushabh Shah @rushabh5000 · Mumbai, India · Joined June 2026 ### [A free, anonymous Snyk alternative for dependency scanning](https://depwarden.hashnode.dev/free-anonymous-snyk-alternative-dependency-vulnerability-scanning?utm_source=hashnode&utm_medium=feed) If you've shopped for Software Composition Analysis (SCA), you've hit the same wall: the good tools (Snyk, Black Duck, Mend, JFrog Xray) want an account, gate the useful parts behind a paywall, and up 2 min read · [depwarden.hashnode.dev](https://depwarden.hashnode.dev/free-anonymous-snyk-alternative-dependency-vulnerability-scanning?utm_source=hashnode&utm_medium=feed) [Oct 13](https://hashnode.com/posts/free-anonymous-snyk-alternative-dependency-vulnerability-scanning/6ace55254e6a9f3325742ea7) ### [What is SAST? A developer's guide to static application security testing](https://depwarden.hashnode.dev/what-is-sast-static-application-security-testing?utm_source=hashnode&utm_medium=feed) Static Application Security Testing (SAST) is the practice of analyzing source code — or bytecode, or compiled binaries — for security vulnerabilities without executing the program. A SAST tool reads 6 min read · [depwarden.hashnode.dev](https://depwarden.hashnode.dev/what-is-sast-static-application-security-testing?utm_source=hashnode&utm_medium=feed) [Oct 9](https://hashnode.com/posts/what-is-sast-static-application-security-testing/6ac8ac6c0fa664f9ffc08ee1) ### [What Log4Shell taught us about open-source supply-chain security](https://depwarden.hashnode.dev/log4shell-cve-2021-44228-supply-chain-security-lessons?utm_source=hashnode&utm_medium=feed) On 9 December 2021, a security researcher publicly disclosed a critical remote code execution vulnerability in Apache Log4j 2, a Java logging library used by hundreds of millions of systems worldwide. 4 min read · [depwarden.hashnode.dev](https://depwarden.hashnode.dev/log4shell-cve-2021-44228-supply-chain-security-lessons?utm_source=hashnode&utm_medium=feed) [Oct 7](https://hashnode.com/posts/log4shell-cve-2021-44228-supply-chain-security-lessons/6ac5cda2d82f2775defc020c) ### [Open-source license compliance for developers: MIT, Apache 2.0, GPL and beyond](https://depwarden.hashnode.dev/open-source-license-compliance-mit-apache-gpl-guide?utm_source=hashnode&utm_medium=feed) Most developers have read the words "MIT License" at least a hundred times and couldn't explain what they actually permit or require. That's fine until the day someone in Legal asks you to audit the l 5 min read · [depwarden.hashnode.dev](https://depwarden.hashnode.dev/open-source-license-compliance-mit-apache-gpl-guide?utm_source=hashnode&utm_medium=feed) [Oct 3](https://hashnode.com/posts/open-source-license-compliance-mit-apache-gpl-guide/6ac0ddd2835816033d2d5d13) ### [OpenSSF Scorecard explained: catching risk in packages that don't have a CVE yet](https://depwarden.hashnode.dev/openssf-scorecard-explained-supply-chain-security-risk?utm_source=hashnode&utm_medium=feed) Most dependency scanners only tell you about vulnerabilities that already have an advisory filed against them. That's useful, but it's inherently reactive — it only catches risk after someone has foun 4 min read · [depwarden.hashnode.dev](https://depwarden.hashnode.dev/openssf-scorecard-explained-supply-chain-security-risk?utm_source=hashnode&utm_medium=feed) [Sep 30](https://hashnode.com/posts/openssf-scorecard-explained-supply-chain-security-risk/6abd3e5e6a575d5abb4ef848)