SAST is just crazy bad at XSS
XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ...
nahsra.hashnode.dev4 min read
Ryan Dens
Developer productivity and application security
It's crazy to me how much noise appsec/prod sec engineers have to sift through to get actionable, validated insights on their code.
"Example 1 of 10 Million" really got me 🤣