AAngusKit·Oct 19Capability-scoped reports: SAST, deps, images, secrets, licensesOn top of the shared report snapshot, narrow by SAST, dependency CVEs, images, secrets, and licenses—plus external redaction and SARIF limits.6 min read·anguskit.hashnode.dev
RRushabh Shah·Oct 9What is SAST? A developer's guide to static application security testingStatic Application Security Testing (SAST) is the practice of analyzing source code — or bytecode, or compiled binaries — for security vulnerabilities without executing the program. A SAST tool reads6 min read·depwarden.hashnode.dev
UUmair Mirza·Sep 14How to Catch Security Vulnerabilities in Code Before They Reach Your Pull RequestsSecurity reviews are most effective when developers receive feedback while the code is still fresh in their minds. Waiting until a pull request, CI build, or penetration test to find exposed credentia9 min read·freecodecamp.org
RRushabh Shah·Sep 10SAST vs SCA: why your CI pipeline needs bothWhen security teams talk about "scanning" code in CI/CD, they usually mean one of two very different things: scanning the code you wrote (SAST) or scanning the open-source code you imported (SCA). Bot5 min read·depwarden.hashnode.dev
ZZennoxa·Aug 21There are 755 static-analysis tools. Only 42 are open-source security scanners.If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosystem's size suggests. W4 min read·zennoxa.hashnode.dev
MManu Shukla·Jul 31OpenAI Codex Security CLI in CI: the 2026 setup and the gated-engine catchOpenAI Codex Security CLI in CI: the 2026 setup and the gated-engine catch Summary. OpenAI open-sourced the Codex Security CLI and TypeScript SDK on 29 July 2026 under an Apache-2.0 licence, as the pu13 min read·ecorpit.hashnode.dev
Vvimalendukumar·Jul 2The Compliance Gap Your Security Scanner Can't See.Security scans find vulnerabilities, not compliance gaps. Discover why modern engineering teams need both.5 min read·scrutora-blog.hashnode.dev
MMarios Grivas·May 26Reverse Engineering the Gov.gr Wallet: How a Hardcoded API Key Exposed Millions of CitizensDiscover how security by obscurity fails in mobile applications. Explore the gov.gr wallet case and learn best practices for API secrets management.6 min read·defprotocol.hashnode.dev
SSourav Chakraborty·Apr 19From Code to Runtime: Closing the AppSec Gap with WAF + DevSecOpsfrom-code-to-runtime-closing-the-appsec-gap-with-waf-devsecops with SCA,SAST,DAST,WAF6 min read·devsecopssourav.hashnode.dev
MMilan Nikic·Mar 23DiffGuard: LLM-Powered Security Review for Staged Git DiffsOpen-source CLI tool that analyzes staged git diffs using tree-sitter AST context and LLM to find vulnerabilities with CWE classification and fixes.17 min read·securitydepth.hashnode.dev
