Static application security testing (SAST) analyses source or compiled code for security flaws without running it. It usually runs in the developer's editor or the CI pipeline.
Code review is the practice of having other engineers examine a change before it is merged. Reviewers check correctness, design, security and readability, and share knowledge along the way.
DevSecOps is the practice of building security checks into everyday software delivery. Code, dependencies and infrastructure are tested automatically on every change instead of being reviewed only before release.
Dynamic application security testing (DAST) probes a running application from the outside with crafted requests. It watches how the application responds for signs of security weaknesses an attacker could use.
The OWASP Top 10 is an awareness document from the OWASP Foundation listing the most critical categories of web application security risk. It is revised periodically using community data.
A clear proven process, that delivers
You've seen our ideas - now go deeper.
Discover more insights, guides, and engineering practice.