Security Testing
in-toto is the foundational framework for software supply chain security that powers much of modern tooling — including SLSA provenance and Sigstore attestations. Understanding in-toto means understanding the underlying model that these higher-level tools implement. The Problem in-toto Solves The SolarWinds attack succeeded because attackers compromised the
Security Testing
Two SBOM formats dominate the software supply chain landscape: CycloneDX and SPDX.
Security Testing
SLSA (Supply-chain Levels for Software Artifacts, pronounced "salsa") is a security framework from Google that provides a common vocabulary and checklist for supply chain integrity. Rather than describing a single policy, SLSA defines four progressively stricter levels — allowing organizations to incrementally improve their supply chain security posture.
Security Testing
Checkov ships with over 1,000 built-in checks — but every organization has requirements those built-ins don't cover.
Security Testing
tfsec is a static security scanner purpose-built for Terraform. Where Checkov supports many IaC formats, tfsec focuses entirely on Terraform and goes deeper: it resolves variable references, evaluates module calls, and understands Terraform's type system. The result is fewer false positives on complex configurations. Originally built by
Security Testing
Hardcoded credentials in source code are a leading cause of data breaches. AWS keys, database passwords, API tokens — once they hit a git commit, they're in version history forever, even if you delete them in a later commit. Secrets scanning tools and pre-commit hooks catch these before
Security Testing
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) are among the most exploited vulnerabilities in web applications. Both are automatable — you can write tests that run on every PR and catch regressions before they reach production. This guide covers how to build an automated XSS and CSRF test
Security Testing
Static Application Security Testing (SAST) tools scan your source code for vulnerabilities without executing it. Semgrep, SonarQube, and CodeQL are the three most widely used — each with different strengths, pricing models, and CI integration stories. This guide compares them head-to-head so you can pick the right one for
Security Testing
DevSecOps integrates security testing into every stage of the CI/CD pipeline instead of running it as a separate gate at the end. The principle is "shift left"—move security checks earlier in the development process where they're cheaper to fix. A complete DevSecOps pipeline runs
Security Testing
Checkov is an open-source static analysis tool for Infrastructure as Code (IaC). It scans Terraform, Kubernetes, CloudFormation, Helm, Dockerfiles, and more for security misconfigurations and compliance violations. With 1000+ built-in checks and the ability to write custom checks in Python or YAML, Checkov catches misconfigurations before they'
Security Testing
Trivy is an open-source vulnerability scanner that covers container images (OS packages and application dependencies), Kubernetes manifests, Terraform, Dockerfiles, and secrets. It's fast, requires no setup beyond installation, and produces structured JSON or table output. Use Trivy in CI to block builds with critical vulnerabilities before they
Security Testing
Semgrep is a fast, language-agnostic static analysis tool that finds security vulnerabilities by pattern matching against source code. It ships with thousands of community rules for OWASP Top 10 vulnerabilities, secret detection, and language-specific security patterns. You can also write custom rules in YAML to catch patterns specific