Security testing guides — vulnerability scanning, penetration testing basics, and secure SDLC practices.
Testing
Electron apps run web content in a desktop shell with access to Node.js APIs. This combination is powerful — and dangerous. Security vulnerabilities in Electron apps can lead to remote code execution (RCE), making security testing not optional but critical. This guide covers automated security testing for Electron applications: testing
Security Testing
Software supply chain attacks have become one of the most effective attack vectors in modern software. SolarWinds compromised 18,000 organizations through a single tampered build. XZ Utils nearly backdoored OpenSSH in half the Linux servers on the internet. The pattern is consistent: attackers don't attack your software
Security Testing
Container image signing closes a critical gap in software supply chain security: verifying that the image running in production is exactly the image your CI pipeline built — and nothing else. Sigstore and its Cosign tool make this practical, with keyless signing that eliminates the burden of managing long-lived private keys.
Security Testing
A Software Bill of Materials (SBOM) is the foundation of modern supply chain security. Without knowing exactly what components your software contains, you cannot know what vulnerabilities you carry. Syft generates SBOMs; Grype scans them for vulnerabilities. Together they form a practical SBOM testing workflow that fits into any CI
Security Testing
Dependency vulnerability scanning is table stakes for modern CI pipelines. A new critical CVE can drop at any moment, and without automated scanning, your pipeline will happily ship code with known exploitable vulnerabilities. Three tools dominate this space: Grype, Trivy, and OSV-Scanner. Each has different strengths, and the right choice
Security Testing
in-toto is the foundational framework for software supply chain security that powers much of modern tooling — including SLSA provenance and Sigstore attestations. Understanding in-toto means understanding the underlying model that these higher-level tools implement. The Problem in-toto Solves The SolarWinds attack succeeded because attackers compromised the build process. The built
Security Testing
Two SBOM formats dominate the software supply chain landscape: CycloneDX and SPDX. Both are open standards, both serve overlapping purposes, and both are supported by major tools. Choosing between them — or using both — depends on your use case, tooling, and compliance requirements. What Is an SBOM Format? A Software Bill
Security Testing
SLSA (Supply-chain Levels for Software Artifacts, pronounced "salsa") is a security framework from Google that provides a common vocabulary and checklist for supply chain integrity. Rather than describing a single policy, SLSA defines four progressively stricter levels — allowing organizations to incrementally improve their supply chain security posture. Why
Security Testing
Checkov ships with over 1,000 built-in checks — but every organization has requirements those built-ins don't cover. Naming conventions, internal tagging standards, specific CIDR allowlists, cross-resource validation — these need custom policies. Checkov supports two custom policy formats: Python classes for complex logic, and YAML for declarative attribute checks.
Testing
Unit tests verify that your Pulumi code produces the resources you intend. Policy-as-code verifies that those resources comply with organizational standards — encryption enabled, tags present, no public S3 buckets, required IAM conditions. Pulumi CrossGuard handles the second concern. CrossGuard policies run on every pulumi up and pulumi preview. They can
Security Testing
tfsec is a static security scanner purpose-built for Terraform. Where Checkov supports many IaC formats, tfsec focuses entirely on Terraform and goes deeper: it resolves variable references, evaluates module calls, and understands Terraform's type system. The result is fewer false positives on complex configurations. Originally built by Aqua
AI Testing
AI applications are only as safe as their guardrails. Prompt injection, jailbreak attempts, and content filter bypass are real attack vectors against production LLM applications. Testing your guardrails — systematically and automatically — is as important as testing your authentication or input validation. This guide covers how to build a guardrail test