Security testing guides — vulnerability scanning, penetration testing basics, and secure SDLC practices.
Security Testing
Hardcoded credentials in source code are a leading cause of data breaches. AWS keys, database passwords, API tokens — once they hit a git commit, they're in version history forever, even if you delete them in a later commit. Secrets scanning tools and pre-commit hooks catch these before they&
Security Testing
SQL injection remains one of the most impactful web vulnerabilities — it appears in the OWASP Top 10 every year and leads directly to data breaches. Testing for it involves probing how your application handles malicious SQL in user-controlled inputs. This guide covers manual detection, sqlmap automation, and parameterized query validation
Security Testing
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) are among the most exploited vulnerabilities in web applications. Both are automatable — you can write tests that run on every PR and catch regressions before they reach production. This guide covers how to build an automated XSS and CSRF test suite that
Security Testing
Authentication is the most critical security boundary in any web application. Broken authentication is consistently in the OWASP Top 10 because the implementation surface is enormous — JWTs, OAuth2 flows, session tokens, password reset flows, MFA. Each component can fail independently. This guide covers how to test each layer systematically. Key
Security Testing
Dynamic Application Security Testing (DAST) probes your running application for vulnerabilities — sending real HTTP requests and observing how the server responds. OWASP ZAP and Burp Suite are the two most widely used tools. This guide covers what each finds, how to automate scans in CI, and how to interpret the
Security Testing
Static Application Security Testing (SAST) tools scan your source code for vulnerabilities without executing it. Semgrep, SonarQube, and CodeQL are the three most widely used — each with different strengths, pricing models, and CI integration stories. This guide compares them head-to-head so you can pick the right one for your team.
API Testing
RESTler is a stateful REST API fuzzer from Microsoft Research. Unlike simple fuzzers that hit each endpoint independently, RESTler infers the relationships between API calls — it knows that you must create a user before you can update it, and that updating requires the ID returned by creation. This stateful awareness
API Testing
API fuzzing finds the bugs that escape manual testing and code review: server crashes from unexpected inputs, schema violations from edge cases, and authorization gaps revealed by unusual request sequences. But fuzzing without a clear strategy wastes time and generates noise. This guide covers the practices that make API fuzzing
Security Testing
DevSecOps integrates security testing into every stage of the CI/CD pipeline instead of running it as a separate gate at the end. The principle is "shift left"—move security checks earlier in the development process where they're cheaper to fix. A complete DevSecOps pipeline runs
Security Testing
Checkov is an open-source static analysis tool for Infrastructure as Code (IaC). It scans Terraform, Kubernetes, CloudFormation, Helm, Dockerfiles, and more for security misconfigurations and compliance violations. With 1000+ built-in checks and the ability to write custom checks in Python or YAML, Checkov catches misconfigurations before they're deployed
Security Testing
Trivy is an open-source vulnerability scanner that covers container images (OS packages and application dependencies), Kubernetes manifests, Terraform, Dockerfiles, and secrets. It's fast, requires no setup beyond installation, and produces structured JSON or table output. Use Trivy in CI to block builds with critical vulnerabilities before they reach
Security Testing
Semgrep is a fast, language-agnostic static analysis tool that finds security vulnerabilities by pattern matching against source code. It ships with thousands of community rules for OWASP Top 10 vulnerabilities, secret detection, and language-specific security patterns. You can also write custom rules in YAML to catch patterns specific to your