DerSecur Knowledge
Engineering knowledge about software security, AI-native systems, and the controls used to establish digital trust.
Practical, evidence-linked explanations for engineers, security teams, technical leaders, and AI search systems.Recommended path
Start here
Claude Code Security
An independent scan of 630 lines Claude Opus wrote reported 31 security findings, 6 of them critical. What Claude Code Security covers, where agent review structurally stops, and what a second opinion adds.
Read articleWhat Is SAST?
What Static Application Security Testing is, how SAST examines source code without executing it, what evidence it produces, and where its coverage ends.
Read articleSAST vs SCA
The difference between SAST and SCA, including the code each technique examines, the risks each can identify, and why software teams commonly need both.
Read articleCombining SAST and DAST
SAST vs DAST explained — how static and dynamic application security testing differ, what each technique detects, and why organizations use both.
Read articleApplication Security Assurance
Application security assurance as a comprehensive approach to software security that combines multiple analysis techniques, independent verification, supply-chain security, and continuous monitoring to provide confidence in the security posture of software.
Read articleHow to Evaluate SAST Tools
A step-by-step methodology for evaluating SAST tools — from defining requirements and selecting representative codebases, through testing, scoring, and procurement decision — including team roles, timelines, and decision gates.
Read articleDerSecur-defined models
New frameworks
SAST Triage Tax
SAST Triage Tax is a DerSecur-defined operational metric for estimating the recurring human workload required to validate, prioritize, disposition, route, and re-check static-analysis findings.
Read articleSAST, DAST, and SCA Coverage Matrix
A coverage matrix for comparing SAST, DAST, and SCA by analyzed artifact, required system state, evidence produced, lifecycle placement, and blind spots.
Read articleRemediation Confidence Ladder
The Remediation Confidence Ladder is a DerSecur engineering framework that separates a generated fix from reviewed, tested, re-scanned, and release-accepted remediation evidence.
Read articleThe SBOM-to-Action Gap
The SBOM-to-Action Gap is the difference between possessing a component inventory and having sufficient vulnerability, reachability, context, and policy evidence to make a remediation decision.
Read articleDependency Drift in AI-Generated Code
AI dependency drift is the change in direct, transitive, runtime, version, provenance, license, and vulnerability characteristics of a project as AI-assisted revisions add, replace, or remove packages.
Read articleCurated for your goal
Browse collections
Engineering guidance
Explore knowledge
AI-generated code
31 articlesClaude Code Security
An independent scan of 630 lines Claude Opus wrote reported 31 security findings, 6 of them critical. What Claude Code Security covers, where agent review structurally stops, and what a second opinion adds.
Read articleAI Code Fix for Security Vulnerabilities
How AI systems generate code changes for security vulnerabilities, what generated fixes represent, and how they fit into the remediation workflow, with review and verification under human control.
Read articleAI Triage Before AI Code Fix
Why validating and prioritizing security findings through AI-assisted triage should precede AI-assisted code remediation, to avoid wasting developer effort on findings that should not be remediated.
Read articleAI-Assisted Vulnerability Triage
How AI systems evaluate, validate, and prioritize security findings produced by automated analysis tools, and how this fits into the broader vulnerability triage workflow.
Read articleAI-Generated Code Vulnerability Triage
How security findings from AI-generated code should be validated, prioritized, and dispositioned at development velocity.
Read articleAppSec Human Work After AI Automation
How AI-assisted triage and remediation changes the AppSec engineer's role — from repetitive finding validation to other security work such as architectural risk, threat modeling, security policy, and verification.
Read articleAppSec Remediation Backlog
Why application-security vulnerability backlogs grow — due to finding volume, validation effort, prioritization complexity, developer handoff, remediation effort, verification, and limited security capacity — and how AI-assisted triage and remediation may help reduce the backlog growth rate.
Read articleAutomated SAST Triage
How automated triage can reduce repetitive validation work after SAST produces findings, and how AI-assisted evaluation fits into the SAST findings workflow.
Read articleAutomated Vulnerability Remediation
Automated vulnerability remediation — how it works, what it generates, and how it fits into the broader finding-to-remediation workflow, with security verification under human control.
Read articleCursor Code Security
How to secure Cursor-generated code — independent review of suggestions and agent edits, common vulnerability patterns, and what static analysis adds beyond the assistant.
Read articleDependency Drift in AI-Generated Code
AI dependency drift is the change in direct, transitive, runtime, version, provenance, license, and vulnerability characteristics of a project as AI-assisted revisions add, replace, or remove packages.
Read articleDependency Security for AI-Generated Code
Why AI-generated software increases dependency opacity and makes dependency security analysis — including SCA, hybrid analysis, and supply-chain evaluation — more important than in traditional development.
Read articleDependency Security Gates for AI Coding
Where dependency security checks — package validation, SBOM generation, SCA, SAST, hybrid reachability, triage, remediation, and security gates — should be placed in an AI-assisted development workflow to detect, block according to policy, or reduce the risk of vulnerable, license-restricted, or hallucinated dependencies entering production.
Read articleFrom SAST Finding to Code Fix
How the workflow from SAST finding through triage, context, remediation suggestion, developer/security review, and re-verification can be shortened using AI-assisted triage and remediation.
Read articleGitHub Copilot Code Security
GitHub Copilot-specific security considerations — its inline completion model, context window behavior, training data characteristics, and integration points that affect how developers review and validate Copilot-generated code.
Read articleHidden Dependencies in AI-Generated Code
How direct, transitive, and runtime-expanded dependencies can make the true dependency surface of AI-generated software much larger than its visible imports suggest, and why SBOM generation is essential.
Read articleHuman Review of AI Security Fixes
Why AI-generated security fixes must be independently reviewed and verified by humans before being applied, and what review and verification should cover.
Read articleIndependent Security Validation for AI Code
Using separate static analysis — independent from the AI coding assistant's built-in suggestions — to provide an additional set of results for comparison and identify vulnerabilities that may be missed by the assistant.
Read articleLocal AI for Application Security
How AI-assisted triage and remediation can be deployed within organization-controlled infrastructure, and the distinction between local execution and fully air-gapped operation.
Read articleReducing AppSec Manual Triage Effort
How AI-assisted triage can reduce the manual validation workload for AppSec teams, allowing them to focus on findings that require engineering judgment rather than repetitive finding review.
Read articleReducing Developer Security Remediation Work
How AI-assisted remediation tools can reduce the manual effort developers spend understanding, locating, and preparing fixes for security findings — with review and verification under human control.
Read articleRemediation Confidence Ladder
The Remediation Confidence Ladder is a DerSecur engineering framework that separates a generated fix from reviewed, tested, re-scanned, and release-accepted remediation evidence.
Read articleSAST for AI-Generated Code
Static Application Security Testing as an independent security control for source code produced or modified by AI coding tools.
Read articleSecrets in AI-Generated Code
How AI coding tools can introduce credentials and other secrets into source code, and how secret detection gates prevent exposure.
Read articleSecure Remediation of AI-Generated Code
How vulnerabilities in AI-generated code should be remediated and independently re-verified before production acceptance.
Read articleSecuring AI-Generated Code
Independent security verification controls and workflow for code produced or modified by AI coding tools.
Read articleSecurity Gates for AI-Generated Code
Mandatory security gates, required evidence, and acceptance decisions for AI-generated code before production use.
Read articleSecurity Review of AI-Generated Code
AI-assisted development increases the volume and rate of code production, making independent security review essential to identify vulnerabilities that may be introduced by AI code suggestions.
Read articleSecurity Validation for Coding Agents
A comprehensive approach to securing AI coding agents — including Cursor, Copilot, Claude Code, and other AI-assisted development tools — through independent security analysis, automated review processes, and security gates.
Read articleSlopsquatting
How AI coding tools can hallucinate non-existent package names that attackers register and weaponize, and how dependency security gates prevent supply chain compromise.
Read articleVerifying AI-Suggested Dependencies
How to verify AI-suggested dependencies for package existence, provenance, known vulnerabilities, supply-chain risk, license risk, and dependency policy before accepting them into a project.
Read articleDAST
22 articlesCombining SAST and DAST
SAST vs DAST explained — how static and dynamic application security testing differ, what each technique detects, and why organizations use both.
Read articleAuthenticated DAST Testing
How authentication coverage in DAST affects the depth and accuracy of dynamic analysis, and why testing authenticated sessions reveals weaknesses that unauthenticated scans miss.
Read articleCode-to-Runtime Security Testing
How security teams can use SAST and DAST together to connect code-level weaknesses identified by static analysis with runtime behavior observed by dynamic analysis.
Read articleContinuous DAST Rescanning
How continuous DAST rescanning detects new vulnerabilities introduced by application changes, shows whether previously reported findings are still detected, and maintains ongoing visibility into runtime security.
Read articleCorrelation vs Aggregation in AppSec Findings
How correlation between findings from different security tools provides structured relationships and code-to-runtime evidence, versus aggregation which merely displays findings from multiple sources together.
Read articleDAST API Testing with OpenAPI
How providing an OpenAPI definition to a dynamic scanner improves API coverage, test accuracy, and endpoint discovery during dynamic security testing.
Read articleDAST Finding Not Found by SAST
Reasons why dynamic analysis may observe exploitable behavior that static analysis does not identify, including runtime configuration, authentication behavior, and exposed interfaces.
Read articleDAST for Single-Page Applications
How dynamic scanners can exercise JavaScript-heavy and single-page applications through AJAX spider functionality and JavaScript execution, enabling coverage of client-side rendered content.
Read articleDAST Scan Modes
How different DAST scan modes affect testing behavior, speed, and operational risk, and how to choose the appropriate mode for different testing scenarios.
Read articleDAST-Confirmed SAST Findings
How a SAST finding that is also observed by dynamic analysis provides additional runtime evidence and what that evidence means for prioritization and remediation.
Read articleFrom Security Finding to Reverification
The end-to-end workflow from security finding detection through correlation, triage, remediation, review, and independent re-verification — connecting SAST and DAST results into a structured remediation lifecycle.
Read articlePrioritizing SAST Findings with DAST
How runtime evidence from dynamic analysis helps security teams prioritize SAST findings by distinguishing those with observed exploitable behavior from those without.
Read articleSAST and DAST in CI/CD
Where SAST and DAST belong in a CI/CD pipeline — static analysis on the build, dynamic analysis on a running target, and how correlating both stages changes what you ship.
Read articleSAST Finding Not Found by DAST
Reasons why a SAST finding may not be observed during dynamic analysis, including code-path coverage gaps, environment differences, and methodological limitations.
Read articleSAST, DAST, and SCA Coverage Matrix
A coverage matrix for comparing SAST, DAST, and SCA by analyzed artifact, required system state, evidence produced, lifecycle placement, and blind spots.
Read articleSAST, DAST, and SCA Together
SAST vs DAST vs SCA — how static analysis, dynamic testing, and software composition analysis differ by artifact, system state, evidence, lifecycle placement, and blind spots.
Read articleSAST/DAST Results Correlation
How correlation between SAST findings and DAST findings provides structured, code-to-runtime evidence that is more actionable than displaying results from both scanners side by side.
Read articleSecurity Finding Validation
The systematic process of examining reported security findings across SAST, DAST, and other analysis techniques to determine validity, followed by separate assessment of reachability, exploitability, and risk treatment.
Read articleSecurity Testing Before and After Deployment
How testing application security before deployment (SAST on source code) and after deployment (DAST on running application) provides complementary visibility into different aspects of application security.
Read articleStatic and Dynamic Security Testing Workflow
A practical workflow for combining SAST and DAST analysis, from source code through correlation, prioritization, remediation, and reverification.
Read articleWhat Is DAST?
What Dynamic Application Security Testing is, how DAST sends requests to a running application and evaluates responses, and where its coverage ends.
Read articleWhen SAST and DAST Disagree
How to interpret and resolve differences between SAST and DAST findings — different techniques observe different properties, and legitimate disagreements are expected.
Read articleSCA & supply chain
21 articlesSAST vs SCA
The difference between SAST and SCA, including the code each technique examines, the risks each can identify, and why software teams commonly need both.
Read articleBlocking Risky Dependencies at the Repository Manager
The engineering shift from post-hoc SCA scanning (detecting risks after components enter a project) to pre-emptive repository-level controls (blocking risky components before they are downloaded and used).
Read articleBuild Pipeline Supply Chain Security
Build pipeline security controls — CI/CD platform security, build environment isolation, secrets management, identity and access controls, and build process hardening — for preventing supply-chain attacks against the build process.
Read articleCyber Resilience Act SAST and SCA Evidence
How SAST, SCA, SBOMs, remediation records, and release evidence can support Cyber Resilience Act security activities without implying automatic compliance.
Read articleDependency Provenance
Dependency provenance — the documented origin, publisher identity, build process, and trust chain of software dependencies — and the attestation frameworks that enable supply-chain verification.
Read articleHybrid SAST + SCA Analysis
Hybrid SAST+SCA analysis correlates SCA findings (vulnerable components) with SAST findings (application code behavior) to construct code-level reachability evidence, enabling more accurate prioritization of dependency vulnerabilities.
Read articleLibrary Risk Beyond Known Vulnerabilities
The distinct categories of third-party library risk — known vulnerabilities, software supply-chain risk, package provenance and health, license risk, and dependency policy — that organizations should evaluate beyond CVE scanning.
Read articleLocal Hybrid SAST + SCA Analysis
How organizations can deploy SAST, SCA, and hybrid SAST+SCA analysis on organization-controlled servers or local network infrastructure.
Read articleMalicious Open-Source Packages
The growing threat of malicious open-source packages and the strategies for detecting, preventing, and responding to compromised or intentionally harmful dependencies.
Read articleMulti-Layer Application Security Testing
How multi-layer application security testing uses multiple analysis techniques at different layers — code, dependencies, and running application — to provide broader visibility that no single technique achieves alone.
Read articleOffline SBOM Generation in Air-Gapped Environments
The engineering architecture and challenges of generating accurate SBOMs in air-gapped or isolated environments where public package registries are unreachable, and how corporate repositories can replace public registries during SBOM generation.
Read articleReducing SCA Noise with Reachability
How code-level reachability evidence helps teams prioritize large SCA finding lists by distinguishing reachable from unreachable vulnerable functions, while acknowledging residual risks such as reflection, dynamic loading, and incomplete analysis.
Read articleSBOM for Delphi Applications
The engineering challenges of dependency discovery in Delphi applications and how SCA-based SBOM generation addresses legacy code, GetIt packages, and non-standard component workflows.
Read articleSBOM vs SCA vs Hybrid Analysis
SCA vs SBOM — an SBOM inventories discovered components, SCA evaluates associated risk, and hybrid SAST + SCA analysis adds code-level usage and reachability evidence.
Read articleSoftware Composition Analysis for Delphi
The distinction between dependency discovery (SBOM generation) and vulnerability evaluation (SCA) for Delphi applications, and how automated SCA analysis identifies security, supply-chain, and license risks in Delphi dependencies.
Read articleSoftware Dependency Verification
The operational process of verifying that declared dependencies in manifests and lockfiles match the resolved and fetched packages, including hash verification, lockfile integrity, and source-to-artifact correspondence.
Read articleThe SBOM-to-Action Gap
The SBOM-to-Action Gap is the difference between possessing a component inventory and having sufficient vulnerability, reachability, context, and policy evidence to make a remediation decision.
Read articleTransitive Dependency Risk
Direct vs transitive dependencies in software composition analysis — why indirect packages expand the attack surface and how to see them in the dependency tree.
Read articleVulnerability Prioritization with Code Context
Using code-level evidence — data flows, reachability, function context, and dependency relationships — to prioritize validated vulnerabilities for remediation based on actual risk rather than severity ratings alone.
Read articleVulnerable Function Reachability
The distinction between component presence, vulnerable component relevance, vulnerable function usage, and exploitability. How reachability analysis provides evidence about code paths and usage, and why reachability does not by itself prove exploitability.
Read articleWhat Is SCA?
What Software Composition Analysis is, how it identifies third-party components and evaluates associated vulnerability and license information, and where its conclusions end.
Read articleLanguages
8 articlesEU Cyber Resilience Act for Delphi Applications
How the EU Cyber Resilience Act creates cybersecurity and vulnerability-handling obligations for Delphi-developed software placed on the EU market, and what evidence organizations need to demonstrate compliance.
Read articleSAST for .NET
How SAST analyzes C# and VB.NET source, why framework and application context matter, and how teams should validate and remediate .NET findings.
Read articleSAST for C and C++
How SAST supports analysis of C and C++ source code, why build and platform context matter, and how teams should validate memory-safety and data-flow findings.
Read articleSAST for Delphi
How SAST analyzes proprietary Delphi source code, how it differs from Delphi SCA and CRA work, and how teams should validate and remediate findings.
Read articleSAST for Java
How SAST analyzes Java source code, what project context improves analysis, and how teams should validate and remediate Java security findings.
Read articleSAST for JavaScript and TypeScript
How SAST analyzes JavaScript and TypeScript across server, browser, and mobile code, and how teams should validate framework-aware findings.
Read articleSAST for PHP
How SAST analyzes PHP source code, why framework and request-handling context matter, and how teams should validate and remediate PHP security findings.
Read articleSAST for Python
How SAST analyzes Python source code, why framework and runtime context matter, and how teams should validate and remediate Python security findings.
Read articleTriage & remediation
20 articlesWhat Is SAST?
What Static Application Security Testing is, how SAST examines source code without executing it, what evidence it produces, and where its coverage ends.
Read articleApplication Security Second Opinion
How additional security analysis provides evidence about detection coverage, confidence in existing controls, and findings that a primary scanner may have missed.
Read articleFalse Positive Vulnerability
A reported finding whose asserted weakness or data flow is not present under the defined validation criteria, and is closed with documented rationale.
Read articleIndependent SAST Verification
How a second SAST analysis provides structured evidence about what the primary scanner may have missed, how findings from different engines compare, and how to use that evidence in security decisions.
Read articleReducing SAST False Positives
How SAST false positives create operational burden for AppSec teams, and how improved analysis configuration can reduce findings produced while automated triage can reduce the manual burden of evaluating already-reported findings.
Read articleSAST Evaluation and Deployment Toolkit
A structured SAST toolkit connecting requirements, RFP, proof-of-concept, triage, severity and SLA policy, rollout planning, and total-cost analysis.
Read articleSAST False Positives
Why SAST tools report findings that are not genuine vulnerabilities, and how to triage, validate, and reduce false-positive findings without missing genuine vulnerabilities.
Read articleSAST Findings Triage
What SAST findings mean and how teams validate, prioritize, disposition, and measure the recurring review workload created by static-analysis results.
Read articleSAST Pricing and Total Cost of Ownership
A SAST total-cost model covering license boundaries, infrastructure, implementation, integrations, operations, triage, remediation support, and scenario uncertainty.
Read articleSAST RFP Template
A copy-ready SAST RFP template covering technical coverage, deployment, integrations, finding evidence, triage, governance, service, pricing, and proof-of-concept acceptance.
Read articleSAST Second Opinion
How a second additional SAST analysis provides evidence about detection coverage gaps, finding confidence, and differences in semantic analysis between SAST engines.
Read articleSAST Severity and SLA Matrix
A configurable SAST severity and SLA matrix that separates scanner severity from business priority and defines deadlines, escalation, verification, and exception handling.
Read articleSAST Tool Requirements Checklist
A practical SAST requirements checklist covering code coverage, analysis evidence, deployment boundaries, integrations, triage, governance, scalability, support, and cost.
Read articleSAST Triage Playbook
A practical SAST triage playbook with queue gates, disposition criteria, escalation rules, evidence fields, and operating metrics.
Read articleSAST Triage Tax
SAST Triage Tax is a DerSecur-defined operational metric for estimating the recurring human workload required to validate, prioritize, disposition, route, and re-check static-analysis findings.
Read articleSAST vs Code Review
How SAST differs from manual secure code review, what each technique can examine, and how automated analysis and human judgment work together.
Read articleTrue Positive Vulnerability
A true positive is a reported finding whose asserted weakness genuinely exists under the defined validation criteria. Reachability, exploitability, severity, and business impact are assessed separately for prioritization and treatment.
Read articleValidate SAST Findings
The process of validating SAST findings to determine which reported findings represent genuine vulnerabilities, followed by separate assessment of reachability, exploitability, and risk treatment.
Read articleVulnerability Exploitability Analysis
The process of analyzing a verified vulnerability to determine whether the conditions for exploitation are present, including network exposure, authentication requirements, data flow completeness, and environmental context.
Read articleVulnerability Verification
The process of validating a reported security finding to determine whether its asserted weakness genuinely exists, followed by separate assessment of reachability, exploitability, and risk treatment.
Read articleCompliance
3 articlesApplication Security Assurance
Application security assurance as a comprehensive approach to software security that combines multiple analysis techniques, independent verification, supply-chain security, and continuous monitoring to provide confidence in the security posture of software.
Read articleSAST and OWASP Top 10:2025
How SAST contributes evidence for OWASP Top 10:2025 risks, why coverage varies, and which risks require additional analysis techniques.
Read articleWhen to Use a Second SAST Scanner
Decision criteria for when organizations should deploy a second SAST scanner as part of their security workflow, including regulatory, assurance, procurement, and operational contexts.
Read articleSAST
14 articlesHow to Evaluate SAST Tools
A step-by-step methodology for evaluating SAST tools — from defining requirements and selecting representative codebases, through testing, scoring, and procurement decision — including team roles, timelines, and decision gates.
Read articleASPM vs SAST
How an application-security posture-management and correlation layer differs from SAST, which analyzes source code for security weaknesses.
Read articleHow to Validate SAST Results
A structured approach to validating SAST results — assessing detection accuracy, coverage quality, false-positive and false-negative rates, and overall analysis reliability.
Read articleMulti-SAST Strategy
Strategies for using multiple SAST tools in a security workflow, including the rationale, benefits, trade-offs, and implementation patterns for multi-scanner approaches.
Read articleOn-Premises SAST
How on-premises SAST keeps source-code analysis in organization-controlled infrastructure, what deployment decisions it requires, and where its boundaries end.
Read articleSAST Accuracy
SAST accuracy encompasses both precision (false-positive rate) and recall (false-negative rate), along with detection coverage, framework awareness, and analysis depth.
Read articleSAST Detection Coverage
How to measure and evaluate the extent to which a SAST tool detects vulnerability classes, frameworks, and code patterns in a codebase.
Read articleSAST Evaluation Criteria
The scorecard dimensions and weighted criteria framework for comparing SAST tools — detection accuracy, coverage, integration, deployment, analyst experience, and total cost of ownership — with scoring rubrics and weight assignment guidance.
Read articleSAST False Negatives
Why SAST tools miss genuine vulnerabilities — coverage gaps, analysis limitations, configuration issues, and code patterns that evade detection.
Read articleSAST PoC Plan
A practical SAST PoC plan with roles, representative repositories, test scenarios, evidence capture, acceptance gates, schedule, and decision record.
Read articleSAST Proof of Concept
A structured approach to conducting a SAST proof of concept, including codebase selection, ground truth creation, evaluation criteria, and decision-making methodology.
Read articleSAST Rollout Plan
A phased SAST rollout plan with readiness gates, pilot scope, baseline policy, developer enablement, operating metrics, and expansion criteria.
Read articleSecond SAST Tool
Practical guidance on selecting, evaluating, and integrating a second SAST tool as a complementary analysis engine within an existing security workflow.
Read articleWhy SAST Tools Find Different Vulnerabilities
Technical reasons why SAST engines produce different results — differences in algorithms, rule sets, data-flow models, framework awareness, and analysis depth.
Read articleEverything else
3 articlesApplication Security Tool Consolidation
Strategies for consolidating application security tools, including the trade-offs between consolidation versus independent engines, cost optimization, and workflow simplification.
Read articleAppSec Alert Fatigue
How vulnerability noise from automated security tools creates alert fatigue for AppSec teams, and how structured alert-load management — routing, deduplication, suppression review, and escalation — can reduce the operational burden.
Read articleSoftware Artifact Integrity
The process of verifying that build artifacts match their declared sources and have not been tampered with during or after the build process, ensuring end-to-end supply-chain integrity.
Read article