SAST DAST SCA
Static analysis (scans source code), dynamic analysis (attacks a running instance), and dependency scanning (known CVEs in libraries).
Why we need this / what value this brings
Catches known vulnerability classes and outdated/vulnerable dependencies automatically, before a human review would ever find them.
When to use this
SAST/SCA from the first CI pipeline; DAST once there's a running instance worth attacking in a test environment.
How to use or implement this
Wire a dependency scanner (e.g. npm audit/pip-audit or a dedicated SCA tool) into CI first — it's the cheapest of the three to add.
Research questions
- Is any of this wired into CI yet, or still manual/nonexistent?
Empty folder — drop notes, links, and findings here as you research.