Security Testing
SAST, DAST, dependency and secret scanning, fuzzing, penetration testing — what each finds, what each misses, and the security tests that belong in CI.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
SAST, DAST, dependency and secret scanning, fuzzing, penetration tests and review each see a different slice; no scanner understands every authorization rule.
Generate structured input variations and watch for crashes, hangs, invariant violations and resource blowups—especially at parsers and file boundaries.
User A cannot access User B’s invoice; expired tokens and unsigned webhooks are rejected; non-admins cannot call admin operations.
A fixed security bug becomes a permanent executable invariant using the smallest test that reproduces the original boundary failure.
Use vulnerability categories as an index—then always follow vulnerability → why it exists → secure design → test.