Read as
Why this module exists. Static and dynamic application security testing in CI/CD is how modern programmes catch security defects before production. This module covers the tool landscape, where each fits in the pipeline, and the realistic tuning required to get signal-to-noise ratios that engineers will actually use.
Why this module exists. SAST that produces 1000 false positives per scan trains developers to ignore findings. SAST tuned and triaged surfaces real bugs caught before merge. The difference is operational discipline, not tool choice.
The testing pyramid for AppSec
| Tool class | When | Catches |
|---|---|---|
| SAST | In IDE / pre-commit / PR | Code-level bugs (injection, crypto misuse, unsafe APIs) |
| SCA | PR / build | Vulnerable dependencies (Module 6) |
| Secret scanning | Pre-commit + PR | API keys, certs, passwords in code |
| IaC scanning | PR / build | Terraform / K8s manifest misconfig |
| Container scanning | Build | Image vulnerabilities, malicious layers |
| DAST | Post-deploy / staging | Runtime issues, real-traffic auth flows |
| IAST | In test environments | Hybrid of SAST + DAST signal |
Need a real pentest?
Get a VAPT scoping call
Senior practitioner-led VAPT — not a checklist run by juniors. CVSS-scored findings, free retest, attestation letter. India's SMBs and SaaS teams.
Book VAPT scoping call
Replies in 4 working hrs · India-only · Senior consultants