appsec
14 posts · all writing
Draugr gates its own CI
Draugr's repository is held to the same P1 gate it asks users to adopt, run by the published release on every pull request that changes code, every push to main, every weekday, and every tag before it ships.
Don't make the model rank it
Two findings arrive looking the same, and one is a leaked private key. Left to a model, the choice of which to fix first comes out differently every time.
The monorepo your scanner thinks is one app
One repository, many services, one number. Whose findings are these, which are urgent, and whose merges does a red build stop? None of it is in the code.
Shift left became run everything on every commit
What got built was twelve scanners on every push, eleven minutes, and a pipeline people bypass. The useful version is about latency, not location.
The TLS certificate nobody was watching
Expired certificates take down more services than TLS vulnerabilities compromise. The check is trivial, the failure total, and it is owned by nobody.
What authenticated DAST actually costs
An unauthenticated scan reaches the login page. Everything worth finding is behind it, which means credentials, session handling and an API spec.
You don't need twelve scanners, just the four that apply
Teams adopt security tooling as nothing or everything at once, and both fail because nobody decided which controls their software actually needs.
Your CSP is strong and broken, and a grade will not tell you
Header tools grade a Content-Security-Policy on strength. Whether it works depends on the page it protects, which is why so many stay in report-only mode.
Security findings in your editor, from standard SARIF
A finding you have to go looking for is one you fix later. Draugr writes standard SARIF, so a scan opens as inline squiggles in VS Code with no plugin.
Why we didn't build an AI pentester
Models find bugs in code they have never seen. That leaves untouched what tooling is for: the same answer every time, cheap enough for every commit.
Point your AI assistant at Draugr
Ask an assistant to check your repo and it will, using whatever scanner it finds over a scope it chose. On our demo that missed 78 of the top 99.
Scan any repo for vulnerabilities with zero config
Most tools want config before a result. draugr scan . runs SAST, SCA, secret and IaC checks over a repo with no descriptor, and ranks what it finds.
What to fix first when everything is critical
Severity is not priority. What matters depends on where a problem lives and what the business would lose, which is context a scanner cannot see.
Describe your app, not your scanners
Teams wire up scanners instead of describing software, and it breaks at scale. One declarative descriptor covers Trivy, Semgrep and Gitleaks at once.