sast
4 posts · all writing
The monorepo your scanner thinks is one app
One repository, many services, one number. Whose findings are these, which are urgent, and whose merges does a red build stop? None of it is in the code.
You don't need twelve scanners, just the four that apply
Teams adopt security tooling as nothing or everything at once, and both fail because nobody decided which controls their software actually needs.
Why we didn't build an AI pentester
Models find bugs in code they have never seen. That leaves untouched what tooling is for: the same answer every time, cheap enough for every commit.
Scan any repo for vulnerabilities with zero config
Most tools want config before a result. draugr scan . runs SAST, SCA, secret and IaC checks over a repo with no descriptor, and ranks what it finds.