sast
3 posts · all writing
You don't need twelve scanners, you need to know which four apply
Security tooling is usually adopted in one of two ways: nothing, or everything at once. Both fail for the same reason. Nobody decided which controls the thing you actually build requires. A short way to work that out from what your software is made of.
Why we didn't build an AI pentester
Models can find bugs in code they've never seen. That commoditizes the pentester's craft, and leaves untouched the thing security tooling is actually for: the same answer, every time, cheap enough to run on every commit, with evidence someone will accept.
Scan any repo for vulnerabilities with zero config
Most security tools make you write config before you get a single result. Draugr scans a repo with no descriptor at all: draugr scan . runs SAST, SCA, secret and IaC checks over your code and ranks what it finds. Nothing to write first.