sca
4 posts · all writing
The monorepo your scanner thinks is one app
One repository, many services, one number. Whose findings are these, which are urgent, and whose merges does a red build stop? None of it is in the code.
Most of your container CVEs aren't yours
Scan a 35-line Python app and get 292 findings. 219 come from the base image, and none are fixable by changing your code. What the actionable move is.
You don't need twelve scanners, just the four that apply
Teams adopt security tooling as nothing or everything at once, and both fail because nobody decided which controls their software actually needs.
Scan any repo for vulnerabilities with zero config
Most tools want config before a result. draugr scan . runs SAST, SCA, secret and IaC checks over a repo with no descriptor, and ranks what it finds.