001worked guide
How to triage a security finding before opening a developer ticket
Use six evidence gates to check a scanner alert, confirm the affected path, and send developers only findings they can act on.
For AppSec leads
CodeSecPilot / Field notes 001—200
Make the next security decision with evidence.
Practical guides to review code, prioritize findings, verify repairs and choose security tools with evidence you can check.
200 in-depth guides 20 collections01 / 10
Finding triage
Check what an alert proves, collect missing evidence, and give developers a finding they can act on.
002checklist
What a useful vulnerability finding should contain
See the evidence, impact, uncertainty, and repair details that make a vulnerability finding useful to engineers and security leaders.
For AppSec leads
003worked guide
How to turn a scanner alert into a testable claim
Turn a scanner alert into a testable claim by naming the actor, input, path, control, effect, and evidence that could disprove it.
For Security engineers
004worked guide
How to write an attack path developers can check
Write an attack path developers can check: actor, input, reachable entry, security controls, harmful effect, and what remains unverified.
For Security engineers
005decision guide
How to handle findings with missing deployment context
Handle a security alert with missing deployment facts by separating what source code shows from what the selected environment proves.
For AppSec leads
006decision guide
How to separate a vulnerability from a hardening recommendation
Decide whether a code issue is a vulnerability candidate, hardening opportunity, or unresolved claim using a specific actor and harmful effect.
For Security engineers
007worked guide
How to review a finding that crosses services
Trace a security finding across service boundaries, identify each control and owner, and record missing facts before assigning a verdict.
For Staff engineers
008template
How to document uncertainty in a security finding
Document uncertainty in a security finding with the missing fact, its effect on the decision, an evidence owner, and a date to revisit it.
For Security engineers
009workflow
How to dispute a scanner finding without losing the evidence
Challenge a scanner finding with exact counterevidence while preserving the original alert, scope, revision, and reason for the decision.
For Developers
010decision guide
What to do when two security reviewers disagree on a finding
Resolve disagreement between security reviewers by freezing the claim, comparing evidence, naming unresolved facts, and assigning an adjudicator.
For AppSec leads
02 / 10
False positives
Challenge scanner claims with code, controls and deployment facts while preserving the review record.
011pillar
Why security scanners produce false positives and how to investigate them
Understand why scanners raise false positives, then trace a specific claim through code, controls, and deployment before deciding its status.
For AppSec leads
012worked guide
How to check whether a flagged code path can actually be reached
Check whether a flagged code path is actually reachable by the proposed actor in the relevant build, route, and deployment context.
For Security engineers
013worked guide
How to account for middleware when verifying an authorization alert
Check whether middleware protects a flagged route by following mount order, caller permissions, object checks, and alternate entry points.
For Staff engineers
014worked guide
How to test whether a sanitizer invalidates an injection claim
Assess a suspected injection alert by tracing input transformation, sanitizer context, bypass routes, and the behavior needed to defeat the claim.
For Developers
015checklist
How to check whether a vulnerable dependency runs in production
Find out whether a vulnerable dependency is present, shipped, and actually used in production before deciding exposure and the next check.
For Security engineers
016explanation
Why a valid code citation does not prove a vulnerability
Learn why an exact source-code citation is only one part of a vulnerability claim and what evidence connects a line to real harm.
For AppSec leads
017workflow
How to build a repeatable false-positive review process
Build a repeatable false-positive review process with a stable claim, evidence gates, dispositions, owners, and noise metrics.
For AppSec leads
018decision guide
When to suppress a finding and when to keep investigating
Decide when a security finding can be narrowly suppressed, when investigation must continue, and what evidence makes the decision reversible.
For Security engineers
019workflow
How to keep rejected claims visible without polluting the fix queue
Keep rejected scanner claims available for later review while giving developers a clear worklist of repairs, investigations and their evidence.
For AppSec leads
020measurement guide
How to measure scanner precision without gaming the denominator
Measure scanner precision with a defined alert cohort, fair sampling, unresolved cases, and coverage so the metric reflects real review quality.
For Security leaders
03 / 10
Risk prioritization
Decide what needs attention using exposure, attacker prerequisites, business impact and available engineering time.
021pillar
How to prioritize application vulnerabilities with limited engineering time
Prioritize application vulnerabilities against real engineering capacity, evidence and dependencies, with a worked example of selecting the next repair.
For AppSec leads
022decision guide
CVSS severity versus practical exploitability in your application
Use CVSS severity alongside application evidence without confusing a score with exploitability, local exposure or the urgency of a specific repair.
For Security engineers
023worked guide
How to rank vulnerabilities by attacker access and prerequisites
Rank vulnerabilities by attacker access and necessary prerequisites, checking dependent conditions and countercontrols before choosing the next action.
For Security engineers
024workflow
How to use CISA KEV without treating it as the whole backlog
Use CISA KEV to focus vulnerability response while confirming affected assets, ownership and applicability, without treating the catalog as your entire backlog.
For AppSec leads
025decision guide
How to weigh business impact separately from exploit difficulty
Assess business consequences separately from exploit difficulty, tracing the plausible loss and affected workflow without inventing precise financial impact.
For Security leaders
026decision guide
How to prioritize a vulnerability with uncertain internet exposure
Prioritize a vulnerability when internet exposure is uncertain, assign the missing deployment evidence and record temporary controls with a restoration decision.
For Security engineers
027workflow
How to decide which findings enter a developer's weekly queue
Build a developer’s weekly security queue from ready work, available capacity and accepted dependencies, while preserving blocked and deferred commitments.
For AppSec leads
028worked guide
How to handle a critical scanner score with weak evidence
Handle a critical scanner score with weak evidence by defining the claim, obtaining decisive facts and separating precautionary action from confirmation.
For Security engineers
029decision guide
How to prioritize flaws shared by several repositories
Prioritize a flaw shared across repositories using consumer-specific reachability, repair ownership and adoption evidence instead of multiplying alert counts.
For Staff engineers
030template
A one-page vulnerability priority decision record template
Use a one-page priority record to document evidence, impact, uncertainty, capacity and the next decision, including a filled example and investigation variant.
For AppSec leads
04 / 10
Remediation
Turn supported findings into bounded repairs, verify the correction, and manage temporary mitigations.
031pillar
How to verify that a vulnerability was fixed in a new commit
Verify a vulnerability fix in a new commit by checking the original harmful path, alternate callers and deployment binding before recording a scoped closure.
For Security engineers
032template
What a useful security fix ticket looks like
Write a security fix ticket with the failed rule, evidence, accepted owner and clear completion conditions, so a developer can start without reconstructing triage.
For Developers
033decision guide
How to distinguish fixed from no longer detected
Distinguish a repaired vulnerability from a missing scanner alert by checking code behavior, scan coverage and release evidence as separate questions.
For AppSec leads
034workflow
How to reassess a security fix without rerunning unrelated work
Reassess a security repair with a bounded scope based on changed controls and callers, expanding only when new evidence reveals a relevant dependency.
For Security engineers
035worked guide
How to handle a vulnerability that reappears after a patch
Investigate a vulnerability that returns after a patch by distinguishing regression, an incomplete repair and a newly exposed path, then assigning prevention work.
For Developers
036decision guide
How to close a finding when the vulnerable feature is removed
Close a finding after feature removal only when the affected routes, workers and restoration paths are reconciled with evidence for the deployed artifacts.
For AppSec leads
037workflow
How to record compensating controls without calling the code fixed
Record a compensating control’s coverage, evidence, failure response and expiry while keeping the underlying defect and unfinished repair visible to its owner.
For Security engineers
038workflow
How to hand a security finding to the right code owner
Route a finding by the control that needs to change, obtain an accepted handoff and preserve the coordinator when implementation crosses team boundaries.
For AppSec leads
039checklist
How to review a proposed security patch before merging
Review a proposed security patch against the failed invariant, relevant callers and current revision, with precise comments and a scoped merge recommendation.
For Staff engineers
040template
How to communicate residual risk after a partial fix
Communicate a partial repair by naming the protected and remaining paths, operational tradeoffs and next owner without claiming an unsupported risk percentage.
For Security leaders
05 / 10
AppSec program
Build a practical security review program with clear responsibilities, sustainable cadence and useful evidence.
041pillar
How to start an AppSec program with one security engineer
Start an AppSec program with one security engineer using bounded intake, selected repositories, accepted engineering ownership and a review cadence that fits capacity.
For Security leaders
042decision guide
How to choose the first repositories to assess
Choose the first repositories for security assessment using business exposure, change patterns and evidence availability, with explicit reasons for deferring others.
For AppSec leads
043workflow
How to set a vulnerability review cadence your team can sustain
Set a sustainable vulnerability-review cadence with realistic capacity, evidence deadlines and escalation rules for missed reviews and urgent new information.
For AppSec leads
044template
How to write an application security policy teams will use
Write an application security policy teams can apply to real decisions, with clear responsibilities, evidence requirements and a workable exception process.
For Security leaders
045decision guide
What a security champion should own and what they should not
Define a security champion’s role around local context and coordination, while assigning repair ownership and consequential decisions to the right accountable people.
For Engineering managers
046template
How to make a security exception with an owner and expiry
Make a security exception specific to an artifact, exposure and owner, with compensating controls, expiry and fresh evidence required for any renewal decision.
For AppSec leads
047workflow
How to reduce scanner backlog without hiding risk
Reduce a scanner backlog with auditable triage, scoped rejections and explicit unknowns, while keeping work counts and genuine risk reduction distinguishable.
For Security leaders
048workflow
How to plan AppSec work alongside feature delivery
Plan AppSec work alongside features by budgeting repair and specialist review capacity, naming dependencies and making allocation decisions explicit.
For Engineering managers
049decision guide
When to add a human review to automated code security
Add human review where automation leaves a consequential question unresolved, then check whether the review actually answers the decision that triggered it.
For Security leaders
050template
How to brief leadership on a new application security program
Brief leadership on an AppSec program with the evidence, capacity choices and concrete commitments needed to support delivery, without inflated assurance claims.
For Security leaders
06 / 10
Developer workflow
Fit security review into pull requests, releases and developer worklists without losing the underlying evidence.
051pillar
How to add security checks to pull requests without blocking every merge
Design pull-request security checks around honest results, revision binding and a narrow merge policy, with deeper work assigned to a separate assessment lane.
For Engineering managers
052template
How to write a developer-friendly vulnerability comment
Write a vulnerability comment that explains the affected path, useful evidence and next action, then keep the discussion accurate as the candidate changes.
For Security engineers
053decision guide
How to handle a security alert during an urgent release
Handle a security alert during an urgent release by comparing scoped fixes, restrictions and delay, with explicit authority and evidence for the exact candidate.
For Engineering managers
054workflow
How to keep security scans from slowing CI
Keep security scans from slowing CI by measuring critical-path delay and runner work, adjusting coverage deliberately and preserving honest incomplete results.
For Platform engineers
055decision guide
How to choose between PR scans and scheduled assessments
Choose PR, scheduled and event-driven security assessments by their decision purpose, with revision-aware handling of overlapping results and missed runs.
For AppSec leads
056worked guide
How to make a security check actionable in a code review
Make a security code-review comment actionable by stating the failed rule, checking downstream controls and updating the request when new evidence changes it.
For Staff engineers
057workflow
How to route a finding when CODEOWNERS is incomplete
Route a finding when CODEOWNERS is incomplete by identifying the service boundary, securing an accepted handoff and repairing the ownership map afterward.
For Engineering managers
058workflow
How to prevent duplicate security tickets across tools
Prevent duplicate security tickets by grouping observations around the same defect and repair boundary, preserving evidence when records must merge or split.
For AppSec leads
059workflow
How to give developers a short security worklist
Give developers a short daily security worklist with ready actions, precise blockers and review handoffs, while preserving unfinished commitments during interruptions.
For Engineering managers
060checklist
How to review security changes after a dependency upgrade
Review a dependency upgrade across deployed artifacts, effective configuration and application behavior, keeping advisory status and rollout completion separate.
For Developers
07 / 10
SAST basics
Understand what static analysis can establish, where it needs context, and how to evaluate its results.
061pillar
What is SAST and what can it actually tell you?
Understand what SAST examines, what its alerts can establish, and how source scope, configuration and review turn scan output into useful work.
For CTOs
062comparison
SAST versus DAST versus manual penetration testing
Compare SAST, DAST and manual penetration testing by the evidence each provides, then plan a bounded release review around unanswered questions.
For CTOs
063explanation
What code scanning misses in business logic
Review the business rules a generic scanner may not know, using a refund example with atomic reservations, retries and unresolved outcomes.
For AppSec leads
064checklist
How to evaluate a SAST tool with a real repository
Evaluate SAST on a pinned repository with defensible labels, matched scope, fair setup conditions and a record of the work each result required.
For AppSec leads
065explanation
Why a clean scanner report does not mean secure code
Interpret a clean scan by checking analyzed scope, raw alerts and filters, then write a release statement that preserves what remains unknown.
For CTOs
066worked guide
How to read a static-analysis dataflow trace
Read a dataflow trace from source to sink, inspect omitted adapters and branches, and distinguish input influence from an unsafe operation.
For Developers
067decision guide
How to choose scanning scope for a first assessment
Choose a first security assessment around one meaningful boundary, its dependencies and a realistic review budget with explicit stopping conditions.
For AppSec leads
068workflow
How to compare scanner findings when tools disagree
Compare conflicting scanner claims at matched revisions, inspect the deciding controls and tune narrowly without hiding a different caller path.
For Security engineers
069decision guide
How to separate source review from runtime validation
Separate source conclusions from runtime observations, match builds and fixtures, and decide when earlier evidence still supports the current claim.
For Security engineers
070template
How to report scan coverage honestly
Report scan coverage using separate inventory, acquisition, analysis and finding ledgers, with clear denominators and a worked example.
For AppSec leads
08 / 10
AI code security
Use AI for bounded code review, verify its claims, and account for model limits, source handling and cost.
071pillar
How to use AI for code security review without trusting every answer
Use AI in code security review with a traceable evidence worksheet, explicit limits, qualified human judgment, and a pilot that measures useful decisions.
For AppSec leads
072checklist
How to verify an AI-generated vulnerability report
Verify an AI vulnerability report against source, prerequisites, and counterevidence, then correct withdrawn claims and patches with a clear review record.
For Security engineers
073explanation
Why AI security findings need independent verification
Assess why independent verification matters for AI security findings, how to resolve reviewer disagreement, and where a small team should spend review time.
For Security leaders
074workflow
How to keep repository prompt injection out of security agent instructions
Keep repository content from becoming security agent instructions by tracking provenance through searches, summaries, caches, and downstream conclusions.
For Platform engineers
075measurement guide
How to evaluate an AI code scanner on false positives
Evaluate an AI code scanner using evidence quality, false positives, unresolved findings, and reviewer disagreement rather than a reassuring alert count.
For AppSec leads
076worked guide
How to check an AI attack path against exact source lines
Check an AI attack path edge by edge against exact source lines, branch conditions, fallback behavior, and the revision that supports each reported claim.
For Security engineers
077explanation
Why separate model calls are not the same as separate model judgment
Distinguish separate model calls from independent judgment using evidence packets, verifier rejection criteria, and a controlled comparison of review workflows.
For AppSec leads
078decision guide
How to set a budget for AI-assisted security review
Set an AI security review budget around concrete decisions, bounded investigation, and useful stopping conditions, with explicit reasons for any continuation.
For Security leaders
079template
How to describe AI scan limits to developers
Explain AI scan limits in the finding itself, name missing evidence, and use continuation records that keep developers from mistaking uncertainty for assurance.
For Security engineers
080checklist
How to assess a vendor's claims about autonomous pentesting
Assess autonomous pentesting claims through bounded scope, evidence quality, failed-run reporting, and a vendor trial with clear operational responsibilities.
For CTOs
09 / 10
Access control
Review resource ownership, tenant isolation and permission changes across the paths that expose customer data.
081pillar
How to review broken access control in a multi-tenant SaaS app
Review multi-tenant access control through resource relationships, authorization decisions, and delivery paths, with a practical map for the next route to inspect.
For Security engineers
082worked guide
How to investigate a reported IDOR before filing it
Investigate a reported IDOR with exact object and actor evidence, distinguish known identifiers from authorization failures, and scope related attachment access.
For Security engineers
083worked guide
How to verify ownership checks across parent and child resources
Trace ownership checks across parent and child resources, including moves, destination permissions, secondary outputs, and the evidence needed to close a fix.
For Staff engineers
084worked guide
How to prevent tenant ID spoofing in an API
Prevent tenant ID spoofing by binding API operations to server-established account context, checking internal callers, and examining exception and job paths.
For Developers
085checklist
How to review permission changes for stale access
Review stale access after permission changes across sessions, jobs, and result delivery, and align operator promises with the revocation behavior you can verify.
For Security engineers
086decision guide
How to design a least-privilege developer finding view
Design a developer finding view around least privilege, controlled sharing, deliberate history access, and the difference between a result link and permission.
For AppSec leads
087checklist
How to test an authorization rule across list and detail endpoints
Review authorization consistently across list and detail routes using controlled policy changes, saved links, revocation behavior, and evidence at delivery time.
For Developers
088worked guide
How to guard against cross-tenant data in batch operations
Review batch operations for cross-tenant data by checking every item, duplicate handling, metadata resolution failures, retries, and when outputs become available.
For Staff engineers
089checklist
How to review machine tokens with repository-scoped permissions
Review repository-scoped machine tokens from minting authority through job admission and result delivery, with explicit scope boundaries and revocation ownership.
For Platform engineers
090template
How to explain a cross-tenant data risk to leadership
Explain a cross-tenant data risk to leadership using supported impact, uncertainty, proportionate containment, and concrete conditions for resuming the feature.
For Security leaders
10 / 10
Identity
Follow sessions, credentials and account membership through the checks that establish who can act.
091pillar
How to review authentication and session security for SaaS
Review authentication and session security across complete user journeys, including fallback paths, session transitions, logout scope, and missing evidence.
For Security engineers
092checklist
How to check MFA enforcement on every sensitive route
Check MFA across sensitive actions and alternate routes, bind challenges to the intended operation, and distinguish assurance failures from authorization defects.
For Developers
093worked guide
How to avoid trusting an email domain as account membership
Avoid treating an email domain as account membership by separating identity, organization routing, approved account linking, and the evidence needed for migration.
For Staff engineers
094checklist
How to review invitation flows for privilege escalation
Review invitation flows for privilege escalation through role changes, resends, existing memberships, grant consumption, and effects after the acceptance commits.
For Security engineers
095worked guide
How to secure account switching in a multi-tenant app
Secure account switching by binding each operation to the intended account, reviewing stale forms and deep links, and checking independent tabs and cached views.
For Staff engineers
096decision guide
How to design safe session revocation after access removal
Design session revocation around observed denial, renewal paths, delayed access changes, and explicit restoration rather than treating a removal request as proof.
For Platform engineers
097checklist
How to review SSO account binding in SaaS
Review SSO account binding from connection administration to the first protected response, keeping identity linking, membership, and authentication assurance distinct.
For Security engineers
098worked guide
How to review password reset without bypassing MFA
Review password reset without weakening MFA by tracing restricted recovery context, support overrides, old sessions, new credentials, and access after completion.
For Developers
099decision guide
Passkeys versus security keys for privileged access
Compare passkeys and security keys for privileged access through enforceable policy, enrollment, spare authenticators, recovery, and a bounded usability pilot.
For Security leaders
100checklist
How to audit service credentials separately from human accounts
Audit service credentials separately from human accounts by checking issuance, renewal, actual scope, secret rotation, and the inventory's explicit boundaries.
For Platform engineers
11 / 10
Injection
Trace input into interpreters and sensitive operations, then check the actual context and controls.
101pillar
How to review injection risks from input to sensitive operation
Trace injection risk from controllable input through representation changes and stored values to sensitive operations, then choose repairs suited to each destination.
For Security engineers
102worked guide
How to verify a SQL injection finding when queries are parameterized
Verify SQL injection claims in parameterized code by tracing query construction, identifier mappings, caller coverage, and the difference between syntax and meaning.
For Developers
103worked guide
How to review command injection without running untrusted code
Review command injection without executing untrusted code by tracing process arguments, indirect inputs, configuration writers, and evidence missing from source.
For Security engineers
104worked guide
How to check template injection claims against actual rendering context
Assess template injection against the actual rendering context, template ownership, exposed helpers, output publication, and the evidence needed to close a repair.
For Developers
105worked guide
How to review cross-site scripting in a modern frontend
Review frontend XSS through input, rendering context, viewer permissions, and rich-text policy, with careful limits on what a harmless marker can demonstrate.
For Developers
106checklist
How to verify log injection and output encoding controls
Verify log and output encoding controls by separating authoritative fields from user content, tracing CSV consumers, and assigning precise remediation ownership.
For Security engineers
107worked guide
How to trace untrusted input through serializers and validators
Trace untrusted input through serializers and validators, including rejection fallbacks, normalized values, schema changes, and retirement of older consumers.
For Staff engineers
108worked guide
How to review unsafe file path construction
Review unsafe path construction through storage-key writers, ownership checks, migrations, and confinement evidence that identifies what source alone cannot prove.
For Developers
109decision guide
How to separate a dangerous API call from an exploitable injection path
Separate a dangerous API from an exploitable injection path with an explicit evidence ledger, authority boundaries, constrained language rules, and counterevidence.
For Security engineers
110checklist
How to choose a safe remediation for an injection finding
Choose injection repairs that preserve intended behavior by tracing mappings, queued inputs, account context, and acceptance criteria at both callers and drivers.
For Developers
12 / 10
Server-side risks
Review outbound requests, uploads, archives, webhooks and background work at their trust boundaries.
111pillar
How to review SSRF in a cloud application
Review cloud SSRF through URL construction, redirects, proxy behavior, destination access, and provider-specific evidence without overstating what source proves.
For Security engineers
112worked guide
How to assess file upload risk beyond extension checks
Assess file uploads beyond extensions by tracing content handling, ownership, replacement, derivatives, and the authorization required when results become available.
For Developers
113worked guide
How to review archive extraction for path traversal
Review archive extraction for traversal and unsafe publication using accepted entry manifests, stable import identity, bounded processing, and isolated retries.
For Developers
114worked guide
How to assess unsafe deserialization in application code
Assess unsafe deserialization by tracing data origin, decoder behavior, trust boundaries, and the evidence required to retire legacy formats without hidden fallback.
For Security engineers
115checklist
How to review webhook signature verification
Review webhook verification across signed bytes, replay handling, endpoint configuration, secret rotation, and the receiver's binding to the intended integration.
For Developers
116worked guide
How to review outbound URL allowlists for bypasses
Review outbound URL allowlists through parsing, redirects, destination policy, and configuration changes without expanding authority to make a failed fetch succeed.
For Security engineers
117worked guide
How to assess symlink risk when processing repositories
Assess repository symlink risks by separating stored links from admitted source, documenting exclusions, and preserving the boundaries of source-only processing.
For Platform engineers
118workflow
How to handle secrets that appear in scanner output
Handle secrets in scanner output with constrained evidence, safe downstream consumers, and clear separation between immediate containment and future prevention.
For AppSec leads
119checklist
How to review a background job that processes hostile files
Review hostile-file background jobs through admission, resource bounds, attempt identity, publication checks, and fleet capacity when individual work stops responding.
For Platform engineers
120template
How to explain a source-only finding that needs runtime proof
Explain a source-only finding with exact supported claims, missing runtime evidence, and the right next method while separating a proposed repair from proof.
For Security engineers
13 / 10
API and business logic
Check authorization, replay, quotas and state transitions against the business rules an API must enforce.
121pillar
How to review API authorization beyond login checks
Review API authorization beyond login by tracing account and object decisions, output projections, and the handling of newly added fields in exported results.
For Security engineers
122worked guide
How to find business-logic abuse paths in a checkout or credit flow
Find business-logic abuse in checkout and credit flows by tracing eligibility, competing writers, repeated actions, and the boundary between support and fresh grants.
For Staff engineers
123worked guide
How to review rate limits around expensive API operations
Review rate limits for expensive operations through admission, retries, operation identity, client-visible outcomes, and shared capacity across all entry paths.
For Platform engineers
124worked guide
How to assess replay protection on one-time actions
Assess replay protection on one-time actions by separating durable consumption from response caching and checking resend semantics, retries, and concurrent requests.
For Security engineers
125checklist
How to review pagination for information leaks
Review pagination for information leaks through cursor context, filter changes, current authorization, count accuracy, and misleading empty or incomplete results.
For Developers
126worked guide
How to review GraphQL authorization at the field level
Review GraphQL authorization at fields and relationships, including new type paths and error projections that can reveal values denied by the main response.
For Developers
127worked guide
How to implement object-level authorization consistently in REST APIs
Apply object-level authorization consistently in REST APIs through explicit account context, final write conditions, support exceptions, and retirement of bypasses.
For Developers
128worked guide
How to verify state transitions in a payment or credit workflow
Verify payment and credit transitions with explicit state rules, durable operation identity, retries, crash recovery, cancellation races, and separate ledger effects.
For Staff engineers
129worked guide
How to review asynchronous jobs for stale authorization
Review asynchronous jobs for stale authorization across admission, execution, and publication, with clear distinctions between cancellation, fencing, and termination.
For Platform engineers
130template
How to describe business-logic impact without inflating severity
Describe business-logic impact with supported outcomes, realistic scale, and clear uncertainty, keeping repair evidence separate from claims about historical loss.
For Security engineers
14 / 10
Dependencies
Connect package advisories and software inventories to shipped components, reachable behavior and repair choices.
131pillar
How to prioritize vulnerable dependencies in a real application
Prioritize vulnerable dependencies by matching identity, deployment, applicability, consequence, and repair options, then revisit decisions when their premises change.
For AppSec leads
132worked guide
How to read an SBOM and find the components that matter
Read an SBOM through artifact identity, component occurrences, dependency edges, and completeness, then turn missing inventory facts into precise follow-up requests.
For Security engineers
133checklist
How to check whether a vulnerable package is deployed
Check whether a vulnerable package is deployed by joining advisory identity, immutable artifact contents, and observed workloads, including mixed rollout states.
For Platform engineers
134workflow
How to handle a transitive dependency vulnerability
Handle a transitive vulnerability across every parent dependency, assess temporary overrides, verify business compatibility, and close against deployed artifacts.
For Developers
135workflow
How to assess a malicious package warning
Assess a malicious package warning by separating listed, installed, executed, and observed access states, with containment and resumption tied to explicit evidence.
For Security engineers
136checklist
How to review dependency update PRs for security
Review dependency update PRs against the shipped artifact, affected behavior and rollback path, with evidence that survives rebases and changed dependency graphs.
For Developers
137workflow
How to reconcile conflicting SCA results from two tools
Reconcile conflicting SCA results by matching package identities, advisory evidence and deployed scope, then preserve the reason behind each corrected decision.
For Security engineers
138template
How to track a dependency exception through its expiry
Track a dependency exception from approval to expiry with a responsible owner, working compensating controls and a practical recovery or upgrade decision.
For AppSec leads
139explanation
How to explain CVE reachability without promising safety
Explain CVE reachability through an explicit source and deployment path, while preserving missing evidence, control assumptions and reasons to revisit the claim.
For Security engineers
140decision guide
What an SBOM cannot tell you about exploitability
Use an SBOM to locate components and route investigation without treating an inventory as proof of reachability, deployment exposure or application exploitability.
For CTOs
15 / 10
Secrets and cloud
Handle credential exposure and review cloud permissions, build artifacts and temporary access in application context.
141pillar
How to respond when a secret is committed to Git
Respond to a secret committed to Git by containing access, checking affected consumers and separating credential revocation from history cleanup and investigation.
For Platform engineers
142checklist
How to verify a secret is fully rotated after exposure
Verify secret rotation across issuer state, running consumers and recovery paths, without confusing a successful replacement with proof the old value is unusable.
For Security engineers
143worked guide
How to prioritize IaC misconfigurations by real exposure
Prioritize infrastructure misconfigurations using effective deployment exposure, then keep emergency repairs aligned with the infrastructure source of truth.
For Cloud security engineers
144checklist
How to review cloud IAM permissions behind an application
Review application IAM permissions against real operations, effective policy and recovery needs, with bounded reductions and evidence for the changed grant.
For Cloud security engineers
145checklist
How to review CI credentials and token scopes
Review CI credential scope and trust conditions across triggers, artifacts and workflow edits, keeping untrusted data separate from privileged execution.
For Platform engineers
146workflow
How to keep build artifacts and source out of security logs
Keep source and build artifacts out of security logs with typed, bounded fields, useful error categories and diagnostic checks that preserve operator visibility.
For Platform engineers
147worked guide
How to review a container image alert in application context
Review container image alerts against shipped bytes, workload use and launch paths, including queued jobs and future tasks that could still run an old image.
For Security engineers
148decision guide
How to decide whether a cloud finding belongs to AppSec or platform
Assign cloud findings to the people who can contain, repair and verify them, using a shared record that keeps AppSec and platform responsibilities explicit.
For Security leaders
149worked guide
How to review temporary credentials for tenant data access
Review temporary credentials for tenant data access through resource restrictions, expiry and revocation enforcement, including changes to the approved scope.
For Cloud security engineers
150checklist
How to assess source-code exposure in a security vendor
Assess a security vendor’s source access from repository grant to retained copies, with a bounded approved snapshot, stop conditions and a clear exposure decision.
For CTOs
16 / 10
Coverage and standards
Map security requirements to actual evidence and state what a partial assessment can and cannot establish.
151pillar
How to use OWASP ASVS 5 without treating it as a scanner score
Use OWASP ASVS 5 as a versioned control baseline with evidence and scope limits, rather than converting selected source findings into an application-wide score.
For AppSec leads
152worked guide
How to map an ASVS requirement to code and deployment evidence
Map an ASVS requirement to source, configuration and runtime evidence, separating originating permissions from authorization changes and unresolved controls.
For Security engineers
153decision guide
How to label security controls that source review cannot verify
Label source-only assessment limits with separate method, progress and conclusion fields, so a reviewed code path cannot conceal an unverified deployment control.
For AppSec leads
154explanation
How to distinguish files discovered from files actually reviewed
Distinguish discovered, acquired, parsed and reviewed files using stable identities and receipts, without inflating coverage through retries or duplicate content.
For Security leaders
155template
How to report a partial security assessment to a customer
Report a partial security assessment with clear included scope, missing evidence and useful next actions, then correct shared claims when the evidence changes.
For Security leaders
156decision guide
How to choose an ASVS level for a SaaS product
Choose an ASVS level around product risk and control applicability, retain external integration boundaries and revisit the baseline when the application changes.
For CTOs
157template
How to document excluded source and why it matters
Document source exclusions with reasons, owners and review consequences, then track which files re-enter scope as permissions, configuration or code changes.
For AppSec leads
158explanation
How to use the OWASP Top 10 without calling it a test plan
Turn OWASP Top 10 categories into concrete control questions without calling them a test plan, using authorization, sharing and timeout cases to define evidence.
For Security engineers
159worked guide
How to measure assessed scope in a monorepo
Measure monorepo assessment scope with file and control ledgers, naming the actual review method and keeping missing source, incomplete work and findings separate.
For Platform engineers
160checklist
How to make a coverage statement a buyer can verify
Write a buyer-verifiable coverage statement with pinned scope, assessment provenance and explicit gaps, then identify what evidence would invalidate the claim.
For CTOs
17 / 10
Monorepos
Choose useful scope, trace shared components and report review depth across services and repository boundaries.
161pillar
How to scope security review for a large monorepo
Scope a large monorepo review around deployment units and security boundaries, with a bounded starting map and honest limits on repository-wide inventory claims.
For AppSec leads
162worked guide
How to identify security boundaries in a monorepo
Identify monorepo security boundaries by tracing authority across services, queues and return paths, then bind each conclusion to the artifacts actually reviewed.
For Staff engineers
163worked guide
How to assess shared middleware used by several services
Assess shared middleware across its consumers, checking caller bindings, trusted job admission and deployed versions before treating one repair as universal closure.
For Security engineers
164decision guide
How to prioritize code for review when scan budget is limited
Allocate a limited scan budget to consequential code paths, distinguish analyst time from model spend and preserve useful evidence for a bounded continuation.
For AppSec leads
165workflow
How to review a service with generated and vendor code
Review generated and vendor code through its contracts, provenance and callers, then place repairs where regeneration or a dependency refresh will preserve them.
For Platform engineers
166worked guide
How to trace a request across repositories for a security claim
Trace a security claim across repositories using pinned artifacts, authority boundaries and deployment combinations, keeping rollout overlap and entitlement gaps visible.
For Staff engineers
167workflow
How to assess an unfamiliar codebase without running it
Assess unfamiliar source without executing it by building a bounded static evidence map, controlling parser behavior and recording the limits of each conclusion.
For Security engineers
168decision guide
How to handle submodules and missing dependencies in code review
Handle missing dependencies and submodules as explicit evidence gaps, with bounded acquisition requests, alternative artifacts and a clear point to stop investigation.
For Security engineers
169workflow
How to organize source evidence from a million-line repository
Organize evidence from a million-line repository through stable identities and scope ledgers, distinguishing acquired source, reviewed paths and unknown child content.
For AppSec leads
170decision guide
How to compare a targeted scan with a full assessment
Compare a targeted scan with a full assessment by the question each can answer, the evidence still missing and the next decision that justifies broader work.
For CTOs
18 / 10
Trust and procurement
Evaluate repository permissions, source handling, regional processing, retention and vendor access before a pilot.
171pillar
How to assess where an AI security vendor processes source code
Assess where an AI security vendor processes source by tracing acquisition, inference, logs and support access, with evidence tied to the selected configuration.
For CTOs
172checklist
Questions to ask before connecting a repository to a security tool
Review repository connection requests before granting access, using a separate synthetic fixture and explicit permissions, owners and unresolved feature dependencies.
For Security leaders
173explanation
What server-managed encryption does and does not protect
Understand what server-managed encryption protects, who controls keys and plaintext access, and why customer-managed keys do not automatically make a service blind.
For Security leaders
174checklist
How to review a vendor's source retention and deletion claims
Evaluate source retention and deletion claims across working copies, logs, backups and keys, keeping accepted exceptions distinct from unresolved evidence gaps.
For Privacy counsels
175decision guide
How to distinguish EU hosting from single-region inference
Distinguish EU hosting from single-region inference through model routes, destinations and account eligibility, including the decision when an outage changes options.
For Privacy counsels
176checklist
How to evaluate tenant isolation in a code security SaaS
Evaluate tenant isolation against the vendor’s actual architecture and promised controls, with layered evidence and explicit acceptance conditions for remaining gaps.
For CISOs
177checklist
How to set least-privilege Git provider permissions for scanners
Set scanner Git-provider permissions around selected repositories, job scope and token renewal, preserving authorization checks when credentials expire or issuance fails.
For Platform engineers
178checklist
How to review support access to sensitive findings
Review support access to sensitive findings using time-bounded grants, visible evidence and revocation semantics, then close retained copies and require a fresh grant.
For Security leaders
179template
How to explain model retention settings to procurement
Explain model retention settings to procurement by separating provider policies, invocation logs and product copies, with configuration-specific evidence and limits.
For Privacy counsels
180workflow
How to design a security-tool pilot without sharing all repositories
Design a security-tool pilot with a narrow source packet, scoped access and a bounded review budget, measuring useful decisions without requiring a newly found bug.
For CTOs
19 / 10
Reporting
Explain findings, remediation and uncertainty with traceable evidence and metrics that support decisions.
181pillar
How to report application security risk to a CEO
Report application security risk to a CEO through the decision, affected business workflow and actual response capacity, with explicit assumptions and unresolved gaps.
For Security leaders
182template
How to turn findings into a one-page risk update
Turn findings into a one-page risk update with a reconciled open-item ledger, evidence-based dispositions and timely operational changes separated from period totals.
For Security leaders
183measurement guide
Which AppSec metrics show progress without hiding gaps
Choose AppSec metrics that expose review, policy and repair bottlenecks, with stable populations, honest small-cohort comparisons and accountable follow-up decisions.
For Security leaders
184measurement guide
How to report remediation progress without counting quiet scans as fixes
Report remediation through positive changed-revision evidence and deployment closure, separating repaired defects, corrected scope and unmeasured risk reduction.
For AppSec leads
185template
How to explain practical exploit difficulty to a nontechnical buyer
Explain practical exploit difficulty through necessary conditions, controls and missing evidence, without presenting a score as the buyer’s probability of compromise.
For Security leaders
186template
How to present security coverage and uncertainty together
Present security coverage alongside uncertainty using separate scope, progress and outcome fields, with clear denominators and honest attribution of review work.
For Security leaders
187measurement guide
How to track mean time to remediate without distorting incentives
Track time to remediate with explicit start and closure evidence, distinguish active work from operational waiting and avoid incentives that hide unresolved defects.
For AppSec leads
188checklist
How to prepare evidence for a customer security questionnaire
Prepare customer questionnaire answers from versioned evidence and precise scope, preserving submitted claims and distinguishing corrections from later product changes.
For Security leaders
189template
How to brief a board on a critical application vulnerability
Brief a board on a critical application vulnerability with decisions, containment, repair status and investigation limits, then define when special updates can end.
For Security leaders
190measurement guide
How to compare open risk across repositories fairly
Compare open risk across repositories using exposure, controls and capacity, keeping accepted risk visible and assigning shared-defect repair work to each consumer.
For AppSec leads
20 / 10
Buying decisions
Compare security tools with a bounded pilot, fair evidence, realistic costs and a decision record.
191pillar
How to evaluate an application security scanner in a two-week pilot
Evaluate an application security scanner in two weeks using common cases, hard gates and observed reviewer effort, with clear exclusions and a bounded buying decision.
For CTOs
192checklist
What to ask in an AI code scanning vendor demo
Challenge an AI scanning vendor demo with source evidence, countercontrols, partial runs and fix reassessment, then turn unanswered questions into finite follow-ups.
For AppSec leads
193decision guide
How to compare SAST tools beyond the number of findings
Compare SAST tools through supported claims, counterevidence and reviewer effort, rather than raw findings, while keeping common scope and unresolved cases visible.
For Security leaders
194decision guide
How to choose between a platform and a focused code security tool
Choose a security platform or focused tool using the work each removes, ongoing coordination cost and a transition plan that preserves ownership and issue history.
For CTOs
195measurement guide
How to calculate the real cost of scanner alert noise
Calculate scanner alert-noise cost from observed activities, distinguish avoidable effort from setup and maintenance, and evaluate when an improvement pays back.
For Security leaders
196checklist
How to validate a vendor's vulnerability verification claims
Validate vulnerability-verification claims against the evidence the vendor actually supplies, distinguishing candidate discovery, source support and runtime results.
For AppSec leads
197checklist
How to compare scanner coverage across languages and frameworks
Compare scanner coverage with versioned language and framework cases, including safe controls, missing context and a plan to revisit changed application abstractions.
For Platform engineers
198checklist
How to evaluate regional data handling in a security pilot
Evaluate regional data handling in a security pilot through exact routes, logs, backups and support access, then reconcile configuration changes and retained copies.
For Privacy counsels
199decision guide
When an external pentest is still necessary after code scanning
Decide when scanning needs an external pentest or targeted runtime assessment, using an explicit scope, synthetic identities and retest evidence tied to the release.
For CTOs
200template
How to write a decision memo after a security-tool pilot
Write a security-tool pilot decision memo with hard gates, observed evidence, cost limits and dissent, then preserve scope and commitments through rollout checkpoints.
For Security leaders
Start with an alert. End with a decision someone can verify.See the product