Automated Rapid7 reports with python
This blog post describes how to collect information from a popular DAST platform, create a simple report and share it with development teams using a popular collaboration platform like Slack.
AppSec
Detect open source vulnerabilities in Gradle projects with Github actions
Software Composition Analysis (SCA) is the automated process of analyzing libraries and open source software with the aim of identifying publicly disclosed vulnerabilities, as well as license usage for compliance reasons.
Detect hardcoded secrets using Github actions
Production passwords, tokens, AWS credentials and other types of secrets should be kept confidential and away from preying eyes of hackers or malicious insiders. In simple terms, no one should know production passwords for databases, admin passwords, AWS credentials etc unless there are legitimate business reasons that mandate to do so. Therefore, keeping these secrets hard-coded in Github repositories must be strictly prohibited.
Github GraphQL for AppSec metrics
GraphQL is a powerful way of interacting with an API to fetch a data object containing all, or at least most information that you need. It resembles REST in the way it works, but it's more powerful and faster. Instead of using multiple requests to query the server for different pieces of data that need to be stitched together, GraphQL allows to fetch a single custom defined object with a single call.
Security? I develop an internal application!
More often that I wish, I need to talk about application security with people who are really sceptical about my role as an application security professional. They behave like it is a waste of time to talk security with me and they would rather go about their regular business. But the most usual and frustrating argument I get is that their application is intended for internal use only, or even worse "trusted parties identified by strong authentication" will be using it.