The Qwiet Blog
Time to Value: Why Real-Time Scanning Isn’t Worth the Tradeoff
Key Takeaways While promising immediate feedback, real-time scanning often creates ‘noise’ without context. This ‘noise’ refers to the excessive and irrelevant alerts that tools running in the IDE or pre-save phase can generate. These tools may flag unreachable or non-exploitable code, leading to alert fatigue and dev pushback. CI/CD scanning, with its promise of higher […]
READ MORE
Filter by
API Security 101: Improper Assets Management
On March 21, the Biden administration directed US companies to "harden your cyber defenses immediately." With these new federal guidelines for application security, the White House urged software developers to deploy "modern tools that can detect known and potential vulnerabilities" in their custom and open-source software (OSS). Learn more about how ShiftLeft can help.
The Cybersecurity Executive Order: the first 120...
Improper Restriction of XML External Entity Reference When the Executive Order on Improving the Nation’s Cybersecurity (Executive Order) was released in May 2021, it came with some very short deadlines for agencies. Most of the Executive Order’s timelines were in the 45-, 60-, and 90-day range. With that in mind, taking a look at the […]
The first step to build a secure...
What every developer should do before they start writing code I talk a lot about finding and fixing vulnerabilities on my blog. But what can you do to prevent vulnerabilities way before they happen? Today, let’s talk about the first step you can take towards a more secure application. A lot of times we think […]
What is Stored XSS?
On March 21, the Biden administration directed US companies to "harden your cyber defenses immediately." With these new federal guidelines for application security, the White House urged software developers to deploy "modern tools that can detect known and potential vulnerabilities" in their custom and open-source software (OSS). Learn more about how ShiftLeft can help.
API Security 101: Injection
How SQL injection and command injection happen in APIs You’ve probably heard of the OWASP top ten or the top ten vulnerabilities that threaten web applications. OWASP also periodically selects a list of top ten vulnerabilities that threaten APIs, called the OWASP API top ten. The current API top ten are Broken Object Level Authorization, […]
