Search
30 results for “sast”
Search results
What is the difference between SAST, SCA, and DAST, and where does each run in a pipeline?
SAST (static application security testing) analyzes an application's own source code without running it, catching issues like injection-prone patterns early in the build stage, before an artifact even exists. SCA (software composition analysis) scans a project's third-party dependencies against known-vulnerability databases, since most of a modern application's code is dependencies, not code the team wrote itself. DAST (dynamic application security testing) tests a running instance of the application from the outside, the way an attacker would, and so it runs later, typically against a deployed staging environment, after the artifact exists and is running somewhere.
Secure CI/CD Pipelines
How SAST, dependency (SCA) scanning, and DAST fit into a build pipeline as automated gates, and why failing the build on a real finding is what actually makes "shift-left" more than a slogan.
According to OWASP SAMM, what should happen at the highest maturity level when a security check fails during the build?
At the highest build-process maturity level, organizations define mandatory security checks and ensure that building a non-compliant artifact actually fails, the pipeline is configured to stop, not just record a finding for someone to look at later. This is the difference between security scanning that genuinely gates what gets shipped and scanning that only produces a report nobody acts on; a finding that doesn't block the build in practice functions as a suggestion, not a control.
Why does OWASP SAMM recommend treating third-party dependencies with the same security rigor as internal code?
Modern applications are typically built from far more third-party dependency code than code the team actually wrote, so a security process that only scrutinizes internal code is scrutinizing a small fraction of what actually ships. SAMM's guidance moves from simply maintaining a Bill of Materials, to actively evaluating dependencies and responding to known risks, to applying the same rigorous analysis given to internal code, precisely because a vulnerable dependency is exploitable in production exactly like a vulnerability the team wrote themselves, regardless of who authored the code.
What is the difference between locally redundant storage (LRS), zone-redundant storage (ZRS), and geo-redundant storage (GRS)?
LRS replicates data three times within a single datacenter; it protects against hardware failure but not a datacenter-level outage. ZRS replicates synchronously across three availability zones within one region, protecting against a single datacenter failure while keeping data within the region. GRS replicates asynchronously to a second, geographically distant region on top of LRS in the primary region, protecting against a regional disaster at the cost of the secondary copy lagging slightly behind (eventual, not synchronous, consistency) and being unreadable by default unless read access is explicitly enabled (RA-GRS).
Securing Azure Blob Storage with PowerShell: Network Isolation, SAS Access & Immutable Policies (Beginner to Pro)
A hands-on lab automating secure Azure Blob Storage using VNets, subnets, SAS tokens, and immutability.
What's the practical difference between Repeatable Read and Serializable, given that PostgreSQL's Repeatable Read already prevents phantom reads?
PostgreSQL's Repeatable Read goes beyond the SQL standard's minimum and already prevents phantom reads via snapshot isolation, but it can still allow a specific class of anomaly called a serialization anomaly, where the combined effect of several concurrently-committed transactions is not equivalent to any possible serial (one-at-a-time) ordering of them, even though each transaction individually looks consistent. Serializable adds predicate locking on top of snapshot isolation specifically to detect and prevent that remaining anomaly, guaranteeing that the outcome is always equivalent to transactions having run one at a time in some order. The cost is the same as Repeatable Read's, more serialization failures the application must retry, in exchange for the strongest correctness guarantee available.
Why would you shorten an embedding from 1536 dimensions to 256, and what do you give up by doing it?
Fewer dimensions means less storage per vector and faster similarity computation at query time, which matters directly at scale, a vector database holding millions of embeddings pays that storage and compute cost on every one of them. Modern embedding models are specifically trained to support this trade-off gracefully: a newer model shortened to 256 dimensions can still outperform an older, unshortened model at 1536 dimensions, so shortening isn't simply "less accurate," it's a deliberate trade against a specific model's own accuracy ceiling. What you give up is some of that ceiling, the shortened embedding is measurably less precise than the same model's full-length embedding, which is why the right dimension count depends on how much accuracy a specific use case can actually trade away.
Why does explicitly telling a model it's allowed to say "I don't know" measurably reduce hallucination, and what's a second, complementary technique for the same problem?
Without that explicit permission, a model under an implicit expectation to always produce a confident, complete answer will sometimes fill a real information gap with a plausible-sounding but fabricated one; stating outright that uncertainty is an acceptable answer removes that pressure and lets the model surface "I don't have enough information" instead of guessing. A complementary technique for long documents is asking the model to first extract direct, word-for-word quotes relevant to the task before generating any analysis, grounding its response in verifiable text it actually has in front of it, and then citing which quote supports each claim, rather than generating an answer freely and hoping it stayed faithful to the source.
What problem does a tool like Poetry or uv solve that pip and venv alone do not?
pip installs packages and venv creates isolated environments, but neither one manages the two together as a single reproducible workflow, nor do they resolve and lock a full dependency tree (including transitive dependencies) automatically. Tools like Poetry and uv combine environment creation, dependency resolution, lockfile generation, and package building into one workflow, similar to how npm or cargo work in other ecosystems, removing the manual, error-prone process of keeping a requirements file, a lockfile, and an environment all consistent with each other by hand.
A client sends a sudden spike of requests that exceeds the configured rate, but the API doesn't immediately reject any of them. Why not, and when does rejection actually start?
The token bucket has accumulated capacity up to the burst limit, if the client had been under the rate limit recently, unused tokens built up in the bucket, and that reserve absorbs a short spike without any request failing, exactly the point of separating burst capacity from steady-state rate. Rejection (a 429 response) only starts once the bucket is actually empty, every accumulated token has been consumed and the spike is sustained long enough that the rate of token consumption keeps exceeding the rate of token replenishment. This is why a token bucket, unlike a hard per-second cap, tolerates brief bursts gracefully while still enforcing a real steady-state ceiling.
Why would a system use a sliding window rate limiter instead of a token bucket, and what problem does it fix?
A naive fixed window (say, "100 requests per minute, resetting on the minute") allows a client to send 100 requests in the last second of one window and another 100 in the first second of the next, 200 requests in a two-second span despite the stated 100/minute limit, an artifact of the window boundary rather than actual demand. A sliding window rate limiter instead evaluates the limit over a continuously moving time range rather than fixed, discrete buckets, which avoids that boundary-doubling effect at the cost of typically more state to track (timestamps of recent requests, not just a single counter) compared to a token bucket's simpler accumulator model.
Why does a chunk like "The company's revenue grew by 3% over the previous quarter" cause a retrieval failure even if it's embedded correctly?
That sentence is only meaningful with context the isolated chunk doesn't carry, which company, which quarter, information that likely lived in a heading or preceding paragraph that didn't survive the chunking boundary. Embedded on its own, the chunk's vector represents a generic, context-free statement about revenue growth, which means it won't be retrieved reliably for a query about "ACME Corp Q2 2023 earnings" even though it's exactly the right chunk, because nothing in its embedding actually encodes that it's about ACME Corp or Q2 2023 at all.
What does a service mesh add on top of what Kubernetes Services already provide?
A Kubernetes Service provides basic load-balanced routing to a set of Pods by label selector, that's it. A service mesh intercepts every request in and out of a Pod (via a sidecar proxy) to add a uniform layer of capabilities across all services without changing application code: mutual TLS encryption between services, fine-grained traffic control (canary percentages, retries, timeouts, circuit breaking), and rich per-request observability (latency, error rate, and request volume between every pair of services). Services give you connectivity; a mesh gives you control and visibility over that connectivity.
MongoDB can be configured to behave more like a CP system or more like an AP system. What settings make that choice, and what are they actually trading?
Write concern and read preference are the actual levers: a write concern requiring acknowledgment from a majority of replicas favors consistency, a write isn't considered successful until enough nodes agree, at the cost of availability if too many nodes are unreachable during a partition. A looser write concern, or reading from secondaries that might lag behind the primary, favors availability, operations keep succeeding even when full replica agreement isn't achievable, at the cost of potentially reading or acknowledging data that isn't fully consistent across the cluster yet. This is exactly the CP-versus-AP trade-off CAP describes, expressed as a concrete, tunable configuration rather than an abstract theorem.
Given a setTimeout(fn, 0) and a Promise.resolve().then(fn) registered in that order, which one runs first, and why?
The Promise callback runs first, even though the timeout was registered with a 0ms delay and appears to ask for the soonest possible execution. `setTimeout` queues a macrotask (a "task" in spec terms), while a Promise callback queues a microtask, and the event loop's rule is that the entire microtask queue is drained completely before the next macrotask is even pulled, regardless of registration order or the timeout value. A 0ms delay doesn't mean "immediately", it means "as the next task once the microtask queue is empty and the current call stack has finished."
What is the difference between a client tool and a server tool, and why does that distinction matter for what your application has to do?
A client tool executes in your own application, the model only returns the structured request to call it; your code is responsible for actually running it (hitting your database, calling your API) and returning the result. A server tool, like a web search or code execution tool a provider offers, executes on the provider's own infrastructure, so your application sees the final result directly without ever writing execution code for it. The distinction determines how much you have to build: every client tool needs your own execution and error-handling code, while server tools need none, just declaring them in the request.
Azure Web App Zero-Downtime Deployment: A Hands-On Guide to Deployment Slots, Auto Scaling, and Load Testing
A practical Azure App Service lab covering staging slots, slot swaps, autoscaling, and traffic testing.
How to Set Up a Secure Point-to-Site VPN in Azure
A Hands-On Azure Networking Lab: Virtual Networks, VPN Gateway, and Certificate Authentication.
How do access tiers (Hot, Cool, Archive) affect Blob Storage, and what do they not affect?
Access tiers change the cost trade-off between storage price and access/retrieval price: Hot has the highest storage cost but cheapest, immediate access; Cool has lower storage cost but a higher per-access cost and is meant for infrequently accessed data; Archive has the lowest storage cost but data must be rehydrated (a process taking hours) before it can be read at all. What tiers do not affect is durability, the redundancy option (LRS/ZRS/GRS) determines durability independently of which access tier a blob is in, so a Cool or Archive blob is exactly as durable as a Hot one with the same redundancy setting.
For the same graph, why might you choose DFS over BFS even though BFS finds shortest paths and DFS doesn't?
Shortest-path guarantees aren't always the goal, DFS is a natural fit for exhaustively exploring all possibilities along one path before trying another (backtracking problems, detecting cycles, topological sorting, finding connected components), where the actual requirement is "visit everything reachable" or "explore this branch fully before trying the next," not "find the closest thing first." DFS via recursion is also often simpler to implement for these problems, at the cost of consuming call-stack depth proportional to how deep the graph goes, which matters for very deep or very large graphs where an iterative approach (or BFS) avoids the recursion-depth risk entirely.
A client sends a payment request, the network times out before a response arrives, and the client retries with the same idempotency key. What actually happens on the server?
If the original request already completed (successfully or even with an error like a 500) before the retry arrives, the server returns the exact same result it returned (or would have returned) the first time, the same status code and response body, without re-executing the underlying operation, so the customer isn't charged twice just because the client never saw the first response. This is the entire point of an idempotency key: it lets a client safely retry an operation whose actual outcome it's genuinely uncertain about (did the first request even reach the server? did it complete before the timeout?) without that retry risking a duplicate side effect.
What problem does policy-as-code solve that a manual infrastructure change review does not?
A manual review depends on a human noticing a specific misconfiguration, an open security group, an unencrypted storage bucket, in a plan diff that may span hundreds of resources, and that scrutiny has to be repeated consistently by every reviewer on every change. Policy-as-code encodes the same rule once as executable logic and runs it automatically against every plan, so an overly permissive security group is caught the same way on the hundredth change as the first, without depending on which reviewer happened to be paying attention that day.
Why does sending SIGKILL to a stuck process work when SIGTERM doesn't, and what does that cost you?
SIGTERM asks a process to terminate but can be caught by a signal handler, letting the process run its own cleanup logic (closing files, flushing buffers, releasing locks) before actually exiting, or in a broken process, being caught and never acted on at all. SIGKILL cannot be caught, blocked, or ignored under any circumstances, the kernel terminates the process directly, which is why it works on a process SIGTERM couldn't reach. The cost is that none of that cleanup logic runs, a database connection isn't closed cleanly, a temp file isn't removed, a lock isn't released, so SIGKILL is a last resort after SIGTERM has been given a real chance to work, not a default first move.
Why would you add a second disk to an existing volume group instead of just creating a new, separate filesystem on it?
Adding a disk as a new physical volume to an existing volume group extends that VG's total capacity, which lets an existing logical volume (and the filesystem on it) be grown into the new space without unmounting it, moving data, or changing the mount point the rest of the system already depends on. Creating a second, separate filesystem on the new disk instead means the original filesystem is still capacity-constrained by its original disk, and anything needing more room has to be manually split or migrated across two independent mount points rather than one that simply grew.
What is a stale closure and how does it happen with useEffect?
A stale closure happens when a function captures a variable from a render that is no longer current, because the effect or callback was not re-created when that variable changed. Classic case: an effect with an empty dependency array reads a piece of state, since the effect only runs once, the function it closes over always sees the state value from the first render, not the latest one. The fix is to include the variable in the dependency array (or use a functional state update that does not need to read the outer value at all).
Why are environment variables considered a weaker place to store a secret than a dedicated secrets manager, even though they avoid hardcoding it in source?
Environment variables are readable by the entire process (and often child processes) they're set for, commonly get dumped into crash reports, debugging output, or `/proc` on Linux, and are easy to accidentally log in full, none of which requires a targeted attack, just an ordinary operational mistake. A dedicated secrets manager instead requires an authenticated, audited API call to retrieve a secret, can issue it as short-lived, and centralizes rotation and access logging in one place. Environment variables are a real improvement over hardcoding in source, but they are a stopgap, not the same security posture as centralized, audited secret retrieval.
What do WCAG's 4.5:1 and 3:1 contrast ratios each apply to, and why does the threshold change for large text?
WCAG 2.1's AA-level contrast requirement is 4.5:1 for normal text, text smaller than 18 point (or 14 point bold), and a relaxed 3:1 for large text at or above that size threshold. The reasoning given is that larger text with wider character strokes is inherently easier to read at lower contrast, so the stricter 4.5:1 ratio is reserved for the smaller, harder-to-read text where insufficient contrast is much more likely to genuinely block reading for people with low vision, color-vision deficiencies, or age-related contrast sensitivity loss. It is not an arbitrary aesthetic distinction, it is calibrated to actual legibility at different sizes.
How to Restrict USB and Removable Storage Devices using Group Policy in Active Directory
This lab documents a real world Group Policy implementation used to restrict USB drives, external hard drives, and all removable storage devices across domain joined systems in an Active Directory environment. The configuration addresses a critical security risk in modern on premises and hybrid env…
Sorting Algorithms & Stability
Why a "stable" sort guarantees equal-key elements keep their original relative order, and how Python's Timsort exploits already-sorted runs in real data to hit O(n) on the best case instead of always paying O(n log n).