AppSec Testing: SAST, DAST, and Manual Review

• No single tool class sees everything: SAST sees source, DAST sees behavior, SCA sees libraries, and humans see business logic flaws.
• Each layer catches what the previous missed — and misses what the next one equals.
• Knowing the strengths (and blind spots) of each layer is what separates a test report from a security program.

The manual finds the typo'd spec, the drive finds the vibration, and the mechanic finds the wear the manual never predicted.

• SAST parses your code and flags patterns (concatenated SQL, eval, hardcoded secrets) without running anything.
• DAST probes a running build with payloads (injections, path traversal, tampered tokens) exactly the way a scanner-based test would.
• SCA inventories dependencies, checks the SBOM against CVE databases, and alerts on reachable vulnerable versions.
• Manual review handles what the tools cannot: business-logic authorization, global state, and multi-step flows.

• A SaaS runs SAST on push and DAST on the nightly staging build, feeding a single triage board with dedup.
• A fintech's CVE triage weights reachability: a vulnerable lib unreachable from any route gets an SLO, not a panic.
• An e-commerce team schedules a manual two-account authorization review after every major refactor — the class SAST can't see.

• Wire the layers into CI so results land in the developer's normal loop, not a side-console.
• Triage by reachability and exploitability, not raw count: dedupe, then rank by 'can a user actually hit this'.
• Baseline your tool's false-positive rate once per quarter so the queue stays believable.
• Fixa finding once by root cause (library upgrade, query refactor), not by suppressing the rule.

• Buying a box of tools and piping untriaged alerts straight to devs — alert fatigue kills the program.
• Treating DAST throughput as proof: dynamic scans cannot cover auth-gated or logic-tier bugs.
• Ignoring the SBOM until a Log4j moment, then scanning a year of releases in a panic.
• Suppressing a rule because it's noisy without ever investigating the class behind the noise.

• When SAST and DAST disagree, reproduce the path manually with a minimal curl — the resolution is the finding.
• Give each finding a repro trail: the exact diff, the payload, the route — a finding without a repro is a dossier.
• Track 'findings per category vs time' so you see systemic fixes, not whack-a-mole.

• DAST against staging is fine with your own accounts; DAST against production with real user data is a different (risky) animal.
• SCA hashes and CVE matches are evidence; keep them in the artifact so a year later you can answer 'were we exposed'.
• Human reviewers sign off on auth decisions; a review that 'passed' a logic flaw is a process gap to fix, not a blame car to park.