Category
Application Security
The bug is still in the code you ship. Encode the sink, check the object, name the finding in the PR. A WAF is not this pillar. Open a shortlist for the buy you are making.
XSS defenses
We split XSS defenses by encoding the sink, then Trusted Types. A WAF is time you bought, not this list.
Shortlists
SAST tools
We split SAST by whether the finding names the sink in the PR. A PDF dump is not a review.
Shortlists
DAST tools
We split DAST by poking the app you already run. A source scanner is a different list.
Shortlists
Secret scanning
We split secret scanners by whether they catch the next leaked key. A vault is Identity.
ShortlistsAuthorization libraries
We split authz libraries by the object check in the handler. A role name on a badge is not enough.
More categories
Questions about Application Security
Is a WAF an application-security control?
A WAF can buy time. It is not a substitute for encoding the response or checking the object id. WAF lives under Web Security.
Does a scanner replace authorization?
No. A finding is a ticket. The object check is in the handler you ship.
Where do API fuzzers sit?
Contract lint and fuzz live under API Security. This pillar is the app you compile.
