{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Tech Stories Tech Brief By HackerNoon","title":"What 200 SAST Triage Sessions Taught Me About Application Security","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/7748e23e\"></iframe>","width":"100%","height":180,"duration":963,"description":"\n        This story was originally published on HackerNoon at: https://hackernoon.com/what-200-sast-triage-sessions-taught-me-about-application-security.\nLessons from 200 SAST triages on false positives, operational risk, scan scope, pull-request gating, and what static analysis misses.\nCheck more stories related to tech-stories at: https://hackernoon.com/c/tech-stories.\n            You can also check exclusive content about #sast, #application-security, #security-triage, #vulnerability-management, #secure-cicd, #pull-request-scanning, #security-tooling, #threat-modeling,  and more.\nThis story was written by: @sgantikota. Learn more about this writer by checking @sgantikota's about page,\n            and for more stories, please visit hackernoon.com.\nThe author argues that roughly 95% of SAST findings encountered across years of production triage were repetitive false positives, low-risk issues, or findings outside the deployed application. The valuable work lived in the smaller set of externally reachable authorization flaws, direct object references, cryptographic mistakes, injection vulnerabilities, and information leaks.\n        \n        ","thumbnail_url":"https://img.transistorcdn.com/IuqXIpaNNuezY7jNfIDnL5gqB1iL_SEndwUUzLGdljY/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9zaG93/LzQxNDI5LzE2ODM1/ODM0NjQtYXJ0d29y/ay5qcGc.webp","thumbnail_width":300,"thumbnail_height":300}