Continuous Security Testing for Small Teams: What to Test, How Often, and Who Owns It
Small teams rarely have a security department. They have a few developers, maybe a team lead, and sometimes an MSP that looks after the infrastructu…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
AI Hooks for Claude Code, Cursor, and Codex: Block Secrets Before Agents Can Use Them
TL;DR Instructions are suggestions, not controls : Prompts, AGENTS.md, and CLAUDE.md files only guide an agent, which can reinterpret or route aroun…
GSC: A Self-Learning SAST That Proves Vulnerabilities, Fixes Them, and Learns From Your Feedback
TL;DR — GSC (Git Security Checker) is a self-learning AppSec platform that doesn't stop at detecting a vulnerability. It proves it with a sandboxed…
MITRE ATT&CK для Product Security: как связать pentest, threat modeling, CI/CD и реальные сценарии атак
Матрицу MITRE ATT&CK обычно ассоциируют с SOC, threat hunting и red team. Это база. Но она может быть полезна намного раньше — на этапе threat m…
DevSecOps Automation II: A Deep Dive into DAST
In the first part of this series , we looked at Static Application Security Testing (SAST) — scanning source code without executing the application;…
CVSS, EPSS and KEV: how to actually prioritize dependency vulnerabilities
Every week a dependency scanner finds dozens of vulnerabilities. Every week most developers ignore them, because there's no time to fix 200 issues a…
AI Agents vs Traditional Automation: What's Actually Different for Security
The real security difference between an AI agent and traditional automation is not "smart vs dumb". It is where control over execution lives : in co…
Поиски «швейцарского ножа» или Обзор инструментов моделирования угроз
Привет, Хабр! Меня зовут Антон Станкевичус, я старший специалист по тестированию безопасности программного обеспечения в компании «Гарда». Моделиров…
The AI Race Has a Missing Question: Can We Explain What Our Agents Already Did?
The public conversation around advanced AI often collapses into two positions. One side says we should slow down. The other says progress is inevita…
Agentic AI Security: Credentials and Permissions Define the Blast Radius
Agentic AI Security: Credentials and Permissions Define the Blast Radius Prompt injection can't be patched away. Three 2026 agentic AI incidents sho…
Harden & Lockdown RKE2 Cluster with a 4-Layer DevSecOps Stack
Introduction Before you move furniture into a new house, you install the locks, the cameras, and the gates. Kubernetes is no different, yet engineer…
`gh attestation verify` said yes to an image we never released
The four questions, and the one nobody asks Pulling a container image somebody else built asks four separate questions. Most people answer three of…
Building a "Fail-Closed" Zero-Trust CI/CD Protocol: A Personal Open-Source Experiment
Hello, Dev community! 👋 I am Anjo Machina (安城巻那), a QA engineer based in Japan. I want to share an open-source project I have been building. It is a…
Кто взломает ваш пайплайн? Моделирование угроз, о которых все забывают. Часть 1
Представьте, что вы построили неприступную крепость. Стены из титана, рвы с акулами, а стража проходит проверку на полиграфе. Звучит надежно? Да. То…
Beyond free-roaming Agents: Architecting a Deterministic 4-node Graph pipeline for zero-false-positive Autonomous VAPT
Beyond Free-Roaming Agents: Architecting a Deterministic 4-Node Graph Pipeline for Zero-False-Positive Autonomous VAPT Every AppSec engineer eventua…
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner (2026 Benchmark)
drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner Benchmarked on 500+ web3 repositories. Generic scanners miss 73% of web3-…
Как взрослеет DevOps на потоке: от информирующих сканов к risk-based gate'ам
Привет, Хабр! На связи Илья Виссарионов, директор департамента «Аппаратно‑системная платформа» компании «Диасофт». Про DevSecOps написаны тон…
Кaк внeдpить cтaтичecкий aнaлиз: пpaктичecкий aлгopитм для мeнeджepoв
Cтaтичecкий aнaлиз кoдa дaвнo пepecтaл быть инcтpyмeнтoм иcключитeльнo для paзpaбoтчикoв. Для pyкoвoдитeлeй пpoдyктoв, тexничecкиx диpeктopoв и кoмa…
Building a Read-Only Cloudflare Worker AI Security Console
Why build this Security teams already have WAF events, bot signals, access logs, and SIEM pipelines. The problem is not always data collection. The…
Where the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT Pipeline
Every VAPT report ends the same way: a handful of numbers. A CVSS score. A severity label. A priority rank. Sometimes an aggregate risk score. Those…
Can Copilot Fix Its Own Security Findings? Testing GitHub Agentic Autofix
Can Copilot Fix Its Own Security Findings? Testing GitHub Agentic Autofix GitHub can now assign a code scanning alert directly to Copilot cloud agen…
Как одна забытая зависимость уронила прод и привела к появлению Dependency Validator
Привет, Хабр. Я Матвей Лихота, старший Go-разработчик и DevSecOps. Как это часто бывает с внутренними инструментами, идея этой утилиты появилась уже…
🛡️ Vulnerability Math: CVE vs. CVSS vs. EPSS
Ever wonder why some "Critical" bugs aren't fixed immediately? It’s all about Impact vs. Urgency . Think of a Broken Lock on your front door: CVE (T…
Proof-of-Fix in GSC: An Architecture for Provable Vulnerability Remediation Verification
Abstract GSC is a self-learning AppSec platform implementing the full pipeline detect → prove → fix → verify → heal → predict . Its defining feature…
How to Build an Audit-Ready CloudTrail and Config Baseline
An auditor asks: "Show who disabled logging in production last quarter." You open three accounts, find CloudTrail off in one, logs scattered in loca…
Turn Trivy SBOM and SARIF output into versioned release evidence
Security tools already generate useful evidence. The problem at release time is often not another scan. It is proving which SBOM, test run, security…
От Security Champion к инженерной культуре безопасности: как мы изменили подход к DevSecOps
Модель Security Champion многим кажется очевидной: если внутри команды появляется человек, который смотрит на продукт еще и с точки зрения безопасно…
Confronting Vault Sprawl And The Risks It Brings
Modern enterprises do not set out to create a maze of credentials, keys, and secrets stores. However, this is the reality most organizations find th…
Why Cursor Keeps Generating Wildcard CORS Headers in Your API
TL;DR AI editors keep generating CORS middleware that reflects the request's Origin header back verbatim while also allowing credentials, so any sit…