Why Modern Software Teams Need Both SAST and DAST in Their CI/CD Pipeline

·1 views

Software teams that deploy code without structured security testing risk critical bugs and data leaks, especially under pressure to ship features rapidly. SAST (Static Application Security Testing) analyzes source code before execution to detect vulnerabilities like SQL injection and exposed secrets, while DAST (Dynamic Application Security Testing) attacks a running application to uncover runtime flaws such as XSS and authentication failures. The two tools serve distinct, complementary roles and should not be treated as interchangeable. A recommended pipeline integrates SAST at the commit stage, Software Composition Analysis during the build, and DAST against a dedicated staging environment before any production release. Structuring security checks at each phase of the development lifecycle significantly reduces the cost and risk of fixing vulnerabilities late in the process.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Multita unified traffic fine data from 33 Argentine government systems

Multita, an Argentine platform for querying traffic fines, integrates data from over 33 official government systems that each return information in different formats, including HTML, JSON, and PDF. The core challenge was inconsistent representations of the same data, such as varying date formats and different labels for payment status across portals. The team solved this by defining a single output schema and building one adapter per data source, keeping all format-translation logic isolated from the business layer. This architecture means that when a source portal changes its structure, only the relevant adapter file needs updating, not the broader system. The article recommends that developers working with multiple uncontrolled data sources define their output format before writing the first scraper to avoid compounding technical debt.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SAG Uses SQL JOINs for Multi-Hop RAG Retrieval, Ditching PageRank Decay

Zleap-AI has released SAG (Structured Agentic Graph), an open-source multi-hop retrieval-augmented generation framework that replaces traditional PageRank-based graph traversal with SQL JOIN operations. Unlike GraphRAG and HippoRAG, SAG does not require expensive offline global graph construction, instead building event-entity relationships at query time using relational database foreign keys. Each document chunk is converted into one semantic event linked to multiple named entities, enabling deterministic and traceable multi-hop reasoning without score decay over long chains. The system is built on a TypeScript, PostgreSQL, and pgvector stack, and includes a built-in MCP server so each project can be exposed as an agent-callable tool. SAG has garnered over 1,900 GitHub stars since its release and is backed by an arXiv paper (2606.15971) under an MIT license.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Actions to Tekton: A Developer's Guide to CI/CD Testing Tools

A comparative guide published on DEV Community evaluates nine popular CI/CD and test management platforms, including GitHub Actions, GitLab CI/CD, Jenkins, CircleCI, and Harness. The guide aims to help developers choose the right tool by highlighting each platform's key features, pricing models, and integration capabilities. Real-world YAML pipeline examples are provided for common use cases such as Node.js and Python application testing. Public repository references, including microsoft/vscode and facebook/react, are cited to illustrate how these tools are used in production environments. The core argument is that automated test execution reduces manual overhead, prevents bugs before code merges, and standardizes testing across environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Swipe Cleaner Processes Photos Entirely On-Device Using Apple's Core ML

Swipe Cleaner, built by the Nomos team, performs all photo analysis locally on the user's device rather than uploading images to remote servers. The app uses Apple's Core ML framework and the iPhone's Neural Engine to run lightweight ML models — kept under 50MB through quantization and architecture optimization. To handle large photo libraries without performance issues, the app processes images in batches of 50 and caches results locally via Core Data. The developers argue that on-device processing offers a structural privacy guarantee, since no photo upload pipeline was ever built into the app. The trade-off is that model improvements require full app updates, unlike cloud-based systems that can refresh models silently.

0 comments Read more at DEV Community