Software Supply Chain
Every dependency, GitHub Action, and container base image a pipeline pulls in is a trust decision. This covers dependency review practices, artifact pinning and signing, SBOM generation, and the MITRE ATT&CK supply-chain technique these controls actually defend against.
T1195.001Compromise Software Dependencies and Development Tools — the specific sub-technique dependency pinning and SBOM practices defend againstRelated Resources
Repository Security Scanner
Scan GitHub and GitLab repositories for hardcoded secrets, sensitive files, SAST vulnerabilities, and dependency CVEs — OWASP-mapped, OSV-backed.
CI/CD Security Scanner
Run repository and dependency security scans automatically in GitHub Actions and GitLab CI — catch secrets, CVEs, and SAST findings before they merge.
Go Deeper in the Reference Database
T1476: Deliver Malicious App via Other Means
An adversary technique for distributing a malicious or trojanized application outside of an authorized app store.
CWE-1104: Use of Unmaintained Third-Party Components
A weakness from depending on a third-party component that is no longer actively maintained or supported.
CWE-798: Use of Hard-coded Credentials
A weakness where software contains a hardcoded credential (password, key, or token) used for authentication or encryption.
CISA Known Exploited Vulnerabilities
An educational overview of CISA's Known Exploited Vulnerabilities catalog and the BOD 22-01 federal remediation mandate.
Other Categories
Mobile Application Security
Static and dynamic analysis of Android and iOS applications, and the OWASP Mobile Top 10 framework findings map to.
Repository Security
Secret detection, dependency review, SAST patterns, and the access-control practices that keep a codebase auditable.
CI/CD Security
Pipeline trust boundaries, branch protection, artifact integrity, and deployment gating for GitHub Actions and GitLab CI.
Secure SDLC
Treating security requirements as a design constraint from the start, not a review gate at the end.
Vulnerability Management
Turning raw findings into a prioritized, trackable backlog — beyond what a severity score alone can tell you.
Reverse Engineering
Manual analysis of compiled binaries — the toolchain and reasoning static analysis automates a subset of.
Engineering Leadership
Making application security legible to the people who manage teams and answer for organizational risk.