2 ms·
> It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. Write th
by q-big 4y ago
> It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans.
Write the source code in some Assembler language (or even binary code ;-) ). Or use some obscure programming language that the vendor cannot scan, thus having a reason not to upload it.
- Mountain_Skies 4y agoIn case you weren't being tongue in cheek, the purpose of the scan is to find security vulnerabilities so they can be rectified. If the scan cannot understand the code, it can't find the vulns that need remediation. Unfortunately, you don't even need to pick an obscure language. Almost all vendors of SAST products are chronically behind schedule on supporting the latest versions of languages and frameworks, and some of the biggest names have significant gaps in which commonly used languages they support.