Security Automation For GraphQL
summary
Advocates shifting security left and automating detection across SAST, SCA and DAST, showing concrete tools and results: semgrep (127 files, 1,600 rules) finds hardcoded credentials and broken regexes that enable DoS, TruffleHog hunts secrets, Snyk/Dependabot flag vulnerable dependencies, and crackql brute-force success demonstrates credential and authorization failures. Recommends pre/post-commit or IDE hooks, CI blocking vs non-blocking scans, cataloging legacy findings, and an orchestration script that toggles noisy tools, deduplicates reports, and routes results for triage and developer training.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 1:49Why automate GraphQL security
- 3:57Three lenses for security testing
- 5:44Popular GraphQL security tools
- 9:53Pre-release testing strategies
- 12:18Demo: Semgrep scanning
- 15:21Demo: CrackQL brute-forcing
- 16:24Implementing effective automation
- 19:38Managing tool results and feedback
- 21:47Orchestration and tool integration
- 24:37Recap and key takeaways
- 25:00Q&A and contact information
related talks
09mGraphQL Security Testing Automation for Developers
39mSecurity Tooling in Your DevOps Pipeline
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
57mShift Left Security with the Security Test Pyramid
44mSecurity Practices Useful in Agile Development
20mAdvanced GraphQL Security with AI-Driven Threat Detection
31mFrom Noise to Notes: Orchestrating SAST with Developers... (Adrián Puente Z.)