Catch Me If You can : Continuous Delivery vs. Security Assurance
summary
Claims that heavy commercial AST/data‑flow scanners are expensive, slow and brittle, and that a pragmatic stack of simple checks plus framework constraints catches the real problems without blocking delivery. Demonstrates finding a directory‑traversal pattern (download_file(path)) across merge requests, compares grep/regex, AST checks (Bandit), commercial data‑flow engines and Semgrep, shows rules that block MRs and trigger alerts, notes data-flow analysis can find cross-file flows but is costly, and argues for secure-by-default frameworks (e.g. Angular protections) plus Semgrep autofix as a working, fast compromise.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:34What this talk is about
- 4:52Why static analysis
- 6:18Problem explanation
- 9:51Success criteria
- 11:26Easybased analysis
- 14:27Limitations
- 16:35Example
- 18:29Cons
- 27:37insecure code
- 30:18the future
related talks
39mPractical Static Analysis for Continuous Application Security
36mScratching the Surface of your CD?
26mSecurity Automation For GraphQL
40mDesign Approaches for Security Automation
39mSecurity Tooling in Your DevOps Pipeline
21mAdding DAST to CI/CD, Without Any Losing Friends
33mBattle Tested Application Security
37mA Secure Continuous Delivery Pipeline