Running code analysis

Part of your security approach should be source code analysis, which can identify security issues before the application is even run. This is a form of static testing, as described in Chapter 6, White-Box Functional Testing. Like linting, this automatic check can detect potential security issues such as being vulnerable to SQL injection attacks or buffer overflows.

Many tools are available for such analysis, and the development team should ensure they run one before the code reaches the test team.

Such tools are easy to run and can be built into deployment pipelines to check each code change. However, they can flag false positive results, and it can be challenging to uncover some classes of vulnerability, such as authentication or access control. They also can’t find configuration issues, as they only examine the code rather than how it is deployed.

Despite its weaknesses, code analysis can quickly find important classes of bugs and is a necessary...