A pentester at a DEF CON meetup told me to skip the fancy SAST tool and just grep the codebase first

Phoenix Thompson · 2026-10-23T08:55:03.537615+00:00

I thought he was full of it, but running simple pattern searches on our repo caught two hardcoded API keys in 20 minutes that the paid scanner missed for months. Is there a good writeup on doing this the right way without drowning in false positives?

SMM Buzz

Loading…

A pentester at a DEF CON meetup told me to skip the fancy SAST tool and just grep the codebase first | Appsec Tools - SMM Buzz