Application security testing
Application security testing finds flaws in software before an attacker does. Our team combines manual testing of running applications with automated analysis of source code, dependencies, containers and secrets, so one review covers both what the code says and how the system behaves.
What we do
- Web application and API penetration tests inside a written scope
- Burp Suite Professional and OWASP ZAP testing, with manual checks for authorization and business-logic flaws
- Static analysis of source with Semgrep and CodeQL, with rules tuned to the codebase
- Container image, dependency and infrastructure-as-code scanning with Trivy
- Secret scanning of repositories and history with Gitleaks and TruffleHog
- Automated dependency updates with Dependabot or Renovate and a review process
- Pipeline checks that fail builds on agreed severities
- Findings written for engineers: reproduction, fix guidance and retest
Every test runs inside a written scope: named targets, agreed test windows, rules on data handling and a contact for stopping work. For web applications and APIs we use Burp Suite Professional and OWASP ZAP, with manual testing for the logic flaws that scanners miss. For code and build pipelines we have worked with Semgrep and CodeQL for static analysis, Trivy for container images and infrastructure-as-code, Gitleaks and TruffleHog for committed secrets, and Dependabot and Renovate for dependency updates.
Results become tickets an engineer can act on: the affected code, a reproduction, a fix and a retest. This group is the engineering side of our Cybersecurity and Pen Testing practice and of Tailored Software, and its findings feed the detection work in security operations.
Platforms and practices
- Burp Suite Professional
- OWASP ZAP
- Semgrep
- CodeQL
- Trivy
- Gitleaks
- TruffleHog
- Dependabot
- Renovate
- OWASP Application Security Verification Standard (ASVS)
- Software composition analysis & SBOM review
- Web application and API penetration testing
References
- PortSwigger: Burp Suite Professional
- ZAP (Checkmarx-supported open-source project)
- Semgrep
- GitHub: CodeQL
- Trivy
- Gitleaks (open source)
- TruffleHog (open source)
- GitHub Docs: Dependabot
- Renovate documentation
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.