Security Tools

Security tooling here covers a few distinct jobs: finding vulnerabilities in your own code, finding them in your dependencies, managing secrets, and handling identity and access.

Dependency scanning is the highest-return starting point for most teams — the majority of exploitable surface arrives through packages nobody reviewed, and automated alerts on known CVEs are cheap to adopt. Static analysis of your own code is next, though it needs tuning: a scanner that cries wolf gets ignored, which is worse than not having one.

Secrets management and identity are less about finding problems and more about not creating them. Hardcoded credentials remain one of the most common real-world breaches, and the fix is boring and effective. Treat the tools in this category as complements rather than alternatives: they address different failure modes, and none of them substitute for the others.