nullra/blog
search →
Application security analysis
7 posts · 6 categories
Authorization

Tenant isolation failures are authorization failures. Not configuration failures, not framework failures, not database failures. This is a catalogue of how they happen, why they're hard to see coming, and what the underlying patterns actually look like.

Before you write a rule, read the code
Tooling & Automation

Most SAST implementations fail not because the tool is wrong, but because the rules weren't written for the codebase they're running against. Generic rulesets generate noise. Noise gets ignored. Ignored findings don't get fixed. Here's how to build rules that match how your organization actually writes code.