Application Security
Section focus: Application Security.
Best use: start with the section map below, then move into the deeper pages that match your role or stack.
Design note: this index was refreshed to act as a cleaner GitBook landing page instead of a plain directory listing.
Start with these pages
| Page | Why open it first |
|---|---|
| SAST Noise Reduction | High-value page inside Application Security. |
| 🥋 DefectDojo and ASPM Platforms | High-value page inside Application Security. |
| 🧭 ASOC and ASPM Orchestration Platforms | High-value page inside Application Security. |
| 🔐 Repository Secret Scanning | High-value page inside Application Security. |
| 🔎 TruffleHog and Gitleaks Deep Dive | High-value page inside Application Security. |
| GitHub and GitLab Native Secret Scanning Comparison | High-value page inside Application Security. |
| 📱 Mobile Application Security Testing | High-value page inside Application Security. |
| 🧱 Secure by Design for AppSec and SDLC | High-value page inside Application Security. |
| 🏗️ Web Application Security Architecture — Practical Intro | Architecture-first onboarding page for reviewers who need the component map before the bug list. |
| 🧠 Business Logic Vulnerabilities and Verification | Explains application-level workflow flaws, how to verify them, and how to connect them to real product abuse. |
| 🔊 SonarQube Modern Practical Guide — Quality Gates, Security Hotspots, PR Analysis, and Review Workflows | Modernizes the 2014 SonarQube mental model into a 2026 AppSec operating guide. |
| 🧭 Burp Suite vs OWASP ZAP — Practical Positioning | Helps teams choose between analyst-first Burp workflows and automation-first ZAP workflows. |
| 🧪 Mobile Report Analysis and Finding Walkthrough | High-value page inside Application Security. |
Related sections
- modern SonarQube positioning for SAST, hotspots, and review workflows
- practical Burp versus ZAP decision guidance
- architecture-first onboarding for modern web applications
- scanner signal quality and secret detection
- mobile application security testing
- cross-links into CI/CD quality gates and newer architecture, abuse, and secure-engineering sections
Intro: This section stays close to product-facing security work: scanner signal quality, findings management, secret scanning, mobile security testing, and the orchestration layer that helps teams make release decisions without drowning in tool output.
What this page includes
- vulnerability orchestration and posture tooling
🧪 Core pages in this section
- SAST Noise Reduction
- 🥋 DefectDojo and ASPM Platforms
- 🧭 ASOC and ASPM Orchestration Platforms
- 🔐 Repository Secret Scanning
- 🔎 TruffleHog and Gitleaks Deep Dive
- GitHub and GitLab Native Secret Scanning Comparison
- 📱 Mobile Application Security Testing
- 🧪 Mobile Report Analysis and Finding Walkthrough
- 🧠 Catch It Before Commit: IDE Security Linters and Pre-Commit SAST
- 🌐 Web Application Security Testing and Gate Patterns
- 🏗️ Web Application Security Architecture — Practical Intro
- 🧠 Business Logic Vulnerabilities and Verification
- 🌐 Web Application Security Review and Architecture Playbook
- 🌐 SSRF, File Fetch, and Parser Abuse Review Guide
- 🧱 Secure by Design for AppSec and SDLC
- 🔊 SonarQube Modern Practical Guide — Quality Gates, Security Hotspots, PR Analysis, and Review Workflows
- 🧭 Burp Suite vs OWASP ZAP — Practical Positioning
- 🔎 Semgrep / CodeQL / SonarQube Positioning
Cross-links
- 🚦 Secret Scanning in Quality Gates
- 📱 Mobile Testing Quality Gates and DefectDojo Integration
- API Security
- 🎭 Business Logic Abuse and Product Abuse
- 🧰 Stack-Specific Secure Engineering
Author attribution: Ivan Piskunov, 2026 - Educational and defensive-engineering use.