Security Scanning Compared: SAST, DAST, IAST, SCA, Secrets, Container, IaC — and Token Formats
Fast recall
Quick revision
Core answer
Treating all scanners equivalent; over-indexing on SAST; no triage; ignoring SCA (biggest real risk); JWT dogma
Map each scanner to bug class; SCA as highest ROI; triage strategy; ASVS vs OWASP; session vs JWT vs OAuth2 trade-offs
Interview-ready guide
Interview answer
Each scanner finds a different bug class. None is sufficient alone. More tools without triage is security theater.
Scanner map
- SAST (Semgrep, SonarQube, CodeQL) — source pattern analysis — fast, PR-time, noisy
- SCA (Snyk, Dependabot, OSV-Scanner, Trivy) — dependency CVEs — highest ROI; real incidents are mostly dep CVEs
- DAST (ZAP, Burp) — runs against staging, catches runtime misconfigs SAST can't
- IAST (Contrast, Seeker) — runtime instrumentation, best accuracy, commercial
- Secrets scanning (Gitleaks, TruffleHog) — pre-commit + CI + historical
- Container scanning (Trivy, Grype) — OS + Java deps in images; run at build
- IaC scanning (Checkov, tfsec) — open S3, permissive IAM at PR time
- Runtime security (Falco, eBPF, RASP, WAF) — defense at runtime
Practical pipeline for Java teams
- PR CI: Semgrep + SCA + Secrets + IaC — must pass
- Weekly: CodeQL deep scan
- Nightly: SonarQube quality gates + ZAP against staging
- Build: container scan + Cosign signing + SBOM
- Runtime: Falco + Datadog ASM or Contrast
- Quarterly: human pentest on critical flows
SAST specifics
- Catches: SQL injection patterns, unsafe deserialization, crypto misuse, XSS sources/sinks
- Misses: logic flaws, misconfig, runtime state, deps
- Use PR-scoped, curated rule sets, severity gating
- Semgrep great FP rate and customizable; CodeQL deep
DAST specifics
- Runtime vulns: auth bypass, CSRF, session issues, cookie misconfigs, SSL
- Slow, needs staging, parameterized for logged-in flows, OpenAPI-aware
- Nightly not PR-time
SCA — highest ROI
- Log4Shell, Spring4Shell — real incidents are dep CVEs
- Reachability analysis cuts FPs 50–80%
- SBOM for supply-chain transparency
- Auto-merge low-risk patches with Renovate/Dependabot
- Block HIGH/CRITICAL without remediation plan
Secrets
- Pre-commit, CI, historical scan
- If leaked: rotate immediately, not suppress
- Preventive: Secrets Manager, Vault, no .env commits
IaC
- Checkov/tfsec on Terraform, CloudFormation, K8s YAML
- Catches 80% of misconfigs that cause breaches
- OPA/Gatekeeper enforces at runtime
Frameworks (not scanners)
- OWASP Top 10: broad list, minimum scanner coverage, training
- OWASP ASVS: tiered requirements — L1, L2, L3 — target L2 business, L3 regulated
- NIST 800-53: government contractors
- SOC 2 / ISO 27001: audit process, not code; compliance ≠ security
- CIS Benchmarks: hardening guides
- CWE/CVE: bug class taxonomy / specific vulns
Session vs JWT vs OAuth2
Session (cookie + server store)
- Simplest, easy to revoke, stateful
- Best traditional web apps
JWT
- Stateless scale, revocation pain, bloat
- Risks: alg:none, weak HS256, long lifetimes
- Best: short-lived (≤15 min) internal microservice tokens
OAuth2 + OIDC
- Framework for delegation; opaque tokens at edge, JWTs internal
- Auth Code + PKCE for SPA/mobile; Client Credentials for service-to-service
- Best for modern: delegate auth to IdP (Okta, Auth0, Cognito)
Modern hybrid
- Edge: opaque tokens (revocable)
- Internal: short-lived JWTs
- Refresh: HttpOnly Secure SameSite=Strict cookies, rotation on use
- MFA on IdP
Pitfalls
- Long-lived JWTs without refresh
- Cookies without HttpOnly/Secure/SameSite
- Tokens in localStorage (XSS exfil)
- Rolling own OAuth2
- Missing audience/issuer/expiration checks
Trade-offs
- More scanners vs alert fatigue — curate, triage, gate on severity
- Shift-left + shift-right — both; don't abandon one
- Commercial vs OSS — OSS baseline, commercial for UX/reachability
- Precision vs recall — tune rules, measure FP rate
- Compliance vs real security — compliance byproduct, not goal
- Centralized vs embedded — security champions in product teams
- Session vs JWT dogma — pick by actual requirements
Anti-patterns
- Scanner stacking without triage
- Ignoring SCA
- JWT god-token with year-long lifetime
- LocalStorage tokens
- SAST-only security
- DAST in every PR CI
- Rolling own crypto/auth
- Suppressing findings without justification
- Security team as gatekeeper
- Compliance-driven security
Senior behaviors
- Threat model first — what, from whom, how
- Defense in depth — multiple layers
- Secure defaults — validation, parameterized queries, HttpOnly cookies, TLS
- SCA as table stakes
- Triage discipline — ≤ 50 open criticals, fix SLA
- Security champions in product teams
- Tabletop exercises — leaked secret, account takeover, DDoS
- Offer secure paved paths, don't be department of no
Bottom line
- Pipeline: SAST + SCA + secrets + IaC in PR; DAST/IAST in staging; runtime security; human pentest
- SCA is the highest-ROI scanner
- ASVS is the real standard; OWASP Top 10 is the checklist
- Token format depends on context — edge opaque + internal short JWT is modern
- Security is culture + defaults + threat modeling, not stacking tools
Security Scanning Compared: SAST, DAST, IAST, SCA, Secrets, Container, IaC — and Token Formats
Direct Answer
Each tool finds a different class of bug; none is sufficient alone, and more tools ≠ more security if nobody triages them. SAST (Semgrep, SonarQube, CodeQL) analyzes source for bug patterns — fast, early, noisy; best for injection, auth flaws, insecure API use. SCA (Snyk, Dependabot, Trivy, OSV-Scanner) checks dependencies for CVEs — the highest-ROI scanner since most real incidents are dependency CVEs. DAST (ZAP, Burp) tests the running app for OWASP Top 10 — catches misconfigs SAST can't see; slow, runs against staging. IAST (Contrast, Seeker) instruments the runtime — best accuracy, harder to deploy. Secrets scanning (Gitleaks, TruffleHog, GitHub Advanced Security) prevents AWS keys in commits. Container scanning (Trivy, Grype, Clair) checks OS + Java deps in images. IaC scanning (Checkov, tfsec, KICS) catches misconfig in Terraform/CloudFormation. For frameworks: OWASP Top 10 is the broad checklist; ASVS is a tiered requirement standard for depth; NIST 800-53 / SOC 2 / ISO 27001 are compliance mappings, not code checks. For session vs JWT vs OAuth2 tokens: session is simplest and easiest to revoke; JWT scales stateless but revocation is painful; OAuth2 + OIDC with opaque tokens at the boundary + short-lived JWTs internally is the modern compromise. The anti-pattern: stacking 8 scanners, none triaged, 2000 open findings, real vulnerabilities buried in noise.
Common Mistakes & Pitfalls
Treating all scanners equivalent; over-indexing on SAST; no triage; ignoring SCA (biggest real risk); JWT dogma
Check your understanding
Answer these without looking back at the article.
- How would you reduce false positives in a noisy SAST deployment?
- When is IAST worth the commercial cost over SAST + DAST?
- How do you handle a critical dependency CVE with no patch available?
- Walk me through a JWT implementation pitfall you'd catch in review.
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.