Security Testing for Java: SAST, DAST, SCA, IAST, Pen Testing in CI/CD

Security testing is a layered set of techniques, not one tool.

The taxonomy

• SAST: static analysis of source/bytecode — SonarQube, Semgrep, CodeQL, Snyk Code, SpotBugs/Find-Sec-Bugs; catches code-level vulns early
• SCA: Software Composition Analysis — Snyk, OWASP Dependency-Check, Dependabot, Renovate; finds vulnerable third-party deps
• DAST: dynamic analysis of running apps — OWASP ZAP, Burp Suite; tests deployed for runtime issues like injection, broken auth
• IAST: instrumented app, hybrid — Contrast, Seeker; catches issues during functional tests with low FP
• Container/IaC scanning: Trivy, Grype, Checkov, tfsec; for images and infrastructure
• Secret scanning: gitleaks, trufflehog; prevents key leaks
• Pen testing: manual + creative; finds business-logic and chained vulns tools miss

Practical pipeline

• Pre-commit: secret scan + lint
• PR checks: SAST + SCA + unit security tests
• Build: container scan + IaC scan
• Staging: DAST + IAST during integration tests
• Production: runtime monitoring, periodic pen tests, bug bounty

Don't deploy all tools at once

• Start with SCA + secret scanning + SAST
• Then add DAST + container scanning

Tune aggressively

• False-positive fatigue kills programs

Common mistakes

• Only running scans at release (too late)
• No triage SLAs
• Scanning without fixing
• Treating SAST as 'done' security
• No business-logic testing

Senior move

• Integrate into developer flow (IDE + PR)
• Establish SLAs by severity
• Automate dep updates
• Pair tooling with threat modeling + manual review for what automation can't catch

Each technique detail

SAST

• Source/bytecode without running
• SQL injection, XSS, hardcoded secrets, weak crypto
• Fast, runs in CI per commit
• Tools: SonarQube, Semgrep, CodeQL, Snyk Code, SpotBugs+Find-Sec-Bugs, PMD security

SCA

• Known CVEs in third-party deps
• Critical because most CVEs in libs not your code
• Tools: Snyk, OWASP DC, Dependabot, Renovate, JFrog Xray

DAST

• Attacks running app from outside; black-box
• Auth bypass, injection in form fields, security headers, TLS config
• Tools: OWASP ZAP, Burp Suite, Acunetix, Netsparker

IAST

• Agent inside running app instrumenting calls
• Combines SAST + DAST insight; very low FP
• More expensive
• Tools: Contrast, Seeker, Synopsys

Container scanning

• OS packages and base image CVEs
• Tools: Trivy, Grype, Snyk Container, AWS ECR scanning

IaC scanning

• Misconfigs in Terraform, K8s, CloudFormation
• Tools: Checkov, tfsec, Terrascan, kube-score, kube-bench

Secret scanning

• Keys, tokens, passwords accidentally committed
• Tools: gitleaks, trufflehog, GitHub secret scanning

Pen testing

• Humans + creativity; chained exploits; business-logic bugs
• Quarterly or before major releases

Bug bounty

• Ongoing crowdsourced testing in production
• HackerOne, Bugcrowd

Fuzzing

• Random/guided inputs to find crashes/edge cases
• OSS-Fuzz, Jazzer for Java

No single tool catches everything

• Coverage is the goal; each technique catches what others miss

Comparison | Technique | Tests | When | Speed | Strengths | Weaknesses | | SAST | Source patterns | PR/commit | Fast | Early, deep code coverage | FPs; misses runtime | | SCA | Deps for CVEs | PR/commit | Very fast | Most CVE risk | Reachability often unclear | | DAST | Running app black-box | Staging/nightly | Slow | Real runtime; auth flow | No code visibility; misses logic | | IAST | Running instrumented | Functional tests | Medium | Low FP; combined insight | Cost; needs agent | | Container scan | Image OS pkgs | Build/pre-deploy | Fast | Base image CVEs | App-layer unaffected | | IaC scan | Terraform/K8s | PR | Fast | Misconfig before deploy | Doesn't validate runtime | | Secret scan | Repo + commits | Pre-commit + PR | Fast | Prevents leaks | Doesn't catch already-leaked | | Pen test | Whole system | Quarterly/pre-release | Slow | Chained, logic bugs | Expensive; point-in-time | | Bug bounty | Production | Ongoing | Continuous | Real attackers | Cost per finding; scope mgmt | | Fuzzing | Inputs to fns/APIs | Nightly/continuous | Slow | Edge cases tools miss | Setup cost; coverage gaps |

Pipeline detail

Stage 1: Developer flow

• IDE plugins: Sonarlint, Snyk, Semgrep show issues as you type
• Pre-commit hooks: gitleaks, ktlint/spotless, basic SAST
• git secrets-style hooks block commits with detected secrets

Stage 2: PR pipeline (block bad code)

• Semgrep config p/owasp-top-ten p/java p/spring
• CodeQL for Java
• Snyk Maven --severity-threshold=high
• mvn org.owasp:dependency-check-maven:check
• gitleaks-action
• Gate: high/critical block merge; medium creates issue with SLA

Stage 3: Build (sign + scan artifacts)

• Trivy/Grype scan container image
• Sign with cosign (sigstore)
• Generate SBOM (syft or cyclonedx-maven-plugin)
• Reject unsigned/unscanned via admission policy (Kyverno, OPA Gatekeeper)

Stage 4: Staging (DAST + IAST)

• ZAP baseline: passive analysis, security headers, basic injection
• ZAP full or Burp Suite Enterprise: active exploitation
• IAST agent during functional tests for low-FP
• IaC scan on Terraform/Helm/K8s manifests

Stage 5: Production

• WAF (Cloudflare, AWS WAF): blocks common attacks before reaching app
• RASP: runtime defense; monitor + block at app layer
• SIEM (Splunk, Elastic, Datadog Security): correlate logs, detect anomalies
• Periodic pen tests (quarterly minimum for prod services)
• Bug bounty if mature (HackerOne, Bugcrowd) or private VDP first
• Continuous SCA: alerts on new CVEs disclosed for current dep versions

Java-specific tests

• @SpringBootTest + @AutoConfigureMockMvc
• enforcesSecurityHeaders: HSTS, CSP, X-Frame-Options DENY, X-Content-Type-Options nosniff
• @WithMockUser cannotEscalateToAdmin: isForbidden
• preventsSqlInjection: search with ' OR '1'='1 returns isBadRequest or clean results
• Sit alongside functional tests; run every PR

Triage and SLAs

• Critical (RCE, auth bypass, secret leak): 24-48h; block deploys
• High (sensitive data exposure, privesc): 7 days
• Medium (info disclosure, weak crypto in non-critical): 30 days
• Low: 90 days or accept
• Automate ticket creation with severity + due date
• Dashboards by team/service; SLA failure escalates

Tuning not optional

• Initial deployment: hundreds of findings
• Triage in batches: real, FP, won't fix
• Suppress FPs at rule level, not individually
• Tune custom rules to codebase (Semgrep/CodeQL custom queries)
• Re-tune quarterly; new patterns emerge

Reachability for SCA

• CVE in dep you don't actually call ≠ your CVE
• Snyk Reachability, Endor Labs, Backslash analyze if vulnerable code reachable
• Prioritize reachable; still upgrade eventually

Pen test scoping

• White-box (code/docs) vs gray vs black
• Time-box: 2-4 weeks complex service
• Authorized targets, hours, traffic limits
• Findings: documented, ranked, prioritized
• Re-test after fixes
• Diverse vendors over time; different lenses

Bug bounty maturity

• VDP first: free, low-overhead, signals openness
• Private: invited researchers; controlled scope
• Public: open program; real volume; need triage capacity
• Don't start without internal vuln mgmt process; you'll drown

Common pitfalls

1. 1
   Tool sprawl, no integration
2. 2
   Scan without fix
3. 3
   Only release-time scanning
4. 4
   Severity inflation (all critical = no signal)
5. 5
   Treating SAST as 'done' security
6. 6
   Pen test once, never again
7. 7
   No internal training
8. 8
   Ignoring container/IaC
9. 9
   Bypassing scans for 'urgent' deploys (precedent)
10. 10
    No security champions (AppSec can't keep up alone)
11. 11
    Not testing third-party services/APIs
12. 12
    Skipping authn/authz tests (most common real-world bug class)

Threat modeling complements

• Tools find known patterns; humans + TM find what system specifically allows wrong
• 30-min TM per feature → custom test cases
• Combines with abuse cases (negative testing)

Build vs buy

• OSS (Semgrep, ZAP, OWASP DC, gitleaks, Trivy) covers most needs
• Commercial (Snyk, Veracode, Checkmarx, Contrast) adds: managed rules, support, integration, reachability, IAST
• Most teams: OSS baseline + 1-2 commercial for SCA/IAST

Maturity ladder

1. 1
   SCA in CI (Dependabot/Renovate + Snyk)
2. 2
   Secret scanning pre-commit + CI
3. 3
   SAST in CI (Semgrep/Sonar/Snyk Code)
4. 4
   Container scanning at build (Trivy)
5. 5
   IaC scanning (Checkov/tfsec)
6. 6
   DAST baseline on staging
7. 7
   Authz/security integration tests in app
8. 8
   Periodic pen tests
9. 9
   IAST during integration tests
10. 10
    Bug bounty (private → public)
11. 11
    Fuzzing for high-risk components
12. 12
    RASP/runtime monitoring + SIEM

• Most should be 1-7; 8+ for high-risk/regulated

Speed matters

• SAST in PR: <5 min ideal
• SCA: <3 min
• Container scan: <2 min
• DAST baseline: <15 min
• DAST full: nightly
• Slower → frustration → workarounds

Coverage matters

• Scan PR branches not just main
• Scan deps, containers, IaC, configs not just code
• Instrument running app (IAST/RASP) not just compiled artifact

Security as code review

• Checklist in PR template (auth, new deps, crypto, PII)
• Security champion on PR review for sensitive areas
• Past incidents in 'gotchas' file new hires read

Compliance

• PCI-DSS requires SAST + DAST + pen test
• HIPAA: similar
• SOC2: documented testing + remediation evidence
• ISO 27001: regular vuln assessment
• Map findings + fixes to compliance evidence; auditors love

Senior engineer moves

• Build pipeline not checklist; integrate into existing CI/CD
• Tune aggressively; FP that lingers erodes trust
• Set + enforce SLAs; visible dashboards, escalation
• Establish severity definitions; shared language security + eng
• Pair tools with humans: threat model, review, pen test
• Train developers: secure coding workshops; OWASP walkthroughs; internal CTF
• Champion vuln triage; treat findings like bugs in backlog
• Measure: MTTR by severity, finding rate, % deploys with gates passing
• Automate dep updates; most CVEs fixed by upgrade
• Plan incidents: runbooks; comm plan; legal contacts

Strategic take

• Portfolio not single tool
• Layered defense: SAST + SCA + DAST + IAST + container/IaC + pen + bounty
• Speed + low FP + clear SLAs = sustainable program
• Combine automated + manual review + threat modeling
• Seniors integrate into every stage; not gate at end

Bottom line

• Right combination of tools, tuned aggressively, with severity SLAs and human pairing, beats any single tool
• Start small (SCA + secrets + SAST), prove value, expand