Article · 70 guides

Guides for faster, safer websites

Practical, no-fluff writeups on performance, security, browser auditing, and code quality.

All 70 Website Audit 19 Security 21 Browser Auditing 7 Code Quality 13 Scanverra 10

SAST Tool Guide: How Static Application Security Testing Finds Vulnerabilities in Your Code

What a SAST tool is, how SAST code scanning works, what it should find, and how to run static application security testing in your IDE, pull requests and CI/CD pipeline.

Oct 6, 2026·11 min read

Read article

More Code Quality

SonarQube and Snyk Alternatives: An Honest Comparison (2026)

SonarQube and Snyk are the default picks for code quality and vulnerability scanning - but they're not the only options, and not always the right fit. Here's an honest look at real alternatives, including where lighter tools fit in.

Sep 9, 2026·7 min read

Container Security: A Practical Guide to Scanning Docker Images

Why a container built from a stale base image ships known CVEs by default, and how image scanning catches it before it reaches production.

Sep 6, 2026·8 min read

Kubernetes Security Misconfigurations: A Practical Checklist

Containers running as root, missing resource limits, overly broad RBAC - the Kubernetes manifest mistakes that pass code review because nothing about them looks obviously wrong.

Sep 6, 2026·9 min read

Software Composition Analysis: A Complete Guide to Dependency Scanning

What SCA tools actually check, how a CVE in a transitive dependency you've never heard of still becomes your problem, and how to build a workable remediation process.

Sep 5, 2026·9 min read

How Secrets End Up in Git History (and How to Get Them Out)

Deleting the file in a new commit doesn't delete the secret - it's still sitting in every earlier commit. Why that matters, and the actual steps to rotate and purge it.

Sep 5, 2026·8 min read

Infrastructure as Code Security: Scanning Terraform, Kubernetes, and CloudFormation

A misconfigured Terraform module or an over-permissive Kubernetes manifest ships the same way application code does - here's how IaC scanning catches it before apply, not after.

Sep 5, 2026·9 min read

Static Analysis vs. Dynamic Analysis: What Each Actually Catches

SAST reads your code without running it, DAST attacks a running app from the outside - what each approach can and can't see, and why most teams need both.

Sep 2, 2026·8 min read

Understanding CVSS Scores: How to Prioritize Vulnerability Fixes

A 9.8 and a 7.5 aren't just "high" and "medium" - what actually goes into a CVSS score, and why the number alone shouldn't decide what you patch first.

Sep 2, 2026·9 min read

npm audit vs. Snyk vs. Dependabot: Choosing the Right Dependency Scanner

Three names that come up constantly, doing genuinely different jobs - and why most teams end up using more than one, not choosing just one.

Aug 24, 2026·8 min read