Explain like I'm five · Security

What is Code Scanning?

Code scanning — SAST, DAST, and secure coding — told as a story about a guard who reads the drawing before building and knocks on the wall after.

a thousand pagescheck all of this by eye…?the cracks are tiny and the bricks are ten thousand — no eye can check them all

A thousand pages, ten thousand bricks. No eye can check them all.The builder lays bricks every day. A crack is the size of one brick. One guard cannot look at them all.

once a yearthe hired thieffor ten months in between, the cracks stayed openno one saw last month's bricksthe big test is rare, but bricks go up every day

The hired thief comes once a year. In between, the cracks stay open.The hired thief is the big test, so he comes rarely. Nobody looked at the bricks laid in between. Real thieves do not wait.

before building: read the drawingfinding cracks on paperafter building: knock on the walltok!…tung?listening for a hollow soundread the drawing and knock on the wall — automatically, brick by brickone is fast, one is sure. use both

Read the drawing and knock on the wall — automatically, brick by brick.Before building, read the drawing to find cracks. After building, knock on the wall and listen for hollow spots. For bricks made by others, check the parts list too.

Read the drawingbefore building, on paper
Knock on the wallafter building, on the real wall
Check the parts listbricks from others, by their list
Every brick, automaticallyno one has to wait
reading the drawingknocking on the wallfast, but far too many flagssome are false alarms: this spot is fineslower, but it finds only real cracksyou can only knock once it is builtread wide and early, knock sure and late

Reading gives too many flags; knocking is late but sure.Reading plants a flag on every maybe — including spots that are fine. Knocking finds only real hollows, but the wall has to be built first.

HOW TO LAY WITHOUT CRACKS· inspect bricks others hand you· never nail a key into the wall· two sets of eyesthat brick sits a little crookeda fellow builder looks it overthe big test, now and thenthe checks every day, the hired thief now and then — different jobs

The builder learns too — how to lay without cracks from the start.Learn to lay without cracks, and have a fellow builder look it over. Checks run every day, every brick; the hired thief is the rare big test. Different jobs.

In one breath

Code scanning = read the drawing for cracks before building, then knock on the wall for hollow spots after — automatically, brick by brick.

SAST (static analysis) reads source code without running it and flags vulnerable patterns; DAST (dynamic analysis) sends requests to the running app and watches how it really responds. SCA checks third-party libraries for known vulnerabilities. Secure coding and code review reduce cracks upstream.

When grown-ups say it

SAST
Reading the drawing. Finds cracks by reading the paper (code) before anything runs. Fast and wide, but plants many false flags.
DAST
Knocking on the wall. Sends requests at the built wall (the running app) and listens for hollows. Late, but real.
SCA
Checking the parts list. Checks bricks made by others (libraries) against known cracks, via the parts list. → the parts list on the tool
Secure coding
Laying without cracks. The builder's habits that stop cracks before they start: never trust what others hand you, never nail in a key. → the thief lesson
False positive / false negative
A flag on a fine spot / a crack missed. Reading gives many false positives; knocking can miss some. Use both so each covers the other.
Code review
A fellow builder looking over. Another builder looks before the brick goes in. Human eyes catch the why that tools cannot.
Injection
A command hidden inside a note. Read a visitor's note as-is, and the wall obeys whatever it says. The crack that reading catches best. → the note reviewer at the counter
Versus a pentest
The daily check / the occasional thief. Checks run automatically every day; the hired thief comes rarely and digs deep. Neither replaces the other. → the thief we hired
Next story
The Guard Room's Automatic Book →
Want another term as a picture book? Request →