The job to be done
Prevent an application-specific failure and give developers a fix they can verify.
What goes in
- Architecture and source code
- Dependencies and build artifacts
- Running application behavior
What should come out
- Actionable findings and fixes
- Dependency and provenance evidence
- Security checks in the delivery process
Questions worth asking
- Does the tool explain a reachable failure rather than only a pattern match?
- Can developers reproduce and verify a fix?
- How are exceptions, generated code, and dependency updates handled?
A useful evaluation exercise
Write a test for a cross-user authorization boundary. Confirm it fails when the control is deliberately removed in a local sandbox.