Applying SAST to Infrastructure as Code (Without TFSec)

<h2> Introduction </h2> <p>Security issues in cloud infrastructure often start as small configuration mistakes. A public network rule, a missing encryption setting, or an overly

<p><strong>Introduction</strong></p> <p>A <strong>two-tier architecture</strong> on AWS — the bread and butter of real-world cloud deployments. Here's the idea:</p> <ul> <li>

<p>Maya Kaczorowski documented Oblique's $0 security stack for code, email, logs, and devices. This is the companion piece: the $0 stack for cloud infrastructure — intent

<h2> TL;DR </h2> <ul> <li>AI assistants trained on public repos reproduce hardcoded secrets because that's what they learned</li> <li>A pushed API key is effectively public even

<h1> Applying SAST to Any Application with CodeQL </h1> <p>Static Application Security Testing (SAST) helps you inspect source code before an attacker ever reaches the running