DevSecOps in Practice: Tools That Actually Catch Vulnerabilities - Part 2 - SAST with Bandit

Part 1 covered secret scanning with Gitleaks — catching credentials before they reach the repo. That's one layer. But credentials aren't the only problem in app.py . There's a SQL injection vulnerability, an eval() call that lets an attacker run arbitrary Python code, and debug mode left on. None of those are secrets. Gitleaks won't touch them. That's what SAST is for. Code repo: https://github.com/pkkht/devsecops-demo/ What SAST is SAST stands for Static Application Security Testing. It analyse