AppSec Signal
Technical writing on dependency security, call-graph reachability, SCA triage, and what it actually takes to reduce MTTR on reachable CVEs. No marketing, no roundups — practitioner-first.
Why CVSS Scores Lie to Your Security Team
A CVSS 9.8 in a package your application never calls is noise. Here's why the scoring system was never designed to tell you whether your specific code is exposed.
Read article
Call Graph Analysis: A Practical Primer for AppSec Engineers
Before you can know which CVEs matter, you need to understand how your code actually executes. A call graph traces the reachable paths — this is how to read one.
Read article
Dependency Triage at Scale: What 50 Deploys a Week Does to Your Patch Queue
Engineering teams shipping fast accumulate CVE debt faster than they can triage it. We analyzed what the backlog looks like at 50+ deploys per week — and how to stop it growing.
Read article
OSV vs NVD: Which Advisory Feed Should Your Tool Trust?
The Open Source Vulnerability database and the National Vulnerability Database have different update cadences, coverage gaps, and CVSS scoring philosophies. Here's the practical difference for AppSec tooling.
Read article
The Reachability Analysis False Positive: When We Get It Wrong
Static call graph analysis can miss dynamic dispatch patterns, reflection, and certain polymorphic call sites. Here's an honest look at Patchlynx's known blind spots and how we're addressing them.
Read article
How to Set Up PR-Blocking Security Gates Without Destroying Developer Velocity
Blocking PRs on every CVSS 7+ is how you get engineers to bypass your security scanner. Reachability-scoped gates block on confirmed exploitability only — here's the configuration pattern.
Read article
The Hidden Risk in Your Node.js Transitive Dependencies
The average Node.js application has 800+ transitive dependencies. Most AppSec tools score them all equally. Reachability analysis shows which 12 actually matter to your running code.
Read article
Python Dependency Vulnerability Patterns That Static Analysis Misses
Python's dynamic import system and conditional dependencies create call-graph edges that naive static analysis can't follow. Here's how Patchlynx handles the common patterns.
Read article
The AppSec Engineer's Sprint Workflow: Fitting Patch Triage Into a Two-Week Cycle
Most security teams don't have their own sprint — they interrupt engineering. Here's a workflow pattern for embedding reachability-prioritized patch work into a two-week engineering cycle without becoming the bottleneck.
Read article
What log4shell Taught Us About Reachability (And What We Still Got Wrong)
Log4Shell's broad blast radius came partly from call paths that teams didn't know existed. The post-mortem analysis revealed something interesting: reachability tools had the data — but nobody was reading it.
Read article
How to Measure Patch Velocity (And Why Most Teams Track the Wrong Metric)
Time-to-patch is a vanity metric if you're patching the wrong things. The right measure is time-to-patch for confirmed-reachable CVEs. Here's how to instrument it.
Read article