Our DAST results have gotten to the point where the security team spends a ridiculous amount of time figuring out which findings are actually worth handing to engineering.

I’m not expecting zero false positives, but there has to be a better way to handle this than manually reproducing everything the scanner spits out. How are people dealing with this at scale?

I've been building SaaS apps with AI and now I want to properly test how secure they are before real users start using them.

I'm not looking for basic advice like use HTTPS, validate inputs, or hide API keys. I want to find actual vulnerabilities, even the ones that are hard to notice.

For example, how do you check if a user can access someone else's data, bypass authentication, abuse APIs, exploit payment logic or find other issues in the backend?

I'm looking for a proper process here, not just a list of tools.

A few things I'd like to know:

• What do you test manually, and how do you go about it?
• Which free tools are actually useful for deep testing?
• Are there any paid tools worth the money for a solo developer?
• Can AI tools like Claude or security agents find serious vulnerabilities in a codebase, or should I not rely on them much?
• How do you test the backend and APIs when you have access to the source code?
• What are some common security issues in AI-generated code that people usually miss?

If you had to test a SaaS from scratch, what would your process look like? Which tools would you use first, and what would you do after that?

I'd prefer advice from people who've actually done application security testing. Even if it's a long process, that's fine. I want to do this properly

Hey everyone!

I’m relatively new to vulnerability research, and I’m interested in finding new vulnerabilities in open-source frameworks and libraries, rather than just scanning for known CVEs.

I’m curious how experienced researchers actually approach large codebases.

Where do you usually start? Do you study past CVEs and patches, identify security-critical components, or just start reading the source code?

What techniques do you typically use? Manual code review, static analysis tools like CodeQL, fuzzing, or a combination? Does your approach change depending on the type of vulnerability you’re looking for?

How has AI changed your workflow? Do you find it useful to let an LLM or coding agent review a codebase first, or is it more effective after you’ve narrowed down specific components or code paths?

I’d especially love to hear about real-world workflows and how you go from exploring a codebase to finding and validating a vulnerability.
Thanks in advance!