Use security tools with judgment

Scanners are useful assistants. They do not understand the complete product or business rule, so their output is a list of signals, not a list of vulnerabilities.

Dependency scanners, static analysis, and dynamic scanners each see one slice: manifests without runtime, code paths without context, running behavior without source. Combine them with manual review, because each one is blind where the others see.

One rule comes before everything else: run tools only against systems you own or have permission to test. A dynamic scanner throws real attack traffic. Pointing one at a production system you do not own is an attack, whatever your intentions.

Reproduce before you rank

A finding you have not reproduced is a rumor. For each important one, reproduce it safely, inspect the affected path, and rank it using context the scanner does not have: is the endpoint reachable anonymously, what data sits behind it, what would recovery cost?

Here is why the manual step matters. A scanner reports a reflected value in a JSON response as XSS:

finding: reflected-xss (medium confidence)
source:  GET /api/notes?q=...
sink:    JSON response field "title"

You trace the path. The frontend renders that field with textContent, which never interprets HTML, so the reported path does not execute script:

noteTitle.textContent = data.title  // inert — no script execution
// noteTitle.innerHTML = data.title // this version would be vulnerable

But notice the trap on the other side: calling this a false positive without reproducing the browser flow is also a mistake. If some other template renders the same field with innerHTML, the finding is real. Tools find signals; the complete data path from source to sink determines impact. You only know after you looked.

Tune, do not mute

A noisy scanner trains people to ignore it, which is worse than not running it. Tune rules that consistently misfire on your stack, and write down why each rule was tuned. What you may not do is hide a result because it is inconvenient — suppressions with no recorded reason are how known vulnerabilities survive three audits in a row.

Take one real finding from any scanner and walk the full source-to-sink path in an authorized environment. Save the request, the response, the execution result, and a regression test, whether you confirm or reject the finding. The rejected ones matter too: the note explaining why the path is safe saves the next person a day of re-investigation.