Docs

Standards and best practices, built into the product.

SiteShadow turns security and engineering standards into automated guardrails. The goal is simple: ship code that is hardened by default, without slowing developers down.

Testing category: SiteShadow is SAST (static analysis) — it inspects code and configuration, rather than probing a running application (DAST).

Security-focused standards

Foundational references that drive secure coding guidance and scanning claims.

OWASP Secure Coding Practices: input validation, output encoding, authentication and password management, session management, access control, cryptographic practices, error handling and logging, data protection, communication security, configuration, database security, file and memory management, and general coding practices.
OWASP Top 10 and Cheat Sheets: language-agnostic guidance on common web risks (injection, XSS, authentication, and more) and how to avoid them in code.
CWE (MITRE Common Weakness Enumeration): a catalog of specific weaknesses like buffer overflows, injection, and insecure path handling. SiteShadow can be positioned as CWE-aware or CWE-informed.
AI/LLM security (emerging): as teams adopt AI-assisted development and agent workflows, the threat model changes. SiteShadow is expanding guardrails for prompt boundaries, tool safety, and abuse resistance — without exposing internal detection logic.

“SiteShadow bakes in OWASP-aligned secure coding checks and CWE-driven weakness detection, so your team ships code that is hardened by default.”

Reference links: OWASP Secure Coding Practices OWASP Top 10 CWE (MITRE)

General engineering best practices

Security is stronger when the engineering fundamentals are non-negotiable.

Code quality and engineering practices: version control, continuous integration, automated tests, code reviews, pair programming, style guides, and clean code principles (KISS, DRY, SOLID).
Standards and style guides: language-specific conventions like PEP 8 (Python), Airbnb JavaScript, Google Java style guide, Effective Go, and more for consistency and readability.
Secure SDLC: security across requirements, design, implementation, testing, deployment, and maintenance.

“From OWASP secure coding practices to SOLID and DRY, SiteShadow turns best-practice checklists into automated guardrails across your entire SDLC.”

Risk-based prioritization

SiteShadow prioritizes checks using a simple model: risk is driven by how exposed you are, what it would cost if exploited, and how likely it is to be used in the real world.

Risk = Vulnerability × Impact × Threat
and Likelihood = Vulnerability × Threat (often called “likeliness”)
so Risk = Impact × Likelihood

Vulnerability: how exposed you are to a weakness — the absence or strength of controls, guardrails, validation, and safe defaults.
Impact: the consequence if the weakness is successfully used — blast radius, data exposure, operational disruption, safety, cost, and trust.
Threat: how common the attack is in the wild and/or the presence of real threat actors attempting it. (The “actors exist” factor is effectively a constant 1 — what changes is prevalence and pressure.)
Likelihood (or “likeliness”): a convenient grouping of Vulnerability × Threat — how probable exploitation is in practice.

Risk drives priority. Higher-risk areas get deeper checks: more context, stronger validation, and tighter guardrails where the cost of being wrong is highest.

Risk model diagrams

Risk model flow: Vulnerability and Threat combine into Likelihood; Likelihood and Impact combine into Risk.

A quick way to reason about risk in practice: group Vulnerability × Threat as “Likelihood”, then multiply by Impact. Open full size Open full size Open full size

Risk matrix showing Impact versus Likelihood, with higher risk in the high-impact, high-likelihood corner.

A simple risk matrix view: higher likelihood and higher impact combine into higher risk — and therefore higher priority. Open full size Open full size Open full size