StackHawk

StackHawk makes it simple for developers to find, triage, and fix application security bugs. AppSec Closer to the Keyboard than Ever Before.

🦅 Kaakaww!

[StackHawk @StackHawk]

The 2026 AppSec reality:

87% adopted AI coding assistants, but 50% spend 40%+ of their time just triaging alerts.
73% can't confidently answer board questions about risk posture.

Learn more: https://t.co/jUNcJWuBoG

Download the guide: https://t.co/qVpwRi8OcG

[StackHawk @StackHawk]

Wingman is live.

Your AI agent writes the code. Wingman finds the vulns, fixes them, and verifies the fix in the same session. Before the PR opens.

7,500+ vulnerabilities fixed in early access. 98% stayed fixed.

$10/user/mo. 14-day trial.
https://t.co/2mOdAGsWie

[Joni Klippert @joniklippert]

Let 'er rip!
I've observed engineers afraid of auto-fixing security vulnerabilities. Here's a post about why you should give it a try: https://t.co/OJS4x6rxyx

[Scott Gerlach @sgerlach]

Watching Engineers work in coding loops with StackHawk Wingman has been fascinating. Actually fixing vulnerabilities in code still always make my eyes get big 🤩

One of the most interesting things we've learned is around the AI maturity level of the engineering orgs and some common patterns.

First post is about choosing the right model/tier for your work. We've seen people get frustrated and basically go backwards when they choose cheaper models. I wrote a blog post about it here.
https://t.co/UMjqTPgKOm

CTOs and VPs of Eng: How are you teaching/encouraging model selections in your org?

[Scott Gerlach @sgerlach]

I was looking at CVE trends the other day and something interesting popped out. Our ability to FIX needs to scale quickly and there's real urgency around that need. Big thanks to @JGamblin for double checking some of my CVE math. https://t.co/OCOUePwHpY

[Scott Gerlach @sgerlach]

Paying engineers $300 for 90 minutes of honest feedback.

We built a security tool that runs inside your coding agent, tests your running app, and hands findings back to the agent to fix.

I want people who use these tools daily to tell me what works, what doesn't, and what's missing.

[StackHawk @StackHawk]

@EvanKirstel What about running it and fixing the finding BEFORE the pipeline? We’ve been doing that lately and the results are astounding!

[StackHawk @StackHawk]

One security engineer rolled out DAST to 40+ dev teams in two quarters.

The verdict: the problem was never technical. It was a project management problem.

Read the full story: https://t.co/ZlnLPiW7MH

[Scott Gerlach @sgerlach]

GitHub just announced a new view for PRs. That's cool, but the underlying problem is getting worse and new filters don't fix it.
https://t.co/5vqpXwvYMO

[Scott Gerlach @sgerlach]

Claude's /run-skill-generator and /run are underused. They save real tokens.

Your agent doesn't know how to build and launch your app, so it works it out from the repo. Every session. You pay for that every time.

/run-skill-generator does the discovery ONCE. Build, launch, how to drive the app. Writes it to a per-project skill. After that /run reads the skill and goes.

Ran it on a Spring Boot app today. Got a curl smoke script that builds, launches, hits the endpoints, clean exit. Plus the non-obvious stuff written down. Self-signed cert, port conflicts, a Gradle warning that looks like a failure and isn't.

The win is simple. The agent stops rediscovering how to run your app every session. Lean CLAUDE.md too, since the run mechanics live in the skill instead of the context you pay for every turn.

Write the run steps down once. Stop paying for the rediscovery.

[Scott Gerlach @sgerlach]

Claude Code is fast at writing code to solve problems. It is not definitely secure. Different problems.

[StackHawk @StackHawk]

Read what we learned from this success story: https://t.co/y6DkwX5q6O

[StackHawk @StackHawk]

Bay Area AppSec, we'll be at the SF Secure Software and AppSec Summit on May 14 in Palo Alto.

Learn more: https://t.co/Its8s5nmhi

[StackHawk @StackHawk]

StackHawk is now a @Wiz_io Integration Partner!

StackHawk’s pre-production DAST findings flow directly into the Wiz Security Graph, where they are correlated with the cloud infrastructure context Wiz maintains.

Application and cloud risk in one place.

https://t.co/J2jcVjznGm

[StackHawk @StackHawk]

Every DAST vendor supports OAuth2, Jira, and OWASP Top 10.

That's not an evaluation.

Download our new DAST RFP template with 75+ criteria, the ones that actually separate tools.
🔗 https://t.co/nmft5rp7eo

[Cloud Security Podcast @CloudSecPod]

Security can't keep being the blocker.
Joe Sullivan says the number one trait for the next gen security team is curiosity.

@sgerlach's anti-pattern: needs procedures. Stays in the box.

@StackHawk

[StackHawk @StackHawk]

It reads your repo. It doesn't send requests to your running app. That's not a gap that better models will eventually close. It's a category difference.

Read the full blog here: https://t.co/CV90D22yt5

[StackHawk @StackHawk]

OpenAI launched Codex Security in March. Real results. Previously unknown vulns in OpenSSH and Chromium. Most coverage stopped there.

[StackHawk @StackHawk]

Runtime testing is the check that closes the gap. StackHawk scans the running app in CI, feeds findings back to the agent as prompts, and you rescan to confirm the fix. All inside the same IDE.

Full walkthrough: https://t.co/8EHiQtqWH9

[StackHawk @StackHawk]

Copilot's coding agent learned from public codebases — including the ones with SQL injection sitting in them, weak auth that nobody caught, secrets committed by accident. It doesn't apply a security lens. It applies the patterns it saw most often.

[StackHawk @StackHawk]

MCP servers connect to production: your DBs, internal APIs, real services. Most ship with zero security testing.

StackHawk now scans remote MCP servers. Add a config block, run HawkScan, findings map to specific tools, not raw protocol calls.
https://t.co/5dPiPsW7C7