SAST, DAST, SCA: three different questions

Anchors the three core scanning categories to one question each — reading code, attacking a running app, or auditing borrowed code.