StackHawk makes it simple for developers to find, triage, and fix application security bugs. AppSec Closer to the Keyboard than Ever Before. 🦅 Kaakaww!
Denver, CO
- Tweets 1,423
- Following 622
- Followers 1,138
- Likes 927
Pinned Tweet
The 2026 AppSec reality:
87% adopted AI coding assistants, but 50% spend 40%+ of their time just triaging alerts.
73% can't confidently answer board questions about risk posture.
Learn more: stackhawk.com/blog/2026-stat…
Download the guide: stackhawk.com/resources/guid…
245
Wingman is live.
Your AI agent writes the code. Wingman finds the vulns, fixes them, and verifies the fix in the same session. Before the PR opens.
7,500+ vulnerabilities fixed in early access. 98% stayed fixed.
$10/user/mo. 14-day trial.
stackhawk.com/product/wingma…
1
3
407
StackHawk retweeted
Let 'er rip!
I've observed engineers afraid of auto-fixing security vulnerabilities. Here's a post about why you should give it a try: stackhawk.com/blog/stackhawk…
1
1
68
StackHawk retweeted
Watching Engineers work in coding loops with StackHawk Wingman has been fascinating. Actually fixing vulnerabilities in code still always make my eyes get big 🤩
One of the most interesting things we've learned is around the AI maturity level of the engineering orgs and some common patterns.
First post is about choosing the right model/tier for your work. We've seen people get frustrated and basically go backwards when they choose cheaper models. I wrote a blog post about it here.
stackhawk.com/blog/cheap-ai-…
CTOs and VPs of Eng: How are you teaching/encouraging model selections in your org?
1
2
35
StackHawk retweeted
I was looking at CVE trends the other day and something interesting popped out. Our ability to FIX needs to scale quickly and there's real urgency around that need. Big thanks to @JGamblin for double checking some of my CVE math. stackhawk.com/agentic-ai-sec…
2
3
4
411
StackHawk retweeted
Paying engineers $300 for 90 minutes of honest feedback.
We built a security tool that runs inside your coding agent, tests your running app, and hands findings back to the agent to fix.
I want people who use these tools daily to tell me what works, what doesn't, and what's missing.
2
1
2
76
One security engineer rolled out DAST to 40+ dev teams in two quarters.
The verdict: the problem was never technical. It was a project management problem.
Read the full story: lnkd.in/gXFapXtM
2
101
This nails it. Scaling AppSec was never a tooling gap, it's an org problem. Getting 40+ dev teams to actually run DAST in their pipelines is change management, not config. The teams that solve the human side ship secure faster than the ones chasing the perfect scanner. Come dig in on @techimpactTV > techimpact.tv Hope to see you at #BHUSA
1
1
44
StackHawk retweeted
GitHub just announced a new view for PRs. That's cool, but the underlying problem is getting worse and new filters don't fix it.
stackhawk.com/blog/security-…
1
2
120
StackHawk retweeted
Claude's /run-skill-generator and /run are underused. They save real tokens.
Your agent doesn't know how to build and launch your app, so it works it out from the repo. Every session. You pay for that every time.
/run-skill-generator does the discovery ONCE. Build, launch, how to drive the app. Writes it to a per-project skill. After that /run reads the skill and goes.
Ran it on a Spring Boot app today. Got a curl smoke script that builds, launches, hits the endpoints, clean exit. Plus the non-obvious stuff written down. Self-signed cert, port conflicts, a Gradle warning that looks like a failure and isn't.
The win is simple. The agent stops rediscovering how to run your app every session. Lean CLAUDE.md too, since the run mechanics live in the skill instead of the context you pay for every turn.
Write the run steps down once. Stop paying for the rediscovery.
1
45
StackHawk retweeted
Claude Code is fast at writing code to solve problems. It is not definitely secure. Different problems.
1
1
1
121
Bay Area AppSec, we'll be at the SF Secure Software and AppSec Summit on May 14 in Palo Alto.
Learn more: clutchevents.co/events/san-f…
71
StackHawk is now a @Wiz_io Integration Partner!
StackHawk’s pre-production DAST findings flow directly into the Wiz Security Graph, where they are correlated with the cloud infrastructure context Wiz maintains.
Application and cloud risk in one place.
stackhawk.com/blog/stackhawk…
1
146
Every DAST vendor supports OAuth2, Jira, and OWASP Top 10.
That's not an evaluation.
Download our new DAST RFP template with 75+ criteria, the ones that actually separate tools.
🔗 stackhawk.com/resources/dast…
1
1
59
StackHawk retweeted
Security can't keep being the blocker.
Joe Sullivan says the number one trait for the next gen security team is curiosity.
@sgerlach's anti-pattern: needs procedures. Stays in the box.
@StackHawk
1
3
94
OpenAI launched Codex Security in March. Real results. Previously unknown vulns in OpenSSH and Chromium. Most coverage stopped there.
1
41
It reads your repo. It doesn't send requests to your running app. That's not a gap that better models will eventually close. It's a category difference.
Read the full blog here: stackhawk.com/blog/codex-sec…
18
Copilot's coding agent learned from public codebases — including the ones with SQL injection sitting in them, weak auth that nobody caught, secrets committed by accident. It doesn't apply a security lens. It applies the patterns it saw most often.
1
80
Runtime testing is the check that closes the gap. StackHawk scans the running app in CI, feeds findings back to the agent as prompts, and you rescan to confirm the fix. All inside the same IDE.
Full walkthrough: stackhawk.com/blog/github-co…
1
83
MCP servers connect to production: your DBs, internal APIs, real services. Most ship with zero security testing.
StackHawk now scans remote MCP servers. Add a config block, run HawkScan, findings map to specific tools, not raw protocol calls.
stackhawk.com/blog/introduci…
44