Writing 1 min
Scan your own work first
A threat model, two scanners and a stubborn habit turned a vulnerable notes API into a clean one. The habit is the point.
The fastest way to learn what a scanner will find in your code is to point it at your code before anyone else does. NoteVault began life deliberately broken so that every fix could be measured.
Semgrep caught the patterns. ZAP caught the behaviour. The threat model caught the things neither tool knows to look for, like an admin route that trusted a role claim it never verified.
The loop, model, scan, fix, re-scan, now runs on every project I ship, including this site.