SASTAV and ARX ASPM PLATFORM Integrate Static Code Analysis with Application Security Risk Management
Russian developers ShiftLeft Security and ARX Security have ensured compatibility between the SASTAV SAST solution and the ARX ASPM PLATFORM. Static analysis of source code can now be launched and configured directly from the ASPM platform interface.
For each project, specialists can select repositories and branches, form rule sets, set scanning parameters, and establish quality gates — criteria that determine whether a product can be released with detected defects. Risk acceptance procedures are also configured within the same interface, requiring formal control rather than simple promises to fix issues.
SASTAV is responsible for static code analysis. The solution allows creation and editing of rules, assignment of different check sets to individual repositories, and management of scanning parameters. ARX ASPM PLATFORM acts as a unified center for managing AppSec tools. The platform collects results from various analyzers, correlates related findings, assesses risks, and displays the overall security posture of digital products.
Both solutions use artificial intelligence, but at different stages. In SASTAV, AI participates in defect verification, automatic triage, prioritization, and preparation of code change recommendations. This reduces the volume of raw warnings passed downstream. The AI assistant in ARX ASPM PLATFORM determines the statuses of defects found by the platform or imported from external systems.
After integration, a two-tier scheme emerges: SASTAV examines the code and filters findings, while ARX correlates them with results from other tools and helps decide which risks are acceptable. Developers expect to reduce manual operations, accelerate DevSecOps project connections, and lower the load on AppSec teams.
Related articles
From Scanner Overload to Manual Insight: A Bug Bounty Hunter's Journey
A young researcher recounts his transition from automated scanning to thoughtful manual analysis in Bug Bounty programs. After completing a broad information security course covering cryptography, networks, Docker, databases, and OWASP Top 10, he initially approached real-world targets with the same scanner-heavy mindset used in labs. Months of fruitless results led to burnout and a six-month break working in construction. Returning with a new focus, he studied hundreds of public HackerOne reports to understand researcher reasoning and anomaly detection. This shift enabled his first valid, unreported finding and fundamentally changed his methodology. Today the 18-year-old university student balances Bug Bounty with reconnaissance, machine learning, and personal projects while emphasizing deep application understanding over tool volume.
Bypassing Paid Export on AI 3D Generation Sites via Browser Network Inspection
A detailed walkthrough shows how users can retrieve AI-generated 3D models in GLB format from services that normally require a paid subscription for export. The method relies on opening the browser developer console, filtering network requests for .glb files after model generation completes, and opening the intercepted asset in a new tab. Examples using Tripo3D and Hi3D demonstrate that the generated model and textures are already present on the client side even when the export button remains disabled. Additional steps address compatibility issues with 3ds Max by recommending conversion through gltf.report with Draco compression before import. The technique also covers post-processing in ZBrush for auto-retopology and format conversion to OBJ. The article notes that such workarounds exist because many AI platforms limit free exports while still rendering full models locally.
National Platform Max Begins Testing Advertising Tools to Monetize User Attention
The Russian national platform Max has started internal testing of new advertising instruments designed to convert user attention into sellable ad inventory. According to the company's press service, the tests are already underway inside the application, although the exact placement, visual format, and eligibility criteria for advertisers remain undisclosed. The move marks a significant shift for the platform, which previously operated without visible commercial advertising. Observers note that Max could become one of the largest domestic digital advertising channels if the tests prove successful. No timeline has been given for a public rollout or for the publication of detailed advertising policies.
Yandex Drops Earbuds Under X-Ray Microtomography: Detailed Internal Analysis of First AI-Powered TWS Headphones
Engineers used non-destructive X-ray microtomography to examine Yandex Drops, the company's first TWS earbuds featuring the Alice AI voice assistant. The scan revealed an eight-layer HDI PCB, three microphones per earbud arranged in a dual feedforward plus feedback ANC configuration, an 11 mm driver, and a QFN-packaged SoC with NPU. No hardware disconnect point was identified in the microphone signal path within visually accessible traces, connectors, and vias. Battery dimensions, coil windings in the case, and internal flex routing were measured directly from calibrated voxel data. The study also confirmed contact-based charging via spring-loaded claw contacts and a Hall-effect sensor in the case lid. The work demonstrates how industrial micro-CT can support hardware security reviews without destroying the sample.