Does Xoxoday use SAST and DAST in its development lifecycle?

​

Security Built Into Every Stage of Development

Xoxoday follows a Secure Software Development Lifecycle (SSDLC) model, meaning security is not an afterthought applied at the end of a release — it is woven into every phase from design through deployment. This approach aligns with the expectations of enterprise buyers operating under frameworks such as ISO 27001 and SOC 2 Type II.

​

Static Application Security Testing (SAST)

Xoxoday runs SAST scans during the development phase, before code reaches production. These scans analyse source code for vulnerabilities including SQL injection, insecure authentication logic, and access control weaknesses. Catching issues at this stage — rather than post-deployment — significantly reduces remediation cost and risk exposure. For example, when a developer pushes a change that affects an integration with Workday or SAP SuccessFactors, SAST tooling evaluates the new code paths for security regressions before the pull request is merged.

​

Dynamic Application Security Testing (DAST)

DAST scans run against deployed application environments, simulating real-world attack patterns to surface runtime vulnerabilities. Xoxoday uses DAST to identify issues such as cross-site scripting (XSS), broken API authentication, and insecure direct object references — classes of vulnerability that only become visible when code is executing against live infrastructure.

​

Automated Security in CI/CD Pipelines

Xoxoday’s continuous integration and continuous delivery pipelines include automated security gates. Every code change must pass security checks before it is promoted toward production. This automation ensures that no deployment bypasses the security review process, regardless of release cadence or team.

​

Manual Code Reviews and Secure Coding Standards

Automated tooling is complemented by periodic manual code reviews conducted by Xoxoday’s security team. These reviews enforce secure coding standards and catch logic-level issues that static analysis may not surface. Developers work against documented secure coding guidelines that are updated as the threat landscape evolves.

​

Threat Modelling and Penetration Testing

Before significant features are implemented, Xoxoday’s engineering teams perform threat modelling exercises to anticipate attack vectors and design countermeasures proactively. Beyond ongoing SAST and DAST coverage, Xoxoday conducts annual penetration tests carried out by qualified external assessors. These tests validate the security posture of both application layers and underlying infrastructure, producing findings that feed directly back into the development roadmap. This layered approach — automated scanning, manual review, and independent third-party testing — gives your organisation confidence that Xoxoday’s applications meet enterprise-grade security standards throughout their lifecycle. Learn more: Xoxoday Help Centre — Authentication