Source Code Testing
Having a professional consultant use source code testing tools is the most comprehensive and effective way to identify potential security vulnerabilities in applications
With the development and application of a large number of modern software programs, program vulnerabilities and information security risks are worrying. Hackers often exploit software vulnerabilities to attack and steal data, and it has become more difficult for developers and maintenance personnel to manage information security. Increasingly shorter software development life cycles make it particularly important to quickly and accurately identify software security risks.
Our professional service team uses source code security testing tools to examine the source codes of applications. Professional consultants analyze test results to list potential security vulnerabilities in the applications in detail. The team also provides the reasons for the occurrence of the vulnerabilities and professional advice on improvement, so that application developers can correctly and quickly fix the application vulnerabilities and strengthen application protection to avoid attacks such as SQL injection and cross-site scripting.
Simulate the Hacker Mindset with Rich Experience in Attack and Defense Exercises to Discover Unknown Vulnerabilities Early
Source Code Testing's Advantages and Benefits
Testing by Professional Teams
With rich experience in security software and program development as well as security testing, our professional testing team provides customers with effective patching advice from a developer’s point of view to help developers improve their development efficiency
International Standards
Through professional tools and expert experience, we ensure that programs are written in ways in line with the industry's best practices to meet international standards, thereby achieving software security and enhancing user trust and reputation
Professional Test Reports and Consulting Services
We follow domestic and international security standards, and provide customers with reports and consulting services for vulnerabilities and deficiencies found during testing to help developers reduce application security risks
Reduced Enterprise Labor and Tool Costs
You can use this service without spending a lot of money on testing tools or products. It is suitable for organizations that provide web application services but do not have their own application developers, or those that have few applications and infrequent demand changes
Enhanced Application Security
Our complete, effective, accurate, and fast source code testing can help identify security vulnerabilities and deficiencies in code to improve application security and program performance stability
OpenText MSP partner
ISSDU is a certified OpenText Managed Service Provider (MSP) partner, equipped with expert knowledge and capabilities in security software testing. In the ever-evolving landscape of cybersecurity vulnerabilities, we deliver the most professional source code scanning services, meeting diverse client needs with timely remediation and response.
Source Code Testing Service Flow
01
Project Initiation
Confirm project requirements, test objects, and execution specifications, complete test environment creation, and obtain legal authorization from customers.
02
Testing Execution
Execute testing as needed, including two source code tests, and provide a test report after each test for development departments to fix program vulnerabilities.
03
Test Reports and Consulting Services
Give advice on vulnerability patching, assist customers in writing handling instructions by themselves or by the application developer/maintenance vendor, and then provide a final test report based on the handling result after consultants' assessments.
源碼檢測常見問題
數聯資安採用 OpenText™ Static Application Security Testing (OpenText SAST)（原 Fortify Static Code Analyzer / Fortify SCA）進行原始碼安全檢測。該工具為全球應用程式安全測試（SAST）市場的領導品牌，已連續十一年獲 Gartner 魔力象限報告（Application Security Testing）評選為領導者。
在檢測能力方面，OpenText SAST 支援 45 種以上程式語言與超過 1,500 種漏洞類型，可涵蓋 OWASP Top 10、CWE/SANS Top 25、DISA STIG、PCI DSS 等多項國際資安標準。透過自動化掃描與精確的程式碼行定位，協助開發團隊快速識別並修補潛在弱點。
數聯資安採用的 Fortify SCA 支援 44 種以上程式語言與框架，涵蓋範圍包括（但不限於）：
- 網頁應用：Java、PHP、ASP.NET（C#、VB.NET）、Python、Ruby（含 Ruby on Rails）、Go
- 行動應用：Kotlin、Swift／Objective-C、Android（Java）
- 前端與腳本：JavaScript、TypeScript、Angular
- 系統與嵌入式：C／C++、Rust、Ada
- 其他：COBOL、ABAP、PL/SQL、T-SQL、Groovy、PowerShell等
此外，Fortify SCA 持續擴充語言支援，最新版本已加入透過 AI 分析器支援 Rust、Ruby、Bash 等 12 種語言。
可以。 OpenText SAST 支援多種國際資安標準的報告產出，包括：
- OWASP Top 10（含 2017、2021、2025 版本，以及 OWASP Mobile Top 10）
- CWE／SANS Top 25
- DISA STIG 與 PCI DSS 合規標準
報告可依上述標準分類輸出，亦可提供客製化報表。產出格式涵蓋 PDF、HTML、DOC、XLS 等，內容包含漏洞種類、嚴重等級、程式碼檔案名稱、漏洞行數及具體修改建議，方便開發與稽核人員參考使用。
