## Contents

- 7. What Shannon Doesn't Cover
- Complementary Tool Stack

## 7. What Shannon Doesn't Cover

Supplement with manual testing or other tools:

| Gap | Alternative |
|-----|------------|
| Business logic flaws | Manual review, threat modeling |
| Mobile app testing | OWASP MAS, Frida, Objection |
| Infrastructure/cloud | ScoutSuite, Prowler, CloudSploit |
| Container security | Trivy, Grype, Docker Bench |
| API rate limiting | Custom load testing (k6, Artillery) |
| GraphQL deep testing | InQL, graphql-cop |
| WebSocket testing | OWASP ZAP WebSocket plugin |
| Dependency vulnerabilities | npm audit, Snyk, Socket.dev |
| Secrets in source code | TruffleHog, GitLeaks, detect-secrets |
| CORS misconfiguration | CORScanner, manual review |
| HTTP request smuggling | smuggler, h2csmuggler |
| Race conditions / TOCTOU | Turbo Intruder, manual testing |
| Cache poisoning | Web Cache Deception Scanner |
| Host header injection | Manual review of password reset flows |

### Complementary Tool Stack

```bash
# Run alongside Shannon for full coverage:

# Dependency scanning (production deps only)
npm audit --omit=dev          # `--production` is deprecated; use `--omit=dev`
pnpm audit --prod             # pnpm equivalent
yarn npm audit --environment production   # Yarn Berry (v2+); classic: `yarn audit --groups dependencies`
npx snyk test

# Secret detection
trufflehog git file://. --only-verified

# Container scanning
trivy image myapp:latest

# Infrastructure
prowler aws --severity critical high

# API fuzzing
schemathesis run http://localhost:3000/openapi.json
```

---