A survey of millions of applications submitted for analysis showed that nearly 75 percent have security flaws, that applications become less secure as they age, and that of the top three programming languages used in business, JavaScript applications tend to have fewer issues and faster remediation than those written in Java or .NET.

The State of application security report from application security company Veracode is based on analysis scans of code submitted for testing. There are three main types of scan: dynamic analysis which looks at runtime behavior, statis analysis which inspects the code, and composition analysis which checks third-party libraries against a database of known flaws.

The three types of analysis reveal different flaws. Top issues found by static analysis are CRLF injection (when an unexpected line terminator is not removed from input), cryptographic issues, and information leakage. Top in dynamic analysis is server misconfiguration, insecure dependencies, and again information leakage. Composition analysis puts information leakage top, followed by insufficient input val