Developers want to write code and security testers want to break it. The problem is security testers need to know more about code to do better testing and developers need to be able to quickly address problems found by testers. This presentation looks at both groups and their toolsets and explores ways they can help each other out. Using open source examples built on OWASP ZAP, ThreadFix and Eclipse, the presentation walks through the process of seeding web applications scans with knowledge gleaned from code analysis as well as the mapping of dynamic scan results to specific line of code.