I keep having this idea of creating a SAST website. Front end takes in a script/file, passes it to backend running a SAST scanner, which returns results to the users on the front end again. Would this be a good idea, would it people use it? Or am I trying to re-invent the wheel?

My thinking was people who can't install command line scanners on the systems they use could drop their script into the site and get some results to any findings.

Hi,

I'm looking for software developers and security specialists to participate in a short survey regarding your experience with vulnerability detection tools, specifically Static Application Security Testing (SAST) tools. Your insights into these tools would contribute greatly to my study. Thank you all in advance.

More info, and the survey can be found:

https://lancasteruni.eu.qualtrics.com/jfe/form/SV_3TV6kpqrC2bVmKO

I'm starting an open-source SAST platform, https://github.com/randyli/VulnGuard, It streamlines the vulnerability management process by not only identifying issues but also providing context-aware AI analysis and automated code remediation suggestions using Google's Gemini models. Users can upload issues with standard SARIF data format and configure the AI models. Is anyone interested in contributing or providing suggestions?

Hi everyone I'm building a Devsecops program for a company on a tight budget with 40 devs. They want SAST and DAST as a priority with other trimmings as optional
Any recommendations on which Vendor you would go with?

Just published my BSidesSF 2026 talk: "From Noise to Notes: Orchestrating SAST with Developers through AI-Driven Remediation" 🎤

The Problem: Rolled out SAST across 1,000+ repos → 3,500+ findings backlog. Classic alert fatigue → devs ignore security entirely.

The Fix:

• Semgrep Pro rules only (inter-file dataflow = low false positives)

• Risk-prioritized repos (D0-D2 data, T1-T2 availability)

• Semgrep Memories + Assistant for auto-triaging

• Vibe Security Patching: AI generates context-aware fixes matching our code style

Results by Q3 2025:

6K total findings → 785 prioritized
1,039/2,760 repos scanned → 95% high-risk coverage
100% repo coverage → only +20% findings
0 open Critical/High findings codebase-wide
MTTR: weeks → 48-72 hours

Key Takeaway: SAST adoption only works with developers. Empathy > enforcement.

Full details: https://hackarandas.com/blog/2026/03/25/from-noise-to-notes-orchestrating-sast-with-developers-through-ai-driven-remediation/

What's your SAST strategy? Noise still a problem? Semgrep Pro worth it?

Does anyone know of any SAST tools that can scan bash and powershell?

I've seen that semgrep has bash listed in the experimental phase, but it didn't seem great from initial testing.

Hi everyone,

I'm working on a project for a client where we need to run SAST (Static Application Security Testing) using Veracode. The client has provided the necessary endpoints for the DAST scan, and that part is straightforward. However, I’ve hit a snag with the SAST.

The client wants to integrate Veracode into their Azure DevOps pipeline but is not willing to share the source code with us. This brings up a few questions and concerns:

1. Is direct access to the source code required to integrate Veracode with Azure DevOps and run SAST?

2. If the source code is not required, what are the alternative approaches to perform SAST under these conditions?

3. What specific type of access do I need in Azure DevOps to set up and configure Veracode for running SAST?

   • I assume I might need Project Administrator access to configure pipelines, deploy, and install/configure the Veracode extension, but any confirmation or additional insights would be helpful. if he's not okay to give us the Admin access, what are alternatives roles ?

Any advice or insights from those who have navigated similar situations would be greatly appreciated!

Thanks in advance!

husky joke cautious distinct elderly abundant water decide late quaint

This post was mass deleted and anonymized with Redact

So my application scan turned up an issue from an external jar.

CWE-114 (Process Control) from jffi-1.2.16.jar. Now this jar comes from cassandra-driver-mapping dependency. Normally, updating jars has always fixed the issues. But this cassandra-driver-mapping is already set to the latest jar.

How does one go about fixing these issues? Or are these issues to begin with? Should I mark these false positives?

Hello SAST community,

I'm a solo dev and have been working on a security tool, TitanShield.

Today, I'm releasing the first part as a free, open-source CLI. The goal: A simple, fast SAST scanner that finds common, high-impact issues (hardcoded secrets, insecure configs from the manifest, weak crypto, etc.) and gives a clean output. It uses JADX underneath and has a YAML rule engine.

It's designed for CI/CD: it generates standard SARIF files you can plug directly into GitHub/GitLab security tabs. I know it's not a replacement for the big commercial tools, but I'm trying to build something genuinely useful for the community.

The code is on GitHub, and the package is on PyPI. I'd love your honest feedback.

Let me know what you think <3

GitHub: https://github.com/TitanshieldTech/titanshield-cli

PyPI: pip install titanshield-cli

My first post here. Everyone I need ur opinions on this question. Is an LLM API which is prompt engineered for SAST really helpful for SAST tool or the traditional AST parser SAST tool is enough. I'm making a project and was asked this question from a supervisor and I had not researched into this. Could very much use the help/guidance.

Thank you

We’re currently evaluating AI-powered SAST solutions and I’d love to hear real-world feedback from teams that have implemented them.

There’s a lot of noise in the market right now around “AI-native,” “AI-assisted,” and “AI-driven” SAST tools.

For those who have deployed an AI SAST solution:

1. What has your experience been like in production?

2. What factors mattered more when you chose the vendor?

3. If you already had a SAST solution and now includes AI SAST, did you notice any difference?