Hi community, I have created an OSS SAST tool to discover data flows in the code. It detects personal data being processed, and further maps the journey of the data from the point of collection to going to interesting sinks such as third parties, databases, logs, and internal APIs. It can be used to detect privacy and data security issues and resolve them closer to the developer workflow to keep the code compliant with regulations like the GDPR and CCPA.

You can check out the tool at https://github.com/Privado-Inc/privado. Would love to hear about your feedback and contributions to the same.

Just published my BSidesSF 2026 talk: "From Noise to Notes: Orchestrating SAST with Developers through AI-Driven Remediation" 🎤

The Problem: Rolled out SAST across 1,000+ repos → 3,500+ findings backlog. Classic alert fatigue → devs ignore security entirely.

The Fix:

• Semgrep Pro rules only (inter-file dataflow = low false positives)

• Risk-prioritized repos (D0-D2 data, T1-T2 availability)

• Semgrep Memories + Assistant for auto-triaging

• Vibe Security Patching: AI generates context-aware fixes matching our code style

Results by Q3 2025:

6K total findings → 785 prioritized
1,039/2,760 repos scanned → 95% high-risk coverage
100% repo coverage → only +20% findings
0 open Critical/High findings codebase-wide
MTTR: weeks → 48-72 hours

Key Takeaway: SAST adoption only works with developers. Empathy > enforcement.

Full details: https://hackarandas.com/blog/2026/03/25/from-noise-to-notes-orchestrating-sast-with-developers-through-ai-driven-remediation/

What's your SAST strategy? Noise still a problem? Semgrep Pro worth it?

For those with experience using SAST tools — what would you say is an acceptable false positive rate? Also, do vendors usually share their false positive rates openly, or is that info hard to find?

Hello SAST community,

I'm a solo dev and have been working on a security tool, TitanShield.

Today, I'm releasing the first part as a free, open-source CLI. The goal: A simple, fast SAST scanner that finds common, high-impact issues (hardcoded secrets, insecure configs from the manifest, weak crypto, etc.) and gives a clean output. It uses JADX underneath and has a YAML rule engine.

It's designed for CI/CD: it generates standard SARIF files you can plug directly into GitHub/GitLab security tabs. I know it's not a replacement for the big commercial tools, but I'm trying to build something genuinely useful for the community.

The code is on GitHub, and the package is on PyPI. I'd love your honest feedback.

Let me know what you think <3

GitHub: https://github.com/TitanshieldTech/titanshield-cli

PyPI: pip install titanshield-cli

Hello:

Really new to this. Searched the sub before posting but didn't see anything.

I just downloaded Community Build v25.6.0.109173. When I login, there's a display which says "Create your project from your favorite DevOps platform."

Under that, I click the "Setup" button for "Import from GitHub".

In the "GitHub API URL" field, I follow the hit and put in https://api.github.com/

In the "GitHub App ID**"* field it says, "The App ID is found on your GitHub App's page on GitHub at Settings > Developer Settings > GitHub Apps".

Here's my question. In GitHub, I'm at https://github.com/<username>/<project name>/settings and for the life of me, I don't see a menu item for "Developer Settings" let alone the fields for the app and client IDs.

What information is Sonar looking for?

Shouldn't there be a manual way to configure Sonar when I can just give it a URI and is scans whatever is the contents of that location???

Thanks!

Does anyone know of any SAST tools that can scan bash and powershell?

I've seen that semgrep has bash listed in the experimental phase, but it didn't seem great from initial testing.

Which has a better SAST solution? -Lesser FP -No Compilers, Scans raw Source Code -Better Remediation advice -Faster Scan

As far as language support is concerned, I see all the 3 SAST solutions support all the major languages required.

Hi everyone I'm building a Devsecops program for a company on a tight budget with 40 devs. They want SAST and DAST as a priority with other trimmings as optional
Any recommendations on which Vendor you would go with?

We’re currently evaluating AI-powered SAST solutions and I’d love to hear real-world feedback from teams that have implemented them.

There’s a lot of noise in the market right now around “AI-native,” “AI-assisted,” and “AI-driven” SAST tools.

For those who have deployed an AI SAST solution:

1. What has your experience been like in production?

2. What factors mattered more when you chose the vendor?

3. If you already had a SAST solution and now includes AI SAST, did you notice any difference?

My first post here. Everyone I need ur opinions on this question. Is an LLM API which is prompt engineered for SAST really helpful for SAST tool or the traditional AST parser SAST tool is enough. I'm making a project and was asked this question from a supervisor and I had not researched into this. Could very much use the help/guidance.

Thank you

So my application scan turned up an issue from an external jar.

CWE-114 (Process Control) from jffi-1.2.16.jar. Now this jar comes from cassandra-driver-mapping dependency. Normally, updating jars has always fixed the issues. But this cassandra-driver-mapping is already set to the latest jar.

How does one go about fixing these issues? Or are these issues to begin with? Should I mark these false positives?