SAST findings vary widely across 12 OCPP 1.6 language ports
SonarQube, Semgrep, and language-specific analyzers reported two issues in Rust and 1,689 in Java.
Stories per day · 30 days
4 RSS
Relatedstatic-analysis5llm2sca2snyk2ai-agents1appsec1aspm1bearer-cli1c-cpp1devsecops1ev-charging1false-positives1gdpr1github1gitlab1llm4sast1memory-safety1metamorphic-testing1
18 stories, newest first · one card per story
Stories tagged #sast
VulnBench 2.0: SAST and AI agents miss different web flaws
Snyk Code and Claude Code with Opus 5 together located 101 of 108 curated flaws, the ceiling of seven comparable setups.
Wiz describes ASPM prioritization with code-to-cloud context
The post explains finding enrichment, deduplication and attack-path scoring inside Wiz Code, not a new incident.
Buyer’s guide compares 12 DevSecOps platforms for 2026
The roundup judges GitHub, GitLab, JFrog, Snyk, and others on scanning depth, workflow fit, and pricing.
Bearer CLI scans source code and ranks flaws by sensitive data
The free Elastic License 2.0 SAST tool covers seven languages and can emit a privacy report for GDPR records.
2
VulnSAGE checks LLM judgments of SAST reports against program structure
On 187 labeled reports it rejected 89 of 97 false alarms and kept 85 of 90 real defects.
Evaluating and Improving Static Application Security Testing Tools for Rust
Researchers evaluate Rust SAST tools and use LLM framework TRUST to uncover 46 faults.
Combining LLM and Dynamic Analysis for Universal Testing of Static Application Security Testing Tools
LLM4SAST finds 66 SAST-tool faults, with 32 confirmed or fixed by developers.
12 Best SAST Tools Compared (2026): Features & Pricing
A 2026 comparison ranks twelve SAST tools, with CodeQL, Snyk Code, and SonarQube leading their lanes.
Top 10 Best IAST Tools in 2026 [Ranked & Scored]
A 2026 IAST ranking puts Contrast Security first, then Black Duck Seeker and Datadog.
Introducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure
Wiz launched AI SAST in public preview to find code flaws traditional scanners miss.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
A 2026 editorial ranking puts Snyk Code first among ten SAST tools, ahead of CodeQL and Semgrep.
OWASP Noir: Open-source static analysis tool
OWASP Noir statically inventories API endpoints across 29 languages and 205 frameworks, surfacing shadow APIs and hardcoded secrets for reviewers and DAST tools.
Trajectory-Level Security Debt in LLM Coding Agents
A new metric tracks static-analysis security debt across intermediate states of LLM coding agents, not just final code.
Triage is where backlogs are born. Checkmarx Triage & Remediation Assist is how they’re cleared.
Checkmarx launches Triage & Remediation Assist, an AI feature in Checkmarx One that assesses SAST/SCA finding reachability and generates suggested code fixes.
An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities
Study of 167 Java CVE instances finds CodeQL false positives follow recurring patterns; query refinements remove 81.8% of reviewed ones.
How Developers Prevent Production Risk at the Source
Wiz argues shift-left code-stage security cuts remediation costs and ships Wiz Code, WizOS, and WizCLI to catch flaws pre-deployment.
3
GitLab 19.3 helps enterprises scale agentic development securely
GitLab 19.3 runs its Duo Agent Platform AI Gateway inside Dedicated single-tenant environments and adds Secrets Manager plus agentic SAST remediation.
4