Know Your Tools: Quirks And Flaws, Integrating SAST Into Your Pipeline
summary
Explains why SAST often misses or misreports vulnerabilities: incomplete models from unresolved imports, weak language feature support, and different analyzer types. Shows concrete examples with pylint, Bandit and a commercial scanner where Bandit requires explicit file listing, unresolved imports hide insecure RNG, and Scala string interpolation causes false negatives then false positives. Describes analyzers (semantic, structural, control‑flow, data‑flow analysis is slow but most powerful, configurational) and recommends testing model completeness and adding custom rules and tests.
AI-written summary · about
chapters (20)
- 0:00Introduction to SAST
- 1:25Speaker introduction
- 2:10How modern SAST tools work
- 6:31Incomplete model examples
- 10:55Language feature support issues
- 13:21Ensuring model completeness
- 15:30Analysis phase overview
- 15:53Semantic analyzer
- 18:00Structural analyzer
- 18:41Control flow analyzer
- 20:47Data flow analyzer
- 23:39Incremental mode limitations
- 24:21Data flow example
- 25:46Configurational analyzer
- 26:28Common analyzer pitfalls
- 28:19False positives and negatives
- 31:34Vulnerabilities SAST misses
- 32:36Selecting the right SAST tool
- 33:39Post-implementation tips
- 34:25Conclusion and Q&A
related talks
51mThe great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)
33mOverwhelmed by Vulnerability Triage Hear a Blend of Finest Best Practices
26mSecurity Automation For GraphQL
41mVulnerabilities that Hide from your Tools
44mSecurity Practices Useful in Agile Development
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
25mHow to select between SAST, DAST, IAST, RASP, and AST
39mPractical Static Analysis for Continuous Application Security