Blog

SAST: Finding Vulnerabilities in Source Code with CodeQL, Semgrep and .NET Security Analyzers

SAST looks for paths where user input (a source) reaches a dangerous call (a sink) without a sanitizer; it only sees the sinks it models and cannot find business rule or authorization gaps. At Bookstore we run CodeQL, Semgrep and the .NET security analyzers against the same five problems and show with real output who found what, a tested Bookstore-specific Semgrep rule, false positive triage and a pipeline that fails only on new findings.