How we use an LLM to triage SAST findings, and what we never send it

Описание и применение

<p>Static analysis tools are pattern matchers. That's their strength (fast, deterministic, explainable) and their weakness: a rule that matches string-built SQL can't tell whether the string came from a user or a constant. So you get findings that are technically correct and practically irrelevant, and teams learn to ignore the whole report.</p> <p>In <a href="https://openrouting.si/?utm_source=devto&amp;utm_medium=referral&amp;utm_campaign=llm-triage-sast-findings" rel="noopener noreferrer">OpenRouting</a> we keep the scanner as the source of truth and add a review step: Claude, via Amazon Be

Задача

<p>Static analysis tools are pattern matchers. That's their strength (fast, deterministic, explainable) and their weakness: a rule that matches string-built SQL can't tell whether the string came from a user or a constant. So you get findings that are technically correct and practically irrelevant, and teams learn to ignore the whole report.</p> <p>In <a href="https://openrouting.si/?utm_source=devto&amp;utm_medium=referral&amp;utm_campaign=llm-triage-sast-findings" rel="noopener noreferrer">OpenRouting</a> we keep the scanner as the source of truth and add a review step: Claude, via Amazon Be

Результат

<p>Static analysis tools are pattern matchers. That's their strength (fast, deterministic, explainable) and their weakness: a rule that matches string-built SQL can't tell whether the string came from a user or a constant. So you get findings that are technically correct and practically irrelevant, and teams learn to ignore the whole report.</p> <p>In <a href="https://openrouting.si/?utm_source=devto&amp;utm_medium=referral&amp;utm_campaign=llm-triage-sast-findings" rel="noopener noreferrer">OpenRouting</a> we keep the scanner as the source of truth and add a review step: Claude, via Amazon Be

Доказательства

How we use an LLM to triage SAST findings, and what we never send it

Источник