sast

JSEF adds a vulnerability-hunting benchmark that scores SAST tools and LLMs on identical prompts, with 52 machine-readable checkpoints across difficulty levels, using Youden Index scoring. MIT licensed.

Velonus is an open-source AppSec scanner for Python that runs five security tools in one command, normalizes findings, and deduplicates noise, with support for SARIF output and CI integration.

OpenAI explains why Codex Security deliberately avoids starting with SAST reports, instead analyzing repository architecture and validating findings directly. The approach addresses the core challenge that hardest vulnerabilities involve whether security checks actually work across transformation chains, not just data flow tracking.