The classical challenge with static application security testing (SAST) was bridging the gap between security and development. In SAST's early days, it was a tool for security pros, who threw the results of prerelease scans over the wall to developers to fix. Developers had to contend with large numbers of unclear findings and false positives, [...]