4 ms·
Vulnerability scanner targeting logic bugs
- Oatcake21 8mo agoI built a vulnerability scanner targeting logic bugs that Semgrep, CodeQL, and Snyk structurally cannot catch because they pattern-match syntax, not behaviour. SAST tools find SQL injection and XSS. They cant find a booking endpoint that lets any authenticated user delete another user’s booking. The code is syntactically valid — the bug is in what’s missing (an ownership check), not what’s present.