LATIDIA · Ciberseguridad

VulnSAGE: Adjudicación de informes SAST conectando el razonamiento de LLM con la estructura del programa

arXiv:2610.23035v1 Announce Type: cross Abstract: Static Application Security Testing (SAST) reporta operaciones flag cuya seguridad depende del contexto específico del proyecto, y los mantenedores deben decidir qué informes describen re

La noticia

arXiv:2610.23035v1 Announce Type: cross Abstract: Static Application Security Testing (SAST) reports flag operations whose safety depends on project-specific context, and maintainers must decide which reports describe real defects. Large language models (LLMs) can interpret this context, but adjudicating a report with them requires the decisive code, which often lies far from the reported line, and a decision basis that program analysis can check. We present VulnSAGE, an adjudication system for SAST reports that connects LLM reasoning to program structure in both directions. Its report-centered slicer recovers the dependencies of the reported operation together with the program structure that explains them, such as the caller object on which a helper acts.