Spent 3 hours chasing a false positive from our new SAST tool, it flagged a string concat as SQL injection

Aaron Chen · 2026-10-14T21:40:04.264924+00:00

Last Thursday I was at my desk in Austin trying to close out a sprint when the tool lit up 47 criticals on a tiny Flask service that just builds a welcome message. Turns out it was matching any string concat near a DB call, so I turned off that rule set and wrote a wrapper that only runs the scanner on changed files in the PR, which cut the noise to almost nothing. Does anyone else here pick rules one by one or do you just ditch the whole default policy and start clean?

SMM Buzz

Loading…

Spent 3 hours chasing a false positive from our new SAST tool, it flagged a string concat as SQL injection | Appsec Tools - SMM Buzz