Reducing SAST False Positives: A Practical Guide

// SAST flags this as potential SQL injection
String query = "SELECT * FROM users WHERE id = " + userId;
Statement stmt = conn.createStatement();
stmt.executeQuery(query);

# Scan only new findings compared to baseline
semgrep scan \
  --config=p/owasp-top-ten \
  --baseline-commit=$(git merge-base HEAD origin/main) \
  --json \
  > findings.json

- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: java

- name: Analyze
  uses: github/codeql-action/analyze@v3
  with:
    # Only fail on new results vs default branch
    upload: true

# Save baseline
bandit -r src/ -f json > bandit-baseline.json

# Future runs: only show new findings
bandit -r src/ -f json | \
  python3 -c "
import json, sys
current = json.load(sys.stdin)['results']
with open('bandit-baseline.json') as f:
    baseline = {r['filename'] + str(r['line_number']): r for r in json.load(f)['results']}
new = [r for r in current if r['filename'] + str(r['line_number']) not in baseline]
print(json.dumps(new, indent=2))
"

# .semgrep.yml — curated ruleset for a Node.js/Express app
rules:
  - id: nosql-injection
    patterns:
      - pattern: db.collection($X).find({$FIELD: req.params.$PARAM, ...})
    message: Potential NoSQL injection
    severity: ERROR
    languages: [javascript, typescript]

# Explicitly disable categories that don't apply
exclude-rules:
  - java.*          # We don't use Java
  - php.*           # We don't use PHP
  - python.django.* # We don't use Django

# Fail CI only on high and critical
semgrep scan --config=auto --severity=ERROR --severity=WARNING \
  | jq '[.results[] | select(.extra.severity == "ERROR" or .extra.severity == "WARNING")] | length' \
  | xargs -I{} test {} -eq 0

# Log but don't fail on low severity
semgrep scan --config=auto --severity=INFO > low-severity.log || true

# Bad: suppression without justification
result = db.execute(query)  # nosec

# Good: suppression with justification
# nosec: B608 - query is constructed from integer ID, not user string input
result = db.execute(f"SELECT * FROM users WHERE id = {user_id}")

// lgtm[java/sql-injection] - userId is validated as integer by Spring @PathVariable
String query = "SELECT * FROM users WHERE id = " + userId;

# List all suppressions in the codebase
grep -rn "nosec\|noqa\|lgtm\|# type: ignore" src/ | \
  grep -v ":#" | \
  sort > suppressions-audit.txt

# Example: flag use of our legacy unsafe helper that was deprecated
rules:
  - id: legacy-unsafe-query
    pattern: LegacyDB.rawQuery($ARGS)
    message: "Use SafeDB.query() instead. LegacyDB.rawQuery() doesn't sanitize inputs."
    severity: ERROR
    languages: [java]

  - id: safe-db-pattern
    # Document the approved pattern so SAST recognizes it as safe
    pattern: SafeDB.query($PREPARED_STMT, $PARAMS)
    # This rule is informational — used to confirm safe usage
    severity: INFO

PR Opened
    │
    ▼
SAST Scan (new findings only, vs baseline)
    │
    ├── CRITICAL/HIGH new findings → Block PR, require security review
    │
    ├── MEDIUM new findings → Comment on PR, don't block
    │
    └── LOW/INFO new findings → Log to dashboard, weekly triage
    │
    ▼
Weekly Triage
    ├── Review medium findings accumulated in the week
    ├── Promote any confirmed medium → high
    └── Add suppressions for confirmed false positives
    │
    ▼
Sprint Cleanup
    ├── Select 5 legacy baseline findings to address per sprint
    └── Reduce baseline debt over time

False Positive Rate = (Findings suppressed as FP) / (Total findings) × 100

# Count total findings
TOTAL=$(semgrep scan --config=auto --json | jq '.results | length')

# Count suppressed findings (findings that were manually dismissed)
SUPPRESSED=$(cat .semgrep-suppressions.json | jq '. | length')

echo "False positive rate: $(echo "scale=1; $SUPPRESSED * 100 / $TOTAL" | bc)%"