{"id":"https://openalex.org/W7160831313","doi":"https://doi.org/10.48550/arxiv.2605.07900","title":"Longitudinal Analyses of SAST Tools: A CodeQL Case Study","display_name":"Longitudinal Analyses of SAST Tools: A CodeQL Case Study","publication_year":2026,"publication_date":"2026-05-08","ids":{"openalex":"https://openalex.org/W7160831313","doi":"https://doi.org/10.48550/arxiv.2605.07900"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.07900","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.07900","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.07900","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5110190353","display_name":"Jean-Charles Noirot Ferrand","orcid":"https://orcid.org/0009-0009-9650-4011"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ferrand, Jean-Charles Noirot","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082300182","display_name":"Kyle Domico","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Domico, Kyle","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007771274","display_name":"Yohan Beugin","orcid":"https://orcid.org/0000-0003-0991-7926"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Beugin, Yohan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135891932","display_name":"Patrick McDaniel","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"McDaniel, Patrick","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.3179999887943268,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.3179999887943268,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.2329999953508377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.15569999814033508,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/codebase","display_name":"Codebase","score":0.8119000196456909},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6140999794006348},{"id":"https://openalex.org/keywords/measure","display_name":"Measure (data warehouse)","score":0.47369998693466187},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.45419999957084656},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.45159998536109924},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.4498000144958496},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4115999937057495}],"concepts":[{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.8119000196456909},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6908000111579895},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6140999794006348},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.47369998693466187},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.45419999957084656},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.45159998536109924},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4498000144958496},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4115999937057495},{"id":"https://openalex.org/C112972136","wikidata":"https://www.wikidata.org/wiki/Q7595718","display_name":"Stability (learning theory)","level":2,"score":0.38909998536109924},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3617999851703644},{"id":"https://openalex.org/C199519371","wikidata":"https://www.wikidata.org/wiki/Q942695","display_name":"Source lines of code","level":3,"score":0.33219999074935913},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3237000107765198},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.3199999928474426},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.3077999949455261},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2906999886035919},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.26409998536109924},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.2565000057220459},{"id":"https://openalex.org/C3020672099","wikidata":"https://www.wikidata.org/wiki/Q857354","display_name":"Longitudinal data","level":2,"score":0.2554999887943268}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.07900","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.07900","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.07900","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.07900","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Open-source":[0],"software":[1],"(OSS)":[2],"pipelines":[3],"rely":[4],"on":[5,72,79,86,173],"automated":[6],"static":[7,45,66],"analysis":[8,67],"tools":[9,28,50,271],"to":[10,43,92,117,197],"prevent":[11,280],"the":[12,24,30,56,63,97,136,145,150,156,169,174,198,219,228,234,304],"introduction":[13],"of":[14,23,26,60,82,96,106,135,158,171,184,191,218,225,275,292,303],"vulnerabilities":[15,119,282],"in":[16,100,206,227,233,299],"code.":[17],"However,":[18],"there":[19],"is":[20,272],"limited":[21],"understanding":[22],"efficacy":[25],"these":[27,128],"across":[29,166,213,246],"OSS":[31,73],"ecosystem":[32],"over":[33,84,144],"time.":[34],"In":[35],"this":[36],"paper,":[37],"we":[38,110,125,154,238],"introduce":[39],"a":[40,182,193,256,273],"novel":[41],"method":[42],"evaluate":[44],"application":[46],"security":[47],"testing":[48],"(SAST)":[49],"through":[51,132],"longitudinal":[52],"measurements":[53],"and":[54,140,168,187,259],"perform":[55],"largest":[57],"academic":[58],"study":[59,155,266],"CodeQL":[61,83,159,172,180,194],"--":[62,71],"most":[64],"prevalent":[65],"tool":[68],"from":[69,89,283],"GitHub":[70],"codebases.":[74],"We":[75,177],"apply":[76],"our":[77],"apparatus":[78],"114":[80],"versions":[81,167,247],"time":[85],"3993":[87],"CVEs":[88,250],"1622":[90],"repositories":[91],"measure":[93,111],"key":[94],"properties":[95],"tool,":[98],"culminating":[99],"more":[101,222],"than":[102,223],"20":[103],"billion":[104],"lines":[105],"code":[107],"analyzed.":[108],"First,":[109],"its":[112,115],"effectiveness,":[113],"i.e.,":[114],"ability":[116],"detect":[118,201],"before":[120],"they":[121,279],"are":[122,205,211,231,243],"fixed.":[123],"Then,":[124],"determine":[126],"whether":[127],"detections":[129,164,204,242,300],"were":[130,251,262],"actionable":[131,208],"two":[133],"measures":[134],"distance":[137],"between":[138],"findings":[139,210,226],"vulnerability":[141,163],"location":[142],"either":[143],"entire":[146],"codebase":[147],"or":[148],"within":[149],"vulnerable":[151,229,235],"file.":[152],"Finally,":[153,237],"stability":[157],"by":[160],"examining":[161],"how":[162],"hold":[165],"evolution":[170],"accuracy-precision":[175],"trade-off.":[176],"find":[178],"that":[179,188,240,261,268,287,294],"identifies":[181],"total":[183],"171":[185,220],"CVEs,":[186],"for":[189,216],"83":[190],"them,":[192],"version":[195,257],"prior":[196],"fix":[199],"could":[200],"it.":[202],"Such":[203],"general":[207],"if":[209],"triaged":[212],"files,":[214],"as":[215,248,278],"50%":[217,224],"detections,":[221],"file":[230],"located":[232],"location.":[236],"show":[239],"CVE":[241],"not":[244],"monotonic":[245],"21":[249],"no":[252],"longer":[253],"detected":[254],"following":[255],"change":[258],"17":[260],"never":[263],"redetected.":[264],"Our":[265],"shows":[267],"using":[269],"SAST":[270],"matter":[274],"best":[276],"practice":[277],"numerous":[281],"being":[284],"introduced,":[285],"but":[286],"developers":[288],"should":[289],"be":[290],"aware":[291],"changes":[293],"may":[295],"leave":[296],"blind":[297],"spots":[298],"upon":[301],"updates":[302],"tool.":[305]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-12T00:00:00"}