Q003 — Large OSS Projects and Bespoke CI Tooling — Reading List¶

Should Read¶

Semgrep vs. CodeQL: Technical Comparison
Konvu · 2026-03-16
Documents fundamental SAST limitations: cannot detect business logic vulnerabilities, authorization bypass, race conditions. Rule coverage is the primary detection lever.
Why read: Explains why standard SAST tools may be insufficient for large, complex codebases — the limitations documented here provide a theoretical basis for why projects might build bespoke tooling.