Notifications
Clear all
Topic starter
02/08/2026 12:04 pm
TL;DR: AST-based SAST tools can reliably detect injection classes, but they routinely miss authentication bypass, broken access control, and privilege escalation because those flaws emerge from cross-file and cross-service logic, according to Gecko Security. Semantic indexing, not more signatures, is the architectural shift needed to reason about missing checks and incorrect security policy.
NHIMG editorial — based on content published by Gecko Security: why AST-based static analysis misses business logic vulnerabilities
Questions worth separating out
Q: What breaks when static analysis only understands syntax and not system context?
A: It misses vulnerabilities that depend on relationships between files, services, and identity context.
Q: Why do business logic flaws survive traditional application security scanning?
A: They survive because they violate intent rather than syntax.
Q: How can security teams know whether their code analysis is good enough for authorization risks?
A: They should verify that the tool can resolve symbols across repositories, trace call chains through service contracts, and highlight missing checks rather than only unsafe sinks.
Practitioner guidance
- Require semantic code coverage for authorization paths Inventory the endpoints, service calls, and repository boundaries that enforce ownership or role checks.
- Map every user-facing request to its downstream trust boundary Trace where user context is introduced, transformed, and discarded in gateway, service, and data layers.
- Test for missing authorization rather than only unsafe input Add security tests that assert ownership, tenant scoping, and role validation at the service layer.
What's in the full article
Gecko Security's full article covers the implementation detail this post intentionally leaves for the source:
- A worked Cal.com walkthrough showing how three separate bugs combined into one authentication bypass
- A practical explanation of why taint analysis still fails even when symbol resolution is improved
- A comparison of AST parsing, semantic indexing, and language-server style resolution for security tooling
- Examples of how cross-repo and microservice call chains can be traced in real analysis workflows
👉 Read Gecko Security's analysis of why AST-based SAST misses business logic flaws →
Semantic code analysis and business logic flaws: where do AST tools fail?
Explore further
02/08/2026 1:10 pm
Semantic completeness is now a security requirement, not just a developer convenience. The article shows that AST-level visibility is not enough when the defect depends on relationships between functions, repositories, and services. Security teams should treat semantic indexing as part of the control surface for detecting authorization failures, not as an optional enhancement to scanning. The practical conclusion is that analysis tooling must understand code as a connected system.
A question worth separating out:
Q: What should teams do when gateway controls do not match downstream service enforcement?
A: Treat that as an explicit trust boundary failure, not a minor implementation gap. Re-test the service layer independently, require ownership or role validation at the point of data access, and use the mismatch to drive code review and test coverage changes before attackers can exploit the gap.
👉 Read our full editorial: Semantic code analysis is exposing business logic flaws SAST misses
