I Built a 100% Offline SAST Scanner That Finds What Semgrep and CodeQL Miss

I spent the last few months building a fully offline SAST security scanner that I think deserves more...

mercoledì 8 luglio 2026 New tab

200 words~1 min read

I spent the last few months building a fully offline SAST security scanner that I think deserves more attention.

The Problem

Most free static analysis tools (Bandit, Semgrep OSS) focus on injection bugs like SQLi and XSS. They completely miss authorization flaws — the IDOR, auth bypass, and ownership verification issues that cause real data breaches. Tools like CodeQL can find these but require manual query writing and a massive database.

What Ansede Static Does Differently

Built-in IDOR/auth bypass detection — no custom rules needed

I Built a 100% Offline SAST Scanner That Finds What Semgrep and CodeQL Miss

I Built a 100% Offline SAST Scanner That Finds What Semgrep and CodeQL Miss

Related reading

The problem with security scanners isn't the scanning

I was tired of security scanners with 90% false positives, so I built my own

I built Sentinel: A blazing fast, regex-free secret scanner in Go 🛡️

I built a security scanner, never shipped it, and finally finished the job

I built an open-source DAST scanner that outfound ZAP

Building a Deterministic Security Scanner for AI-Generated Code

Related reading

The problem with security scanners isn't the scanning

I was tired of security scanners with 90% false positives, so I built my own

I built Sentinel: A blazing fast, regex-free secret scanner in Go 🛡️

I built a security scanner, never shipped it, and finally finished the job

I built an open-source DAST scanner that outfound ZAP

Building a Deterministic Security Scanner for AI-Generated Code