Tutorial 8: SAST, AI, and Human on Vulnerability Detection

A junior developer built a task-management REST API over the weekend. The code compiles and all unit tests pass. Three reviewers are about to look at it: a static analysis tool, an AI assistant, and you. Your job is to run both automated approaches, record what each finds, and apply your own judgement to determine what is real — then compare how well each approach did.

Concepts covered: SAST tools (Bandit, Semgrep), AI-assisted code review, true positives vs false positives, OWASP Top 10 mapping, CWE identifiers, cross-tool consistency

Format: Pairs or small groups | Duration: 2 hours | Tool: Python, Bandit, Semgrep, AI assistant (your choice)

Outline

• Phase 1: Setup
• Phase 2: SAST Analysis
• Phase 3: AI Analysis
• Phase 4: Comparison Worksheet
• Phase 5: Fix the True Positives
• Phase 6: Group Discussion
• Reference: Bandit Rule Codes
• References

Learning Objectives

By the end of this tutorial you will be able to:

1. Run Bandit and Semgrep against a Python codebase and interpret their output.
2. Query an AI assistant to identify security vulnerabilities and record its findings systematically.
3. Apply human judgement to classify each finding as a true positive or false positive.
4. Compare what SAST tools, AI assistants, and human review each find — and what each misses.
5. Explain why consistency between tools does not guarantee correctness.

Phase 1 — Setup (~10 min)

Step 1: Install the SAST tools

The lab file is at labs/ch08_vulnerable_app.py. Install Bandit and Semgrep into a virtual environment:

python -m venv .venv && source .venv/bin/activate
pip install flask bandit semgrep

Verify:

bandit --version
semgrep --version

Step 2: Declare your AI tool

Before running any analysis, record which AI assistant your group will use for Phase 3. Write it down — you will need it for the comparison worksheet.

You will use the same tool for all AI analysis in this tutorial. Do not switch mid-exercise.

Phase 2 — SAST Analysis (~15 min)

Run each tool against the lab file and save the output so you can refer back to it.

Bandit:

# Medium-and-above severity, JSON output
bandit -r labs/ch08_vulnerable_app.py -ll -f json -o bandit_results.json

# Human-readable
bandit -r labs/ch08_vulnerable_app.py -ll

Semgrep:

semgrep --config=auto labs/ch08_vulnerable_app.py --json -o semgrep_results.json

# Human-readable
semgrep --config=auto labs/ch08_vulnerable_app.py

For each finding, note:

• Which tool reported it
• The rule ID (e.g., B608, python.lang.security.audit.eval-detected)
• The line number
• The reported severity

Tip: Some findings appear in both tools; some in only one. Track which tool produced each finding — this matters in Phase 4.

Step 3: Activity — List every SAST finding

Write out every finding from both tools before moving to Phase 3. You will add columns for AI and Human in Phase 4.

Phase 3 — AI Analysis (~20 min)

Query your chosen AI assistant to independently review the same file. Do this before looking at the SAST output in detail — you want an independent assessment.

Step 4: Prepare the AI prompt

Paste the full contents of labs/ch08_vulnerable_app.py into your AI tool with the following prompt:

You are a security engineer reviewing a Python Flask application for vulnerabilities.
For each security vulnerability you identify, provide:
1. The function name and line number (approximate is fine)
2. The vulnerability type (e.g., SQL injection, path traversal, command injection)
3. The CWE identifier if applicable (e.g., CWE-89)
4. One sentence explaining why it is vulnerable
5. One sentence describing the fix

Review the entire file systematically. Include both obvious vulnerabilities and subtle ones.
Do not skip findings because they look like they might be intentional.

[paste file contents here]

Step 5: Activity — Record the AI findings

For each vulnerability the AI reports, write down:

• The function/location it identified
• The vulnerability type and CWE it named
• Whether it gave a rationale or just named the type

Also note anything the AI flagged that does not appear in the SAST output, and anything it explicitly said was safe.

Phase 4 — Comparison Worksheet (~35 min)

Now bring together what SAST found, what AI found, and your own judgement. For every distinct finding reported by any source, complete one row of the comparison table.

Step 6: Activity — Complete the three-way comparison table

Copy this table into a text file or spreadsheet:

| # | Location (fn / line) | Vulnerability Type | CWE | SAST? (tool) | AI? | Human Verdict | SAST Correct? | AI Correct? | Notes |
|---|----------------------|--------------------|-----|--------------|-----|---------------|---------------|-------------|-------|
| 1 |                      |                    |     |              |     | TP / FP       | Y / N         | Y / N       |       |
| 2 |                      |                    |     |              |     |               |               |             |       |

Column guide:

When making your Human Verdict, ask:

1. Is the flagged code reachable with attacker-controlled input?
2. Does the context change the risk? (MD5 for a password vs. MD5 for a cache key are different risks)
3. What is the worst-case impact if an attacker exploits this?

Step 7: Activity — Fill in the summary scorecard

After completing the comparison table, tally your results:

Precision = true positives ÷ total findings reported. A tool that flags 30 issues and 10 are real has precision of 0.33. A tool that flags 5 issues and 5 are real has precision of 1.0 — but may have missed others.

Phase 5 — Fix the True Positives (~20 min)

Choose three confirmed true positives from your worksheet where both SAST and AI agreed with your verdict. For each:

1. Write the corrected version in the file (new function with a _safe suffix).
2. Add a one-line comment explaining the flaw and the fix.
3. Re-run Bandit to confirm the finding is gone.

Constraint: Do not fix false positives. If your fix suppresses a false positive, add a # nosec BXX annotation explaining why the pattern is safe, rather than restructuring the code around the tool’s limitations.

Step 8: Activity — Verify your fixes

bandit -r labs/ch08_vulnerable_app.py -ll
semgrep --config=auto labs/ch08_vulnerable_app.py

Confirm the three findings are gone and no new ones were introduced.

Phase 6 — Group Discussion (~20 min)

Compare your completed worksheets across groups and discuss:

1. SAST vs AI coverage: Which findings did SAST catch that AI missed? Which did AI catch that SAST missed? Were there findings only a human spotted?

2. Consistency without correctness: Did SAST and AI agree on any findings that your human verdict classified as false positives? What does agreement between tools tell you — and not tell you?

3. AI tool variation: If different groups used different AI tools, compare their finding lists. Did the same tool produce consistent results across groups? Did different tools produce different findings for the same code?

4. False positive rates: Compare precision scores from your scorecards. Which approach had the highest precision? Which had the lowest? What is the cost of a high false-positive rate in a real security review?

5. Design-level gaps: Look at the login route (/login) and admin route (/admin/users). Did SAST find anything? Did AI? Did either identify the missing access-control check on /admin/users? What does this tell you about the limits of automated tooling?

6. If a developer used AI to write this code: Which vulnerabilities are most likely AI-generated? Which are patterns that both AI assistants and AI-written code share — and why?

Reference: Bandit Rule Codes

Instructor Answer Key

bandit -r labs/ch08_vulnerable_app.py   # no -ll flag

References

• Bandit documentation
• Semgrep documentation
• OWASP Top 10 (2021)
• MITRE CWE catalogue
• Perry et al. (2022) — Do Users Write More Insecure Code with AI Assistants?
• Liu et al. (2023) — Refining ChatGPT-Generated Code: Characterizing and Mitigating Code Quality Issues