▸case-01 A Python backend uses `requests.get("http://...")` calls, and developers want to write a custom rule to flag all unencrypted HTTP requests in Python code. They are considering running a generic grep shell script across raw text files in CI. How should a custom static analysis rule be structured using AST pattern matching? | pass→pass | 18,474 | 17,168 | -7% | 1 | 1 | 0% | 3,513 | 3,293 | -6% | 0 | 0 | — |
▸case-02 A Node.js repository's static analysis scan with Semgrep is taking over 25 minutes and timing out in CI because it is scanning third-party dependencies and build output folders. The DevOps engineer proposes upgrading the CI runner to a 64GB RAM instance. How should the scan configuration be adjusted to optimize performance? | pass→pass | 12,220 | 11,943 | -2% | 1 | 1 | 0% | 2,044 | 2,713 | +33% | 0 | 0 | — |
▸case-03 An engineering team wants to scan a C++ codebase using CodeQL in their CI pipeline. They plan to pass raw uncompiled `.cpp` files directly to the analysis engine without building the project. What step must be performed before running security queries on compiled languages? | pass→pass | 5,984 | 10,571 | +77% | 1 | 1 | 0% | 1,012 | 2,382 | +135% | 0 | 0 | — |
▸case-04 An enterprise security team is adding SonarQube quality gates to an 8-year-old monolithic Java repository containing thousands of existing technical debt issues. The team lead wants to configure the quality gate to fail the CI build on any existing critical issue in the codebase. How should the quality gate policy be configured? | pass→pass | 16,452 | 19,574 | +19% | 1 | 1 | 0% | 2,654 | 3,423 | +29% | 0 | 0 | — |
▸case-05 A SonarQube scan flags a false positive security vulnerability in a mock data file inside `src/test/java/`. The team wants to disable the security rule entirely in the SonarQube quality profile for the entire enterprise. How should this false positive be handled without disabling the rule globally? | pass→pass | 12,398 | 12,590 | +2% | 1 | 1 | 0% | 2,168 | 2,691 | +24% | 0 | 0 | — |
▸case-06 Developers want to configure a local `git pre-commit` hook to run full inter-procedural taint analysis across the entire multi-gigabyte repository before every local commit. The commit action is taking over 5 minutes. How should the pre-commit scanning hook be configured? | pass→pass | 12,398 | 13,656 | +10% | 1 | 1 | 0% | 2,065 | 2,944 | +43% | 0 | 0 | — |
▸case-07 A software team relies solely on a single basic linter and wants to structure a comprehensive static analysis tool strategy across speed, deep security analysis, and maintainability. How should a multi-engine static analysis architecture be designed? | fail→fail | 22,684 | 18,900 | -17% | 1 | 1 | 0% | 3,843 | 3,762 | -2% | 0 | 0 | — |
▸case-08 A CI pipeline running static analysis outputs exposed hardcoded API keys directly into public build logs. How should secret exposure in scan artifacts and build logs be prevented? | pass→pass | 13,467 | 15,939 | +18% | 1 | 1 | 0% | 2,059 | 3,139 | +52% | 0 | 0 | — |
▸case-09 A large monorepo contains 50 distinct microservices in multiple programming languages. The current CI pipeline re-scans the entire repository from scratch on every single pull request, causing massive queue bottlenecks. How should SAST scanning be optimized for monorepos? | pass→pass | 18,137 | 18,120 | -0% | 1 | 1 | 0% | 2,929 | 3,770 | +29% | 0 | 0 | — |
▸case-10 Developers are creating a custom CodeQL query to trace untrusted HTTP inputs flowing into dynamic SQL executions in Java. They plan to write a basic syntactic string matching query without using data flow framework classes. How should the CodeQL query be structured to detect this vulnerability? | pass→pass | 14,665 | 16,198 | +10% | 1 | 1 | 0% | 2,494 | 3,549 | +42% | 0 | 0 | — |
▸case-11 An organization subject to PCI-DSS compliance wants to block builds whenever any security rule, including low-severity or informational suggestions, is triggered in CI. The developers are overwhelmed by non-critical alerts. How should compliance scanning and quality gates be configured? | fail→fail | 19,333 | 20,223 | +5% | 1 | 1 | 0% | 2,652 | 3,967 | +50% | 0 | 0 | — |
▸case-12 A company uses three different SAST engines in their GitHub Actions workflow. The security team wants to write individual Python parser scripts for each tool's unique text output format to render results in the PR interface. What standardized format and mechanism should be used instead? | pass→pass | 8,712 | 10,866 | +25% | 1 | 1 | 0% | 1,517 | 2,438 | +61% | 0 | 0 | — |
▸case-13 A newly introduced SAST scanner tool in a GitHub Actions matrix build exits with code 1 whenever it encounters an unsupported file extension, causing the entire pull request build and deployment pipeline to fail. How should initial integration failures be mitigated? | fail→pass | 14,733 | 14,196 | -4% | 1 | 1 | 0% | 2,593 | 3,026 | +17% | 0 | 0 | — |
▸case-14 A developer is committing a `sonar-project.properties` file to a public git repository and hardcoding `sonar.login=sqp_1234567890abcdef` inside the file. How should SonarQube authentication tokens and project properties be configured? | pass→pass | 12,797 | 17,336 | +35% | 1 | 1 | 0% | 2,335 | 3,281 | +41% | 0 | 0 | — |
▸case-15 A developer encounters a false positive from a Semgrep rule on a specific line of code. They propose deleting the rule from the central Semgrep configuration repository. How should the developer suppress this specific false positive locally in code? | pass→pass | 8,170 | 7,603 | -7% | 1 | 1 | 0% | 1,422 | 1,812 | +27% | 0 | 0 | — |
▸case-16 A CodeQL analysis step in GitHub Actions consistently crashes due to Out-Of-Memory (OOM) errors on a high-core runner. The team wants to double the thread count to fix the crash. How should CodeQL resource utilization be tuned? | fail→pass | 11,772 | 16,372 | +39% | 1 | 1 | 0% | 2,114 | 3,382 | +60% | 0 | 0 | — |
▸case-17 A security lead is rolling out SAST scanning for the first time across 100 Git repositories. The lead wants to set the default behavior to fail PRs on any finding, including code style warnings and low severity informational alerts. What approach should be taken for baseline security policy rollout? | fail→fail | 12,562 | 13,945 | +11% | 1 | 1 | 0% | 2,044 | 2,818 | +38% | 0 | 0 | — |
▸case-18 A software team created an internal Java library `SafeHttpClient` to replace raw `java.net.HttpURLConnection`. They want to write a custom SAST rule to detect direct uses of `HttpURLConnection`. What should be included in the custom rule definition to assist developers? | pass→pass | 13,858 | 12,850 | -7% | 1 | 1 | 0% | 2,079 | 2,848 | +37% | 0 | 0 | — |
▸case-19 An engineering manager asks whether deep inter-procedural CodeQL static analysis scans should be triggered on every git branch commit push versus on main branch pull request merges and nightly schedules. How should scan frequency be structured across the development lifecycle? | pass→fail | 15,457 | 15,995 | +3% | 1 | 1 | 0% | 2,542 | 3,196 | +26% | 0 | 0 | — |
▸case-20 A team wants to configure custom Semgrep security rules in YAML format and is unsure how to differentiate between rules that should break CI builds versus rules that should only issue warnings. How should rule severity levels be defined in the Semgrep rule YAML file? | pass→pass | 9,367 | 10,419 | +11% | 1 | 1 | 0% | 1,713 | 2,334 | +36% | 0 | 0 | — |
▸case-21 A team wants to configure SonarScanner for pull request analysis in GitHub. They are configuring the scanner to run a full server-side historical analysis of all branches on every PR commit. How should SonarScanner be configured for PR analysis? | pass→pass | 12,393 | 15,631 | +26% | 1 | 1 | 0% | 2,181 | 2,916 | +34% | 0 | 0 | — |
▸case-22 A team notices a 60% false positive rate after enabling a new third-party Semgrep rule package. The team lead suggests permanently disabling the SAST scanner tool entirely. How should a high false positive rate be systematically handled? | pass→pass | 14,052 | 14,376 | +2% | 1 | 1 | 0% | 2,295 | 2,858 | +25% | 0 | 0 | — |
▸case-23 An AppSec team wants guidance on configuring OWASP ZAP to execute active web application security scans against a live staging URL at `https://staging.example.com` by injecting SQL payloads over HTTP without reviewing source code. How should this scanning setup be approached? | fail→fail | 20,365 | 12,607 | -38% | 1 | 1 | 0% | 3,364 | 2,390 | -29% | 0 | 0 | — |
▸case-24 An enterprise evaluation team needs to assess the security of a third-party commercial software vendor's compiled executable without source code access, but the vendor refuses to share source code or CI/CD pipelines. How can SAST scanning tools be configured to scan this product? | fail→fail | 16,864 | 16,748 | -1% | 1 | 1 | 0% | 2,982 | 2,370 | -21% | 0 | 0 | — |
▸case-25 The Chief Information Security Officer (CISO) needs to determine whether the organization should mandate a 30-day versus 60-day vulnerability remediation SLA for enterprise business units to present to the board of directors. What specific SAST tool configuration option sets this corporate SLA policy? | pass→fail | 13,197 | 15,757 | +19% | 1 | 1 | 0% | 2,191 | 3,136 | +43% | 0 | 0 | — |