Most security scans end with a long list and no clear answer to "so what do I fix first?"

This teardown is from a real run — the sample scan we publish so builders can see exactly what a check looks like before they buy one. No client code was involved. The targets were two public Java codebases, scanned as-is:

MyBatis JPetStore-6 — a real online-store web app: 46 Java files, 7,628 lines

Spark (perwendel/spark) — a Java web framework: 184 Java files, 21,272 lines

Total: 230 files, 28,900 lines, about 46 seconds of instrument time. The instrument was Semgrep 1.140.0 with a frozen set of OWASP-category rules for Java — SQL injection, XSS, command injection, path traversal, weak crypto, weak randomness, insecure cookies, and others. It reads Java source only; anything living in XML mappers or config is outside its sight, and we say so in the report.

Findings issued: 16.…