Static analysis tools are good at finding problems and poor at getting them fixed. A typical SAST run produces a list of findings, each with a rule, a file, a line and a severity. Turning each one into a correct code change is still a developer's job, and that is where the backlog grows.

Prefer to watch? A short Q&A on the same topic:

AI code-fix tools promise to close that gap by drafting the change. They can help. They can also introduce subtle bugs, change behaviour nobody asked them to change, or create a false sense that something has been fixed. This post covers what a safe AI SAST remediation workflow looks like, and what to check before trusting one.

Why SAST findings do not get fixed

The barriers are rarely about whether a finding is real. They are about effort and context:

The fix needs the whole file. A SQL injection on one line may need a change to how a query helper is called, an import, or a parameter list elsewhere in the file.

The developer is not the author.…