Prioritizing security findings in a SAST tool based on historical security analysis

Apparatus, comprising:

• a processor;
• computer memory holding computer program instructions executed by one or more processors to reduce security vulnerabilities associated with development of an application across multiple application development environments, the application having a set of application programming interfaces (APIs), the computer program instructions operative to:
• receive, at a first time, a static scan of a first set of source code from the application, the static scan including one or more identified vulnerabilities;
• receive, at a second time, a static scan of a second set of source code from the application;
• based on the static scans, identify one or more APIs as being in common use in the application;
• with respect to at least common use API so identified, identify at least one API in the second set of source code that, with respect to the first set of source code, has been updated between the first time and the second time to address a vulnerability;
• and
• based on identifying the at least one API that has been updated, prioritize processing of one or more of the identified vulnerabilities in an API associated with the first set of source code over vulnerabilities identified in at least one other API.

A computer program product in a non-transitory computer readable medium for use in one or more data processing systems, the computer program product holding computer program instructions executed by the one or more data processing systems to reduce security vulnerabilities associated with development of an application across multiple application development environments, the application having a set of application programming interfaces (APIs), the computer program instructions operative to:

• receive, at a first time, a static scan of a first set of source code from the application, the static scan including one or more identified vulnerabilities;
• receive, at a second time, a static scan of a second set of source code from the application;
• based on the static scans, identify one or more APIs as being in common use in the application;
• with respect to at least common use API so identified, identify at least one API in the second set of source code that, with respect to the first set of source code, has been updated between the first time and the second time to address a vulnerability;
• and
• prioritize processing of one or more of the identified vulnerabilities in an API associated with the first set of source code over vulnerabilities identified in at least one other API.