Hacker News Reader

They would not catch it, it requires combining multiple vulns.

I just meant the SQLi (which is the basis of the chain), not the full chain.

There is likely thousands of such SQL concatenations throughout the codebase. The issue with traditional SAST tools is that they can't readon about context.

Reply on news.ycombinator.com