Using ChatGPT as a Static Application Security Testing Tool

Abdalsamad Keramatfar; Amir Norouzi; Atieh Bakhshandeh; Mohammad Mahdi Chekidehkhoun

Using ChatGPT as a Static Application Security Testing Tool

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2308.14434 v1 pith:O2HIPO2V submitted 2023-08-28 cs.CR cs.AI

Atieh Bakhshandeh , Abdalsamad Keramatfar , Amir Norouzi , Mohammad Mahdi Chekidehkhoun This is my paper

classification cs.CRcs.AI

keywords chatgptcoderesultssecurityapplicationdetectionfalsepython

verification ladder T0 review T1 audit T2 compute T3 formal

0 comments

read the original abstract

In recent years, artificial intelligence has had a conspicuous growth in almost every aspect of life. One of the most applicable areas is security code review, in which a lot of AI-based tools and approaches have been proposed. Recently, ChatGPT has caught a huge amount of attention with its remarkable performance in following instructions and providing a detailed response. Regarding the similarities between natural language and code, in this paper, we study the feasibility of using ChatGPT for vulnerability detection in Python source code. Toward this goal, we feed an appropriate prompt along with vulnerable data to ChatGPT and compare its results on two datasets with the results of three widely used Static Application Security Testing tools (Bandit, Semgrep and SonarQube). We implement different kinds of experiments with ChatGPT and the results indicate that ChatGPT reduces the false positive and false negative rates and has the potential to be used for Python source code vulnerability detection.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Towards Effective Complementary Security Analysis using Large Language Models
cs.CR 2025-06 conditional novelty 5.0 of 10

Using Chain-of-Thought and Self-Consistency prompts, some LLMs removed over half of SAST false positives on a benchmark while missing no genuine weaknesses, and ensembling three models removed about 79%.

Pith tools