---
title: "Discussion on \"SAST is just crazy bad at XSS\" | Hashnode"
description: "Discussion on \"SAST is just crazy bad at XSS\". XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ..."
url: "https://hashnode.com/posts/sast-is-just-crazy-bad-at-xss/686fda204baf225bb8198991"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [SAST is just crazy bad at XSS](https://nahsra.hashnode.dev/sast-is-just-crazy-bad-at-xss?utm_source=hashnode&utm_medium=feed)

XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ...

Jul 10, 2025 · 4 min read · nahsra.hashnode.dev  
Read the article

-   [#xss](https://hashnode.com/tag/xss)
-   [#sast](https://hashnode.com/tag/sast)
-   [#ai](https://hashnode.com/tag/ai)
-   [#security](https://hashnode.com/tag/security)
-   [#appsec](https://hashnode.com/tag/appsec)
-   [#devsecops](https://hashnode.com/tag/devsecops)
-   [#security-testing](https://hashnode.com/tag/security-testing)

## Written by

[Arshan Dabirsiaghi](https://hashnode.com/@nahsrasec)

@nahsrasec

  
[View profile](https://hashnode.com/@nahsrasec)

security nerd

CTO @ Pixee. ai (@pixeebot on GitHub) ex Chief Scientist @ Contrast Security Security researcher pretending to be a software executive.

## Responses 1

Markdown supported · ⌘↵ to post

[Ryan Dens](https://hashnode.com/@ryandens)

[Jul 10, 2025](https://hashnode.com/posts/sast-is-just-crazy-bad-at-xss/686fda204baf225bb8198991/comment/686fdb519288a6213ae47683)

It's crazy to me how much noise appsec/prod sec engineers have to sift through to get actionable, validated insights on their code.

"Example 1 of 10 Million" really got me 🤣