Skip to main content
Detection · v5.2

90+ SAST rules across Python, JavaScript, Java and Go

Static analysis with rules written against real exploit conditions rather than pattern matches, wired to the same validation and ranking as everything else.

Request accessFull release notes
Version
5.2
Released
February 12, 2026
New features
3
Category
Detection

What's new

Features and improvements in this update

New features

3

  • 90+ security rules, four languages

    Injection, deserialisation, path traversal, SSRF, weak cryptography, hardcoded secrets, unsafe reflection and authorisation-check omissions, each written against the conditions that make the pattern exploitable rather than the pattern alone.

  • Taint tracking from source to sink

    Data flow is followed across functions and files so an unsanitised parameter reaching a sink three calls away is reported, and one that passes through validation is not.

  • Secret detection with entropy and format checks

    Credentials in source and configuration are detected by format and entropy, and known provider formats are checked for whether the key is live before the finding is raised.

Improvements

3

  • Framework-aware analysis

    Django, Flask, FastAPI, Express, Spring and standard Go HTTP routing are understood well enough to know what is already sanitised by the framework, which removes a large share of static analysis noise.

  • Fix guidance with the corrected code

    Findings include the corrected form in the same language and framework, not a link to a general description of the vulnerability class.

  • Incremental analysis

    Results are cached per file and invalidated by content hash, so a second run over an unchanged repository completes in seconds.

Benefits

What it changes for you

Stated as work removed rather than capability added, the only version of a benefit that can be checked.

  • Findings your engineers do not argue with

    Framework awareness and taint tracking remove most of the reflexive objection to static analysis: that it flags code the framework already protects.

  • One queue for static and dynamic findings

    SAST results are validated, deduplicated and ranked alongside DAST and dependency findings, so there is one ordered list rather than three tools with three opinions.

  • Fast enough to gate on

    Incremental analysis keeps per-PR runs in the low minutes, which is the threshold below which teams leave a gate switched on.

Upgrade

Getting it

Getting this update

Bundled with the package: no separate ruleset download. Custom rules can be added in the same format.

pip install --upgrade aiptx

Related

Other updates

v5.0

DAST for applications that stopped being pages

GraphQL, WebSocket and single-page application scanners ship together, so the parts of a modern application a crawler never reached are now tested like the rest of it.

Read
v4.0

Nothing gets reported until it has been exploited

Every candidate finding is now validated by replay before it reaches your queue. Unreproducible candidates are dropped rather than downgraded, which is what takes a scanner queue from thousands to dozens.

Read
v3.0

Security testing that runs in the pull request

SARIF output, inline PR annotations and configurable merge blocking bring findings to the engineer who wrote the code, at the moment they can still change it cheaply.

Read

See Your Attack Surface in Real-Time

Run a comprehensive VAPT assessment powered by advanced security tools. Get actionable findings in hours, not weeks. No credit card required.

Request access