Why static analysis misses access-control bugs

Static application security testing (SAST) reads source code without running it. It looks for patterns that are dangerous regardless of context: string-built SQL, unescaped output, hard-coded keys, unsafe deserialisation. These are real bugs, and SAST finds them cheaply and early.

It is no coincidence that these are also the bugs AI coding agents have mostly stopped writing. In Tenzai's test of five agents, none of the 15 apps had exploitable SQL injection.

Consider a handler that loads an invoice by ID for a signed-in user:

export async function GET(req, { params }) {
  const user = await requireUser(req);
  const invoice = await db.invoice.findUnique({ where: { id: params.id } });
  return Response.json(invoice);
}

There is no dangerous pattern here. The query is parameterised and the route requires a session. The bug is a missing line, a check that invoice.userId === user.id, and only someone who knows the business rule can say that line should exist. Some invoices might legitimately be shared. Some routes are meant to be public.

OWASP lists this as API1:2023 Broken Object Level Authorization, the top API risk. Its sibling, broken function-level authorization, covers admin actions that ordinary users can call. Both are about who is asking, which is exactly the context static analysis does not have.

A runtime test does not need to understand the business rule in the abstract. It can observe the consequence. Capture the request User A's browser makes for invoice 42. Replay it with User B's session. If the response contains User A's invoice, the rule was broken, whatever the code looks like.

The same idea finds unguarded routes: replay the request with no session at all. It also finds leaks that no code path makes obvious, such as a response that includes another user's email in a nested field.

This is not an argument against static analysis. Keep it in CI for the pattern bugs it finds well. Add a runtime check for the context bugs it cannot see, and run it against a deployed environment with at least two real test accounts.