SAST triage usually lands in a nightly report nobody reads. This tests whether Jev, TypeSafe’s classification model (calibrated probabilities against typed questions, not prose), can make triage fast and cheap enough to sit in the PR itself.
The first run: 731 deduplicated Semgrep findings from six deliberately vulnerable apps (Juice Shop, WebGoat, crAPI, NodeGoat, VAmPI, DVWA). 265 cleared the reporting threshold, 127 were suppressed at high confidence, and 339 went to a review queue with the probability attached. The whole run took about fifteen seconds and five cents.
Limitations: it only reclassifies what Semgrep already found, and Semgrep missed most of the logic flaws in the corpus. Jev’s published accuracy is about 68%. The thresholds were calibrated on one PHP app. Next step: a pilot on a real codebase.