QUANTITATIVE SECURITY EVALUATION OF WEB APPS USING STATIC ANALYSIS TOOLS

this paper presents a study on Static Application Security Testing (SAST) with a focus on the Snyk Code tool. SAST enables early detection and remediation of security vulnerabilities during software development, improving overall system security. The research introduces the General Application Vulnerability Rate (GAVR) model, which quantifies vulnerability risks based on the CVSS 3.1 framework. A case study using Snyk Code demonstrates the identification and assessment of security flaws, such as XSS and certificate validation issues. The study highlights the need for an integrated approach to security testing, emphasizing automation and structured vulnerability assessment to enhance software security. The GAVR model enhances traditional security evaluations by incorporating exploitability probabilities, offering a more dynamic risk assessment. The findings suggest that integrating SAST within the software development lifecycle significantly reduces security risks and improves remediation efficiency. By leveraging automation and systematic vulnerability quantification, this study underscores the importance of proactive security strategies to safeguard web applications against evolving threats.