What SAST actually does
Static Application Security Testing parses source into an AST and runs taint analysis: it traces untrusted input (sources) to dangerous calls (sinks) like SQL exec, eval, file writes. No parser for the language = no AST = zero findings — silence that looks like safety.
Why AI makes the gap worse
Assistants happily emit Zig, Bun APIs, HTMX attributes, or brand-new ORM query builders. A 2024-era rule pack has no sink definitions for those APIs. The scanner doesn't fail loudly — it reports "0 issues", which teams read as a green light.
Velocity compounds it
If devs ship 2× more code and coverage is 70%, unscanned code grows 2× faster too. Security debt scales with velocity × (1 − coverage). Raise the velocity slider and watch the red stream thicken.
What closes the gap
1) Scanners that analyze semantics, not just signatures (LLM-assisted review). 2) Rule packs updated per-framework, per-quarter. 3) Guardrails at the prompt layer: secure-by-default templates. 4) Runtime detection (DAST/IAST) as a safety net for what static tools miss.