Writing Custom SAST Rules for Vulnerabilities Your Scanner Doesn't Cover

Every SAST tool ships with a default ruleset. And every default ruleset has gaps. Sometimes the gap is a framework-specific vulnerability that the tool's authors didn't anticipate. Sometimes it's an internal pattern unique to your organisation — a custom authentication library, a legacy data access