I built this for my undergraduate thesis (Software Engineering) and wanted to share it here because I think the technical trade-offs are more interesting to this audience than the headline numbers. The problem An AppSec pipeline running SAST, SCA, and DAST on every commit generates more findings than any team can realistically triage. Most of them aren't real vulnerabilities — test code, an already-mitigated dependency, a scanner that flakes between runs. But each tool decides, i...