HACKING PROJECT · cloud · Intermediate
Static Code Analysis (SAST) Plugin
Deliver a mobile-aware SAST plugin that detects and explains insecure code patterns inside the developer's IDE and CI pipeline.
Mobile developers ship insecure code (hardcoded secrets, insecure storage, weak crypto, unsafe WebView/IPC, SQL injection) because security review happens too late, if at all, and generic SAST tools produce noisy, non-mobile-specific findings. Security is not integrated into the developer's IDE or CI where it is cheapest to fix. There is a gap in a lightweight, mobile-aware SAST plugin that gives fast, MASVS-mapped feedback in the developer workflow.
**What you'll build**
Build a SAST plugin — as an IDE extension (Android Studio/VS Code) and/or a CI step — that parses Kotlin/Java/Swift source and manifests, applies rule-based and AST/pattern matching (leveraging or extending engines like Semgrep) to detect mobile-specific weaknesses, and surfaces findings inline with MASVS/CWE references and remediation guidance. Include a customizable ruleset, severity scoring, and a CI mode that fails builds on policy violations. Output SARIF for integration with code-scanning dashboards.
**Objective** — Deliver a mobile-aware SAST plugin that detects and explains insecure code patterns inside the developer's IDE and CI pipeline.
**Expected outcome** — A working SAST plugin/CI step with a mobile ruleset that produces MASVS/CWE-mapped, SARIF-exportable findings on a sample app.
**Difficulty** — Intermediate — building on Semgrep/AST tooling is approachable, though high-quality low-noise rules take iteration.
**Primary category** — AppSec (SAST); Secondary = DevSecOps, Secure SDLC
**Security domains** — Primary = DevSecOps; Secondary = Blue Team, Security Research, Mobile AppSec
**Technical focus** — Static analysis, AST/pattern matching, secret detection, insecure-storage/crypto detection, taint analysis (basic), IDE extension development, CI/CD integration, SARIF reporting, detection rule authoring
**Core technologies** — Languages: Python, Kotlin/Java, Swift, TypeScript (IDE extension); Frameworks/Libraries: Semgrep, tree-sitter, ANTLR, SARIF SDK; Security Tools: Semgrep, MobSF (reference), gitleaks (reference); Cloud/Infra: GitHub Actions/GitLab CI, Docker; AI/Data: optional LLM for remediation suggestions and rule synthesis; Databases: findings store (SQLite/PostgreSQL)
**Where it's valued** — Any mobile-app-producing company, fintech, healthtech, enterprise software, security tooling vendors
**Careers it builds toward** — Application Security Engineer, DevSecOps Engineer, Secure Code Reviewer, Product Security Engineer
**Framework alignment**
• MITRE ATT&CK: Preventive/shift-left — reduces exploitable conditions (e.g., credentials in code, insecure IPC) rather than mapping to a single attacker technique
• NIST CSF 2.0: Protect (secure development), Identify (code-level vulnerability discovery), Govern (policy-gated builds)
• OWASP: MASVS-CODE, MASVS-STORAGE, MASVS-CRYPTO, MASVS-PLATFORM; maps findings to CWE and OWASP Mobile Top 10
• CIS Controls v8: 16 (Application Software Security), 4 (Secure Configuration), 2 (Software Inventory)
**Innovation** — Improved Existing Solution — SAST engines exist, but a focused, MASVS-mapped, low-noise mobile plugin integrated into IDE/CI with SARIF output is a strong, employable deliverable. Scores: Innovation 6/10, Startup 6/10, Enterprise-Readiness 7/10, Patent = No.