Implementation of Static Code Analysis to Detect Vulnerabilities in Applications Developed with the Assistance of Large-Language Models (LLM)

Arnold Nasir (Informatics (Makassar City Campus), Ciputra University, 60219, Indonesia)
Kasmir Syariati (Informatics (Makassar City Campus), Ciputra University, 60219, Indonesia)
Citra Suardi (Informatics (Makassar City Campus), Ciputra University, 60219, Indonesia)
David Sundoro (Informatics (Makassar City Campus), Ciputra University, 60219, Indonesia)
Juan Salao Biantong (Informatics (Makassar City Campus), Ciputra University, 60219, Indonesia)
Reinaldo Lewis Lordianto (Informatics (Makassar City Campus), Ciputra University, 60219, Indonesia)

Energy: Jurnal Ilmiah Ilmu-ilmu Teknik
Vol. 15 No. 2 (2025): ENERGY: JURNAL ILMIAH ILMU-ILMU TEKNIK (July-November 2025 Edition)

The emergence of large language models (LLMs), such as ChatGPT and GitHub Copilot, has transformed software development, including in higher education. Students can now easily create PHP code for Laravel web applications. This research implements static code analysis with PHPStan to detect security vulnerabilities in student-developed PHP code that is likely assisted by LLMs. The analysis was performed on the full code of 28 capstone projects, focusing on student projects that demonstrated patterns consistent with heavy LLM output use. The results show that 64.16% of LLM-assisted code often neglects data sanitization, uses raw queries without parameterization, and contains vulnerable authentication logic. This study contributes to web application security literacy for students and recommends static analysis as a pedagogical and preventive tool.