<![CDATA[Full execution of Static Application Security Testing (SAST) on every commit in a modern CI/CD pipeline creates significant bottlenecks, especially in Jamstack architecture characterized by high commit frequency and fragmented code changes. This study evaluates the effectiveness of the Selective-SAST approach based on code churn analysis as a strategy to optimize pipeline execution time. The proposed approach utilizes four indicators of code change risk, namely relative churn above the 75th percentile, developer entropy above 1.5, intersection with sensitive paths (authentication, API, configuration, CI/CD), and days since last modification above 14 days, to determine the scanning coverage. The experiment was conducted using a paired comparison design on 49 open-source Jamstack repositories, 2,450 unique commits, and 120,472 lines of data resulting from the combination of churn metrics and Semgrep findings. Empirical results show that Selective-SAST provides a median time saving of 15.21% (95% CI bootstrap 12.88%-17.28%; ; rank-biserial ) while also demonstrating promising security retention potential (precision 1.00, recall 0.9412, and F1-score 0.9697). However, because the basis of SAST findings in the sub-sample is very sparse (only 17 baseline findings from 7 commits), these retention metrics should be interpreted as preliminary evidence. This study concludes that Selective-SAST shows promise in accelerating security feedback on the Jamstack CI/CD pipeline, but absolute validation requires testing on datasets with higher vulnerability density.]]>
Copyrights © 2026
