Advanced False Positive Reduction

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• QUICK_START.md
• SECURITY_REVIEW.md
• configs/default.json
• CONTRIBUTING.md
• src/index.ts

Advanced False Positive Reduction is a core architectural component of the Enhanced Security Scanner v2.0, designed to achieve an industry-leading false positive (FP) rate of less than 5%. The system transitions beyond traditional Static Application Security Testing (SAST) by utilizing a three-phase scanning strategy that integrates AI-enhanced validation and context-aware filtering. Sources: README.md:12-16, README.md:38-41

This module ensures that security teams can focus on legitimate vulnerabilities by suppressing noise generated by high-noise queries or traditional pattern matching. It employs machine learning classification, framework-specific intelligence, and business logic analysis to distinguish between intentional code patterns (such as CLI path handling) and actual security flaws. Sources: README.md:43-48, SECURITY_REVIEW.md:79-110

3-Phase Scanning Architecture

The false positive reduction logic is embedded within a multi-phase workflow. Each phase progressively refines the results found in the previous step.

The diagram shows the sequential flow from high-noise discovery to refined verification. Sources: README.md:27-36, README.md:43-47

Phase 1: High-Noise Discovery

The scanner initially runs Semgrep and CodeQL with permissive and "high-noise" queries. This ensures maximum coverage (high recall) but typically results in a large number of potential issues that require further filtering. Sources: README.md:29-30, README.md:113-120

Phase 2: AI-Enhanced Validation

AI models (OpenAI, Anthropic, or AWS Q Developer) perform multi-scan iterations (typically 3) to embrace non-determinism. This phase compares developer intent (comments) against implementation and identifies complex multi-file flows that traditional tools might misinterpret. Sources: README.md:32-36, README.md:121-127

Phase 3: Targeted Deep Dive

The final phase performs deep analysis on critical findings, focusing on function-level logic and business logic detection to confirm exploitability before reporting to the user. Sources: README.md:31, README.md:128-133

Filtering Strategies and Logic

The system utilizes several specialized mechanisms to suppress findings that are technically matches but contextually safe.

Strategy	Description	Application Example
Context-Aware Filtering	Detects framework security controls and environment context.	Suppressing path traversal in CLI tools where user-provided paths are expected behavior.
Package Intelligence	Ignores lock file integrity hashes and validates package popularity.	Preventing false typosquatting alerts for popular pairs like jest vs next.
ML-Enhanced Classification	Learns from historical patterns and developer suppressions.	Identifying repetitive "safe" patterns in specific codebases.
Intent Analysis	Compares implementation against "TODO" comments or documentation.	Identifying when a function intentionally skips validation for local development.

Sources: README.md:44-47, SECURITY_REVIEW.md:135-155, SECURITY_REVIEW.md:162-180

Case Study: CLI Path Traversal

In a security review of the scanner itself, several path traversal findings were identified as false positives because the tool is a CLI utility. The reduction logic identifies that resolve(target) is safe when the input is explicitly provided by the user in a non-web context. Sources: SECURITY_REVIEW.md:79-110

This sequence demonstrates the suppression of findings based on configured patterns and context. Sources: QUICK_START.md:434-450, SECURITY_REVIEW.md:214-222

Configuration and Implementation

False positive reduction is controlled via the falsePositives and advancedFiltering sections of the project configuration.

Configuration Schema

Users can define specific patterns to exclude or enable automated filtering behaviors.

{
  "advancedFiltering": {
    "contextAware": true,
    "businessLogicAnalysis": true,
    "intentAnalysis": true
  },
  "falsePositives": {
    "excludeTestFiles": true,
    "excludeStorybook": true,
    "patterns": [
      {
        "file": "**/*.example.ts",
        "pattern": "API_KEY",
        "reason": "Example files with placeholder keys"
      }
    ]
  }
}

Sources: configs/default.json:28-32, README.md:149-153, QUICK_START.md:441-447

Component Locations

The logic is distributed across the core engine and specific analyzers:

• Main Orchestrator: Coordinates the 3-phase flow. Sources: src/index.ts:9, CONTRIBUTING.md:15
• FP Reducer: Located in packages/core/src/fp-reducer/, containing the rule-engine.ts for suppression logic. Sources: CONTRIBUTING.md:21
• SARIF Processor: Merges and validates results, applying final filtering before output. Sources: src/index.ts:8, README.md:244

Technical Debt and Dependency Filtering

The scanner specifically reduces noise in dependency scanning by:

1. Whitelisting Popular Packages: Avoiding typosquatting flags for well-known legitimate packages like jest and next. Sources: SECURITY_REVIEW.md:175-185
2. Integrity Hash Exclusion: Ignoring integrity strings in package-lock.json that might trigger secret detection rules. Sources: README.md:45
3. Severity Thresholding: Allowing low-risk findings (like outdated @types packages) while failing builds only on high-confidence Critical/High issues. Sources: QUICK_START.md:112-123, SECURITY_REVIEW.md:196-200

By combining multi-phase AI validation with rule-based suppression, the Advanced False Positive Reduction system ensures a high-signal environment for developers, maintaining trust in automated security tooling. Sources: README.md:280-285, SECURITY_REVIEW.md:244-250