FYI, more details have been given in this post: Takeaways from building a SAST product, and why OWASP benchmark is not enough.
FYI, more details have been given in this post: Takeaways from building a SAST product, and why OWASP benchmark is not enough.