Ali Raza
Sr. Vulnerability Researcher
Independent Researcher
Ali Raza (a.k.a locus-x64) is a Vulnerability Researcher, specializing in low-level system security, Linux/Android kernel exploitation, and software defense mitigations. His research centers on memory corruption analysis, binary exploitation, and building provable security mechanisms for static analysis and firmware environments.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Scanipy: Refactor-Invariant Identity and Provable Provenance for Static Analysis
SAST tools are good at finding bugs, but they often struggle to keep track of those bugs as the code changes. A finding tied to a source location or text hash can get a new ID after a variable rename, formatting change, helper extraction, or file move. That breaks suppressions and triage history. Re-running a scan can also produce different output, which makes it difficult to use SAST results as audit evidence or reliable CI gates.
Scanipy is an open-source platform for tracking and verifying SAST findings across code changes. It runs existing engines such as Semgrep and CodeQL and adds three things:
Stable finding identity. Scanipy builds a fingerprint from the finding's code-dependence slice using graph canonicalization instead of a text hash. The identity remains stable across renames, formatting changes, code reordering, method extraction, and file moves, but changes when the underlying issue is actually fixed.
Reproducible results. Scans run in a pinned environment and are checked by a partitioned attestor to verify that repeated runs produce byte-identical results.
Signed provenance. Each finding has a machine-checkable chain linking it back to the source commit.
The demo will use a public repository. We'll scan it, make several refactors, and compare how Scanipy, CodeQL, and Semgrep track the resulting findings. We'll also verify two byte-identical runs and inspect the signed provenance for a finding.
Scanipy is available as a one-command Docker deployment so attendees can run it themselves.
Session Outcomes
- Why SAST finding IDs change after refactors, and how graph-based identity keeps the same finding linked to its previous triage and suppression history.
- How to make static-analysis results reproducible enough for audit use and CI enforcement, while separating what is guaranteed by the system from what depends on the analysis engine.
- How to evaluate new and AI/LLM-generated detection rules using an anytime-valid statistical precision guarantee instead of fixed thresholds.
- A runnable, self-hostable, open-source implementation that attendees can deploy themselves.
- 14:40
- Tue
- 01 Dec
Stage:
Arsenal 2
Sessions Type:
Keynote