arXiv: An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities

This publication is not a regulatory change but a research paper analyzing the effectiveness of the static analysis tool CodeQL in detecting Java vulnerabilities. The study empirically evaluates false positive rates and proposes query refinements to improve accuracy. For compliance professionals, this signals a growing gap between automated security scanning outputs and reliable, audit-ready evidence, particularly under frameworks that require demonstrable vulnerability management.

Organizations using CodeQL or similar static application security testing tools in their DevSecOps pipelines are directly affected, especially those in sectors with strict secure coding mandates such as financial services, healthcare, and critical infrastructure. Compliance teams relying on tool-generated findings for risk registers or audit trails may face challenges, as high false positive rates can obscure genuine threats and waste remediation resources.

Compliance teams should review their current SAST configuration and validation processes. They should assess whether query sets are tuned to their specific Java frameworks and consider implementing a manual triage layer for reported findings before they enter formal compliance tracking. Additionally, they should monitor future updates from CodeQL maintainers regarding query refinements and update their internal testing standards accordingly to ensure that automated scans remain aligned with regulatory expectations for accurate and complete vulnerability reporting.