---
id: wiki-2026-0508-corgea
title: Corgea (AI-Native SAST)
category: 10_Wiki/Topics
status: verified
canonical_id: self
aliases: [Corgea, AI-native SAST, LLM-based security, PolicyIQ, autofix security, reachability analysis]
duplicate_of: none
source_trust_level: B
confidence_score: 0.83
verification_status: applied
tags: [security, sast, ai-native, corgea, llm, autofix, devsecops, vulnerability-detection]
raw_sources: []
last_reinforced: 2026-05-10
github_commit: pending
tech_stack:
  language: SaaS
  framework: Corgea
---

# Corgea

## 매 한 줄
> **"매 LLM 의 SAST core 의 직접 build"**. 매 pattern-based scanner X — 매 business logic 의 understand. 매 < 5% false positive (claim). 매 IDE + PR autofix. 매 AI-native security 의 first wave. 매 modern alternative: Snyk, Semgrep, Socket, Aikido + AI features.

## 매 핵심 differentiator

### AI-native (vs AI-augmented)
- **Traditional SAST + AI**: 매 pattern scan → 매 AI 의 triage.
- **Corgea**: 매 LLM 의 scanning engine itself.
- 매 result: 매 business logic vuln 의 catch.

### PolicyIQ
- 매 natural-language business / env context.
- 매 scanner 의 contextualize.
- 매 detection + fix accuracy ↑.

### Reachability Analysis
- 매 vuln location 만 의 X — 매 actually reachable?
- 매 call graph 의 entry point 의 trace.
- 매 false positive 의 reduce.

### Autofix in workflow
- 매 IDE 의 inline.
- 매 PR comment.
- 매 AI-generated + verified.
- 매 Latio.tech 의 best autofix tool 의 평가 (2024).

### 매 supported language
- 매 20+ language.
- TypeScript, Python, Go, Java, C#, Ruby, PHP, etc.

### 매 typical detection
- **OWASP Top 10**.
- **Business logic vuln** (broken auth, IDOR).
- **Injection** (SQL, XSS, command).
- **Sensitive data exposure**.
- **Misconfigured cloud / IaC**.

### 매 vs 매 alternative
| Tool | Type | Strength |
|---|---|---|
| Corgea | AI-native SAST | Business logic + autofix |
| Snyk | Multi (SCA, SAST, IaC) | Ecosystem coverage |
| Semgrep | Pattern SAST | Custom rules + speed |
| SonarQube | Quality + security | Quality gate |
| GitHub Advanced | Code scanning | GitHub integration |
| Socket.dev | Supply chain | Package risk |
| Veracode | Enterprise SAST | Compliance |

### 매 limitation
- 매 newer (less benchmark).
- 매 LLM 의 cost (large codebase).
- 매 enterprise sales 의 hurdle (vs incumbent).
- 매 false positive 매 not zero.

## 💻 패턴 (응용 — security pipeline)

### CI integration (GitHub Actions)
```yaml
- name: Corgea SAST
  uses: corgea-io/sast-action@v1
  with:
    api-token: ${{ secrets.CORGEA_TOKEN }}
    fail-on: high
    autofix-pr: true  # 매 PR 의 fix 의 attach
```

### PolicyIQ context (natural language)
```yaml
# .corgea/policy.yml
context: |
  This is a B2B SaaS for healthcare data. 
  All endpoints under /admin require role=admin.
  PII fields: ssn, dob, medical_record_number.
  We use AWS KMS for encryption-at-rest.
  GraphQL endpoint at /graphql is rate-limited.
  
  False positive examples:
  - sanitize_html() is a custom safe wrapper, not vulnerable.
  - logger.debug() output is gated by DEBUG env var.
```

### IDE plugin (VS Code-like)
```ts
// 매 vulnerability finding 의 IDE 의 inline
{
  range: Range(file:42, col:15-30),
  severity: 'High',
  type: 'SQL Injection',
  message: 'Unsanitized user input in raw SQL query.',
  reachable_from: ['POST /api/search'],
  fix_suggestion: {
    description: 'Use parameterized query',
    diff: `- query.exec("SELECT * FROM users WHERE id = " + userId)
+ query.exec("SELECT * FROM users WHERE id = ?", [userId])`,
  },
}
```

### Multi-tool layered security
```yaml
# 매 defense in depth — Corgea + 매 alternative
security_pipeline:
  pre_commit:
    - gitleaks  # 매 secret
  
  pr:
    - corgea  # 매 AI SAST
    - snyk_sca  # 매 SCA (CVE)
    - checkov  # 매 IaC
  
  pre_deploy:
    - trivy  # 매 container
    - cosign  # 매 sign
  
  runtime:
    - falco  # 매 runtime threat
```

### Custom rule (when Corgea의 X)
```yaml
# 매 fallback to Semgrep
# 매 .semgrep/internal-policy.yml
rules:
  - id: hardcoded-internal-url
    pattern: 'https://internal.acme.com/...'
    message: 'Use env var for internal URLs.'
    severity: WARNING
    languages: [typescript, python]
```

### Reachability check (DIY)
```python
import networkx as nx

def is_reachable(call_graph, vuln_function, entry_points):
    """매 vuln 이 entry 의 reachable?"""
    G = nx.DiGraph(call_graph)
    for entry in entry_points:
        if nx.has_path(G, entry, vuln_function):
            return True, nx.shortest_path(G, entry, vuln_function)
    return False, None
```

### LLM-based vuln detection (DIY backup)
```python
def llm_security_review(code, context=''):
    prompt = f"""You are a security expert. Review this code for vulnerabilities.

Context: {context}

Code:
{code}

Output JSON:
[{{
  "type": "OWASP type or 'business_logic'",
  "severity": "critical/high/medium/low",
  "line": int,
  "description": "specific vulnerability and why",
  "exploitability": "how an attacker would exploit",
  "fix": "specific code change"
}}]

Return only JSON, no prose."""
    return structured_llm.generate(prompt)
```

### False positive feedback loop
```python
class FPFeedback:
    def __init__(self):
        self.feedback = []
    
    def mark_fp(self, finding_id, reason):
        self.feedback.append({'id': finding_id, 'reason': reason, 'date': datetime.now()})
        # 매 send to Corgea API → 매 retrain context.
```

### Cost monitoring
```python
def estimate_corgea_cost(loc_per_month, scan_count):
    """매 typical pricing model."""
    base_per_loc = 0.01  # 매 hypothetical
    return loc_per_month * base_per_loc * scan_count
```

## 🤔 결정 기준
| 상황 | Tool |
|---|---|
| AI-native SAST | Corgea |
| Multi-tool single vendor | Snyk |
| Custom rules speed | Semgrep |
| GitHub-native | GitHub Advanced Security |
| Compliance-heavy | Veracode / Checkmarx |
| Open-source | Semgrep + custom |
| Small team | Snyk free + Dependabot |

**기본값**: 매 layered approach — 매 Corgea (AI SAST) + 매 Semgrep (custom) + 매 SCA + 매 secret scan + 매 IaC.

## 🔗 Graph
- 부모: [[SAST]] · [[CI_CD 파이프라인 및 IDE 통합 보안|DevSecOps]]
- 변형: [[AI-Native-SAST]] · [[Reachability-Analysis]] · [[Corgea|PolicyIQ]] · [[Autofix]]
- 응용: [[Semgrep]] · [[SonarQube]]
- Adjacent: [[CI_CD 파이프라인 및 IDE 통합 보안]] · [[AI 코드 리뷰 및 보안 취약점 점검(DevSecOps)]] · [[Custom-ESLint-Rules-Development]] · [[CodeScene]]

## 🤖 LLM 활용
**언제**: 매 production-grade SAST. 매 business logic vuln. 매 AI-native security adoption.
**언제 X**: 매 budget-tight (Semgrep + LLM 의 alternative). 매 air-gapped (cloud LLM 의 X).

## ❌ 안티패턴
- **Single tool monoculture**: 매 layered defense X.
- **No PolicyIQ context**: 매 false positive ↑.
- **Autofix 의 blind merge**: 매 review 의 still 필요.
- **AI 의 only (no Snyk SCA)**: 매 dependency CVE 의 miss.
- **No feedback loop**: 매 false positive 의 retrain X.

## 🧪 검증 / 중복
- Verified (Corgea docs, Latio.tech report).
- 신뢰도 B.
- Related: [[CI_CD 파이프라인 및 IDE 통합 보안]] · [[AI 코드 리뷰 및 보안 취약점 점검(DevSecOps)]] · [[Custom-ESLint-Rules-Development]] · [[CodeScene]] · [[AI 생성 코드 검증(AI Code Assurance)]].

## 🕓 Changelog
| 날짜 | 변경 |
|---|---|
| 2026-04-18 | Auto-mapped |
| 2026-05-08 | Phase 1 |
| 2026-05-10 | Manual cleanup — AI-native + PolicyIQ + 매 CI / IDE / multi-tool / DIY LLM code |
