  Static Application Security Testing (SAST) is a popular quality assurance
technique in software engineering. However, integrating SAST tools into
industry-level product development and security assessment poses various
technical and managerial challenges. In this work, we reported a longitudinal
case study of adopting SAST as a part of a human-driven security assessment for
an open-source e-government project. We described how SASTs are selected,
evaluated, and combined into a novel approach for software security assessment.
The approach was preliminarily evaluated using semi-structured interviews. Our
result shows that (1) while some SAST tools out-perform others, it is possible
to achieve better performance by combining more than one SAST tools and (2)
SAST tools should be used towards a practical performance and in the
combination with triangulated approaches for human-driven vulnerability
assessment in real-world projects.
