Using Reasoning Models in AutoTriage

This report evaluates the use of reasoning language models in SAST AutoTriage, arguing they are overkill for most rules but significantly more effective for complex cases like JavaScript path traversal. It explains multiple path traversal patterns ("../", "..\", lone "..", and leading "/" with path.resolve()) and recommends robust remediation and triage checks — notably resolving and validating paths against a known base — while noting reasoning models can halve false positives for these edge cases.