operator-tuning.md

Operator Tuning Guide

Performance tuning for the Baco SAST scanner. Adjust settings based on scan speed, LLM costs, or analysis depth.

Scenario Profiles

Fast CI Scans (Sub-10-Minute Turnaround)

[scanner.performance]
enable_incremental_scan = true
max_parallel_tasks = 2
enable_threat_modeling = false
enable_confidence_refinement = false
enable_cve_bootstrap = false
enable_variant_search = false

[llm]
enable_llm_cache = true

[scanner]
exclude_paths = ["tests/", "docs/", "target/", "vendor/"]

Trade-off: Reduced recall on cross-file vulnerabilities. Incremental scans may miss dependency context changes.

Deep Nightly Scans (Full Analysis)

[scanner.performance]
enable_incremental_scan = false
max_parallel_tasks = 8
enable_threat_modeling = true
enable_root_cause_dedup = true
enable_confidence_refinement = true
enable_cve_bootstrap = true
enable_variant_search = true

[llm]
enable_llm_cache = true
max_concurrent = 8
timeout_secs = 120

Trade-off: Higher LLM costs (3-5x baseline). Runtime 30-60 minutes for medium projects.

LLM-Cost-Sensitive Runs

[scanner.performance]
enable_incremental_scan = true
max_parallel_tasks = 2
enable_confidence_refinement = false
enable_variant_search = false

[llm]
enable_llm_cache = true
max_concurrent = 2

Trade-off: Lower detection quality on nuanced vulnerabilities. Cache hits depend on code stability.

Performance Flags Reference

Flag	Type	Default	Effect
enable_incremental_scan	bool	false	Skips unchanged files via SHA256 hash comparison
max_parallel_tasks	int	4	Max concurrent scan tasks
enable_file_filtering	bool	true	Filters low-value files (minified, vendor)
enable_threat_modeling	bool	false	STRIDE-based threat analysis
enable_root_cause_dedup	bool	true	Collapses findings with same root cause
Flag	Type	Default	Effect
------	------	---------	--------
enable_incremental_scan	bool	false	Skips unchanged files via SHA256 hash comparison
max_parallel_tasks	int	4	Max concurrent scan tasks
enable_file_filtering	bool	true	Filters low-value files (minified, vendor)
enable_threat_modeling	bool	false	STRIDE-based threat analysis
enable_root_cause_dedup	bool	true	Collapses findings with same root cause
enable_auto_patching	bool	false	Generates fix patches — opt-in
enable_poc_compilation	bool	false	Compiles PoC exploits — opt-in
enable_confidence_refinement	bool	true	Re-calibrates confidence scores
enable_cve_bootstrap	bool	true	Enriches findings with CVE data
enable_variant_search	bool	true	Searches for variant vulnerability instances
early_termination_threshold	float	1000.0	Stops scan after N medium+ findings (0.0 disables; Info findings excluded)
never_submit_enabled	bool	true	Enables never-submit pattern filter
never_submit_multiplier	float	0.1	Confidence multiplier when never-submit pattern matches

Setting	Section	Default	Effect
max_file_size_kb	[scanner]	512	Skip larger files
exclude_paths	[scanner]	["tests/", "docs/", "target/"]	Glob patterns to skip
exclude_rules	[scanner.semgrep]	[]	Semgrep rule IDs to skip
custom_rules	[scanner.semgrep]	[]	Inline semgrep YAML rules: blocks shipped in presets; materialized to temp files at scan time

Trade-off Callouts

LLM Cost vs. Recall

Disabling enable_confidence_refinement and enable_variant_search cuts LLM calls by ~40%. Expect 15-25% reduction in true positives.

Incremental Scan Caveats

Incremental scanning compares file SHA256 hashes but does not track dependency changes or config drift. Full rescan recommended after major changes.

Semgrep exclude_rules

[scanner.semgrep]
exclude_rules = ["html.security.plaintext-http-link"]

Use to suppress known false positives. Document each exclusion.

Early Termination Threshold

Controls when the scan stops based on finding count. Set to 0.0 to disable.

### Early Termination Threshold

Controls when the scan stops based on finding count. Only medium-and-above findings are counted (Info findings are excluded to prevent flooding). Set to `0.0` to disable.

```toml
[scanner.performance]
early_termination_threshold = 500.0

Scan stops after N medium+ findings. Useful for very large codebases. When triggered, an early_termination section is recorded in the JSON report.

Agent Flow Gate

Multi-agent harness synthesis (opt-in, default OFF). Enable only after understanding the requirements:

[agent_flow]
enabled = false
max_iterations = 10
requires_instrumented_target = false