You&#x27;d really need to see the paper to evaluate this, because pretty much every static analysis technique can generate lists of &quot;undetected security flaws&quot;, especially if the corpus of application code is unconstrained. You&#x27;d want to know:<p>* Did they find a kind of security flaw that is particularly difficult to detect? Like, reliable generic authorization bypass detection result would be novel.<p>* Did they find 23 flaws in <i>popular and important Rails apps</i>? Those applications have probably been tested extensively already, and new results are interesting. Random e-commerce applications buried in Github, less so.<p>* How severe were the flaws? Security flaws range from remote code execution on the very damaging side to version information disclosure on the marginal side.