## 6 Conclusions  
Detecting and resolving vulnerabilities is essential for preserving the availability, confidentiality, and integrity of digital systems. In an era where data intrusions can result in substantial financial losses, tarnished reputations, and legal repercussions, ensuring system security becomes crucial. Malicious actors can exploit unpatched vulnerabilities, resulting in unauthorized access, data theft, or even system shutdowns. Moreover, our growing dependence on digital infrastructure in industries like healthcare, finance, and transportation amplifies the real-world consequences of these vulnerabilities. A compromised system can endanger lives, destabilize economies, and diminish public confidence. Beyond tangible effects, addressing vulnerabilities reinforces an organization's commitment to its users, enhancing trust in its digital offerings. Detecting and resolving vulnerabilities is a fundamental aspect of responsible digital stewardship, not just a technical necessity.  
In this paper, we have provided an overview of the primary directions in which artificial intelligence is increasingly being used in programming, formulated a categorization for determining both the nature of sensitive data and the application's vulnerability, and developed a process based on the GPT API to detect the CWE-653 vulnerability. Although GPT-3.5 underperformed during the evaluations, GPT-4 obtained an accuracy of 88.76%, confirming our hypotheses regarding the static code analysis and interpretation capabilities of large language models. We hope our research offers a deeper understanding of AI's potential in software engineering. Our presented methodology aims to facilitate the design and implementation of new code analysis techniques. These techniques can greatly aid in analyzing more complex source code, improving its quality and enhancingvulnerability detection for development teams. Furthermore, we aspire to promote similar research directions for fellow research groups.  
The following supporting information can be downloaded at [[https://www.mdpi.com/article/10.3390/fi15100326/s1](https://www.mdpi.com/article/10.3390/fi15100326/s1)]([https://www.mdpi.com/article/10.3390/fi15100326/s1](https://www.mdpi.com/article/10.3390/fi15100326/s1)).  
Conceptualization, Z.S. and V.B.; methodology, Z.S.; validation, Z.S.; writing--original draft preparation, Z.S.; writing--review and editing, Z.S. and V.B.; visualization, Z.S.; supervision, V.B. All authors have read and agreed to the published version of the manuscript.  
The research was supported by the Ministry of Innovation and Technology NRDI Office within the framework of the Artificial Intelligence National Laboratory Program (RRF-2.3.1-21-2022-00004). Project No. TKP2021-NVA-09 has been implemented with the support provided by the Ministry of Innovation and Technology of Hungary from the National Research, Development and Innovation Fund, financed under the TKP2021-NVA funding scheme.  
No further data beyond what was published in the main text is publicly available.  
We would like to thank [PERSON] for developing the GitHub crawler and helping us with the selection and minification of the sample projects.  
The authors declare no conflicts of interest.  
The following abbreviations are used in this manuscript:  
Application programming interface  
API  
Attribute-based access control  
ABAC  
Automatic program repair  
APR  
Common weakness enumeration  
CWE  
Data access object  
DAO  
Generative pre-trained transformer  
GPT  
Large language model  
LLM  
Reinforcement learning from human feedback  
RLHF  
Role-based access control  
RBAC