## 1 Introduction
Nevertheless, this integration is fraught with significant challenges, including the complexity of tool configuration, false-positive management, elevated costs associated with continuous maintenance, the substantial expenses imposed by tool vendors, and the lack of transparency in detection and remediation mechanisms. Although advances in SSDLC and DevSecOps have bolstered the capabilities of vulnerability detection approaches, programming languages continue to be a significant source of security risks. The study _On the Vulnerability Proneness of Multilingual Code_[11], leveraging Negative Binomial Regression (NBR), highlighted high vulnerability indices for languages such as C, C++, PHP, and Java. The extensive use of PHP in legacy web applications, coupled with the critical roles of Java, C, and C++ in high-performance systems requiring explicit memory management, exacerbates their exposure to security challenges. These characteristics, despite the maturity and widespread use of these languages, continue to exert pressure regarding the integration of robust security features, ensuring comprehensive policy coverage, and conducting regular monitoring [12]. Such attributes render these languages particularly vulnerable within dynamic and evolving codebases [13]. As underscored by [14; 15], the aforementioned challenges can significantly extend testing timelines and, if inadequately managed, may lead to delays in delivery or the deployment of insecure code into production environments. To mitigate these issues, ML techniques have been introduced to enhance the efficiency and accuracy of methods for the review of vulnerable code. According to [14; 16], ML approaches can refine the analysis of vulnerable code by examining relationships between code fragments, swiftly identifying faults, mapping secure to insecure code, and improving error detection rates. These innovations have markedly reduced review times, as reflected in improved performance metrics. While the use of ML is appealing due to its capacity for automation and quantifiable performance in code review tasks, significant challenges still exist, as outlined below. * _Generalization Challenges:_ Numerous ML models rely on superficial patterns rather than a profound comprehension of code context, therefore limiting their efficacy in detecting novel vulnerabilities. Furthermore, many models are designed to analyze only one programming language, posing a significant obstacle in environments requiring the evaluation of multiple languages [17]. * _Dependence on Extensive Data Sets:_ Traditional approaches require vast data sets annotated at the token or sequence level to identify vulnerabilities, increasing processing demands and diminishing the inherent advantages of these models. Despite the significant potential of Deep Learning (DL), Natural Language Processing (NLP), and Statistical Learning (SL) approaches, these techniques face limitations stemming from the scarcity and diversity of training samples, complicating their generalization and prolonging annotation processes [11; 18]. * _Static Nature:_ Many models struggle to adapt to evolving codebases and emerging vulnerabilities, therefore reducing their efficacy over time and necessitating frequent re-training, which imposes considerable operational overheads [18]. * _Insufficient Contextual Responses:_ ML-based tools often fail to provide actionable and precise responses, which is particularly problematic in the DevSecOps context, where practical and direct solutions for code correction are essential. This lack of interpretability represents a challenge for security analysts, who require accurate and contextually grounded insights within their workflows [19; 20]. The challenges associated with effectively addressing vulnerabilities in source code have amplified the necessity for practical and timely solutions in real-world scenarios despite existing contributions from SSDLC, DevSecOps, and ML.