Why I built attack-chain correlation on top of Semgrep and Joern

I've been running security scans on codebases for a while, and the thing that always bothered me...