Static Analysis (SAST)

What is SAST?

SAST is a technique that analyzes source code without executing it to detect patterns of security vulnerabilities such as SQL injection, XSS, and buffer overflows. Run it at the PR stage to block vulnerable code before it is merged into the main branch.

The configuration below is an example — a fully working implementation lives in the reference repository

The YAML and commands on this page are examples that show the essentials. For a complete, copy-and-run pipeline (including policy files and a sample app), see the Best Practice repository.

Tool Comparison

SAST tool selection criteria vary depending on supported languages and analysis depth. The following tools are widely used in the open-source ecosystem.

Tool	Key Characteristics	Supported Languages	License
Semgrep	Easy custom rule authoring, fast	30+ languages	LGPL-2.1 (Community Edition — managed rulesets use a separate license)
CodeQL	GitHub-native, deep analysis	12 major languages	Free on GitHub Actions
Bandit	Python-only, lightweight	Python	Apache-2.0
SpotBugs	Java/Kotlin-focused	Java, Kotlin, Scala	LGPL

For multi-language projects, Semgrep is usually the best fit. For teams using GitHub, CodeQL is often the best choice. For single-language projects, combining language-specific tools is recommended.

Semgrep Setup

Semgrep is easy to adopt quickly because it has rich public rulesets and straightforward custom rule authoring. Running semgrep ci in the official semgrep/semgrep container works directly in GitHub Actions without separate installation. (The old semgrep-action was deprecated in 2024.)

GitHub Actions

YAML
# .github/workflows/sast-semgrep.yml

name: SAST — Semgrep

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@v7

      - name: Run Semgrep
        run: semgrep ci
        env:
          SEMGREP_RULES: >-
            p/owasp-top-ten
            p/security-audit
            p/secrets

GitLab CI

YAML
# .gitlab-ci.yml (semgrep job section)

semgrep:
  stage: test
  image: semgrep/semgrep:latest
  script:
    - semgrep ci
      --config p/owasp-top-ten
      --config p/security-audit
      --error
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

Ruleset Selection Guide

Ruleset	Target	Description
p/owasp-top-ten	All	Detects OWASP Top 10 vulnerabilities
p/security-audit	All	Comprehensive security audit ruleset
p/secrets	All	Detects hardcoded secrets
p/python	Python	Python-specific security rules
p/java	Java	Java-specific security rules
p/javascript	JS/TS	JS/TS-specific security rules

Writing Custom Rules

You can add team-specific patterns as custom YAML rules in the .semgrep/ folder. This is useful for defining internal prohibited coding patterns that are not covered by public rulesets.

YAML
# .semgrep/custom-rules.yml

rules:
  - id: no-hardcoded-db-password
    patterns:
      - pattern: |
          $DB = new PDO("...", "...", "$PASSWORD", ...)
    message: |
      A hardcoded DB password was detected.
      Replace it with an environment variable.
    languages: [php]
    severity: ERROR

CodeQL Setup

CodeQL is a GitHub-only tool (on GitLab CI, use the Semgrep GitLab example above). It is available for free in GitHub Actions for public repositories and organizations subscribed to GitHub Code Security (the product split out of GitHub Advanced Security). It supports data flow analysis, enabling detection of indirect vulnerability paths.

GitHub Actions

YAML
# .github/workflows/sast-codeql.yml

name: SAST — CodeQL

on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1' # full scan every Monday at 2 AM

jobs:
  codeql:
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    steps:
      - uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript, python
          # Interpreted languages need no build step.
          # For compiled languages (java, cpp, ...) use build-mode: autobuild.
          build-mode: none
          # Supported languages: javascript, python, java,
          #            cpp, csharp, go, ruby, swift

      - name: Analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: '/language:javascript'

Adoption Considerations

Do not enable build blocking from day one

Gradual hardening: For the first 2-4 weeks, output warnings only. After the team gets familiar with results, switch to build blocking. If hundreds of warnings appear at once, alert fatigue can cause the team to ignore the tool.

False positive management: Semgrep can exclude specific files and paths using .semgrepignore. Excluding test code and third-party library paths is recommended.

Ruleset scope: Start with only p/owasp-top-ten, then expand after stabilization. Enabling every ruleset at once can increase false positives and disrupt developer workflow.

SAST Result Analyzer

Upload Semgrep/CodeQL result files to automatically generate vulnerability priorities and remediation guidance.

Preview with a sample first (no API key required)

You can view the analysis of a pre-built sample scan result right away, without an API key. Get a feel for what the tool produces first, then run a real analysis on your own results below.

Run a real analysis on your own results

This tool requires an Anthropic API key

It calls the Anthropic API directly from your browser. Enter your own Anthropic API key to use it right away. Your key and inputs are sent only from your browser to Anthropic (they never pass through a trustedoss server). Usage is billed to your own Anthropic account.

Self-Study

In-depth SAST result analysis with Claude Code

The analyzer above is available directly in your browser. If you need remediation code examples and .semgrepignore file generation, use the agent below.

Prerequisite: Clone the Trusted OSS repository

Bash
cd agents/sast-analyst
claude

The agent automatically performs the following:

Auto-detects Semgrep JSON / CodeQL SARIF
Generates direct remediation code examples by rule
Creates false-positive handling examples (.semgrepignore)
Provides a priority-based remediation roadmap

Next Steps

Dependency vulnerability management: SCA
Integrate the full pipeline: Pipeline Design