SAST in use

sast_in_use

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Family

CI/ CD tools

Description

Does the project use static code analysis tools?

This check tries to determine if the project uses Static Application Security Testing (SAST), also known as static code analysis.

Security

SAST is analyzing source code before the software is run. This means that the source code can be checked for bugs before it is integrated or complete and ready for delivery.

Using SAST tools can prevent known classes of bugs from being inadvertently introduced in the codebase. Many SAST tools are specialized in catching security flaws; while others are more generic and look for generic defects in source code and configurations.

Lack of SAST increase the risk of unknown bugs (and security vulnerabilities for the security-focused tools) in the delivered software.

The check looks for execution of known SAST tools in the recent merged PRs, or the usage of these tools in CI workflows.

Mitigation / Fix

Run a SAST tool in your CI/CD workflow, early and often, so a flaw is caught on the pull request that introduces it rather than after release. The check looks for a known SAST tool in the pipeline definitions and build scripts of the project.

This check reads pipeline definitions and build scripts only. A scan run anywhere else — from a developer’s machine, or a pipeline living in another repository — is not visible to it, so the finding stays open until the scanning step belongs to a pipeline this project owns.

Xygeni Code Security

Xygeni Code Security runs SAST as a step of the pipeline. Add the scanner command to the workflow:

# SAST only
xygeni sast -n $PROJECT -d .

# Or together with the other scans of the same run
xygeni scan --run=sast,secrets,deps -n $PROJECT -d .

On GitHub Actions the same scan is available as an action, and on Azure Pipelines as the xygeni-scanner task with sast: true:

- name: Xygeni SAST
  uses: xygeni/xygeni-action@<commit-sha> # pin to a release commit
  with:
    command: sast
    token: ${{ secrets.XYGENI_TOKEN }}

Fail the pipeline on the findings that matter — see the scan policies — so the scan gates the change instead of only reporting on it.