SAST (Static Analysis)

Analyzes the structure of your source code without executing it to find code-level vulnerabilities. The goal is to catch vulnerable code inside the repository before it ships. Used with the Source Code service.

한눈에 보기

Analysis

Code-level vulnerabilities (static analysis)

What you need

A registered Source Code service

Results

Findings by severity plus the vulnerable code location and snippet

Vulnerabilities it finds

• CRITICAL Immediately exploitable flaws such as hardcoded secrets and authentication bypass
• HIGH Unvalidated input paths such as SQL injection and command injection
• MEDIUM Conditional risks such as weak cryptography and path manipulation

Viewing results

Each finding shows the location and the relevant snippet of the vulnerable code. Clicking an item opens a detail drawer where you can review the description, reference (CWE), and recommended actions.

Handling results

• If it is not a real risk, suppress it as a false positive. The same item at the same location will not appear from the next scan onward.
• If you decide not to act on it now, mark it as accepted risk.
• For the detailed flow, see Vulnerability Management.

CI integration

To run SAST automatically on every pull request, issue a token in the service's [CI Trigger] and add a scan trigger step to your pipeline. See CI Integration for details.

Supported languages

Static analysis supports the following programming languages (29). Coverage keeps expanding.

Python · JavaScript · TypeScript · Java · Go · Ruby · PHP · C · C++ · C# · Kotlin · Rust · Scala · Swift · Dart · Elixir · OCaml · Lua · Julia · Bash · Solidity · Clojure · Apex · Terraform · Dockerfile · JSON · YAML · HTML · Generic

Next steps

Vulnerability Management→Review findings and mark false positives / accepted riskCompliance→Mapping to OWASP / CWE standardsSource Code overview→Turn on other analyses and CI integration