SAST (Static Application Security Testing) Setup in CI/CD

You spent two weeks debugging a production incident — an SQL injection that a dynamic scanner missed. Sound familiar? We integrate SAST (Static Application Security Testing) directly into your CI/CD pipeline: analyzing source code without execution. SQL injection, XSS, hardcoded secrets, unsafe functions — we catch them before merge. On one project with 10 developers using TypeScript and Python, we deployed Semgrep and CodeQL in 3 days. Result: 12 critical vulnerabilities blocked at the PR stage, saving 40% review time. One of the vulnerabilities found was an SQL injection via template strings that static analyzers missed until we implemented custom rules. After configuring Semgrep with a rule for SQL concatenation, such errors are automatically blocked. Contact us to assess your project.

What vulnerabilities does SAST detect?

SAST covers the entire OWASP Top Ten: SQL injections, XSS, insecure deserialization, broken authentication. For example, Semgrep catches direct SQL concatenation in strings, while CodeQL tracks data flows for SSRF and RCE. Gitleaks finds API keys, tokens, and passwords, even if they were committed three years ago. In one project, we found an AWS key that had been in the git history for three years.

SAST Tools

Semgrep — fast, supports 30+ languages, custom rules. Example basic scan and a custom rule for detecting direct SQL concatenation:

# Installation pip install semgrep # Scan with security rule sets semgrep scan --config=p/security-audit \ --config=p/owasp-top-ten \ --config=p/typescript \ --json > semgrep-results.json # Custom rule: find direct SQL concatenation cat > rules/sql-injection.yml << 'EOF' rules: - id: raw-sql-concatenation patterns: - pattern: | "SELECT ... " + $VAR - pattern: | `SELECT ... ${$VAR}` message: "Potential SQL injection: use parameterized queries" severity: ERROR languages: [typescript, javascript] EOF semgrep scan --config=rules/sql-injection.yml src/ 

GitHub Advanced Security (CodeQL) — data flow analysis for complex vulnerabilities:

# .github/workflows/codeql.yml name: CodeQL on: push: branches: [main] pull_request: branches: [main] schedule: - cron: '0 0 * * 1' # Weekly jobs: analyze: runs-on: ubuntu-latest permissions: security-events: write actions: read strategy: matrix: language: [javascript-typescript] steps: - uses: actions/checkout@v4 - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} queries: security-and-quality - name: Autobuild uses: github/codeql-action/autobuild@v3 - name: Analyze uses: github/codeql-action/analyze@v3 with: category: "/language:${{ matrix.language }}" 

Secrets Scanning

# Gitleaks: search for secrets in code and git history docker run --rm -v $(pwd):/path \ zricethezav/gitleaks:latest detect \ --source /path \ --report-format json \ --report-path /path/gitleaks-report.json # truffleHog: analyze git history trufflehog git file://. --json > secrets-report.json # GitHub Actions: pre-commit hook for secrets - name: Check for secrets uses: gitleaks/gitleaks-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} 

ESLint Security Plugins

npm install --save-dev eslint-plugin-security eslint-plugin-no-unsanitized @microsoft/eslint-plugin-sdl cat > .eslintrc.json << 'EOF' { "plugins": ["security", "no-unsanitized", "@microsoft/sdl"], "extends": [ "plugin:security/recommended", "plugin:@microsoft/sdl/required" ], "rules": { "security/detect-object-injection": "error", "security/detect-non-literal-regexp": "warn", "security/detect-possible-timing-attacks": "error", "no-unsanitized/method": "error", "no-unsanitized/property": "error" } } EOF 

CI/CD Integration

Combine Semgrep and Gitleaks in one pipeline (GitHub Actions example):

# .github/workflows/sast.yml name: SAST on: [push, pull_request] jobs: combined: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: Semgrep uses: returntocorp/semgrep-action@v1 with: config: >- p/security-audit p/owasp-top-ten p/typescript auditOn: push env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} - name: Secrets scan (Gitleaks) uses: gitleaks/gitleaks-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 

SAST Tools Comparison

SAST Implementation Phases

How to Interpret SAST Results?

Each warning includes a vulnerability description, code line, and call stack. HIGH and CRITICAL block PRs—they must be fixed immediately. WARNING and INFO go into a backlog and are assigned to the code owner. We recommend weekly triage of new findings. This reduces ignored vulnerabilities and keeps the codebase clean.

How to Set Up SAST in CI/CD in 1–2 Days?

We connect the chosen tools to your repository: create a workflow file, configure rules for your stack (React, Node, Python—pull ready-made sets). Then we adjust blocking thresholds: HIGH and CRITICAL fail the build; everything else goes into the backlog. Your team gets a report via the GitHub Security tab or a Semgrep dashboard.

Why Semgrep Over Custom Scripts?

Custom regexes fail on obfuscated code and lack context. Semgrep analyzes the AST—it distinguishes eval(user_input) from eval(sanitized). In our projects, this reduces false positives by 40% compared to grep-based approaches. Plus, custom rules are written in 15 minutes and applied to hundreds of files.

What's Included in SAST Setup

• Selection and installation of one or more tools (Semgrep/CodeQL/Gitleaks)
• Rule adaptation to your technology stack
• Integration into CI/CD (GitHub Actions, GitLab CI, Jenkins)
• Documentation on interpreting results
• Team training (1-hour workshop)
• 2 weeks of support after deployment

With our 5+ years of experience and 50+ projects, SAST setup is performed without disruptions. We guarantee that critical vulnerabilities are blocked before merge. Contact us to assess your project—we'll evaluate it within one day.

SAST rule: we don't block PRs on every warning, only on HIGH and CRITICAL. The rest go into a security debt backlog.