SAST (Static Application Security Testing) Setup in CI/CD

You spent two weeks debugging a production incident — an SQL injection that a dynamic scanner missed. Sound familiar? We integrate SAST (Static Application Security Testing) directly into your CI/CD pipeline: analyzing source code without execution. SQL injection, XSS, hardcoded secrets, unsafe functions — we catch them before merge. On one project with 10 developers using TypeScript and Python, we deployed Semgrep and CodeQL in 3 days. Result: 12 critical vulnerabilities blocked at the PR stage, saving 40% review time. One of the vulnerabilities found was an SQL injection via template strings that static analyzers missed until we implemented custom rules. After configuring Semgrep with a rule for SQL concatenation, such errors are automatically blocked. Contact us to assess your project.

What vulnerabilities does SAST detect?

SAST covers the entire OWASP Top Ten: SQL injections, XSS, insecure deserialization, broken authentication. For example, Semgrep catches direct SQL concatenation in strings, while CodeQL tracks data flows for SSRF and RCE. Gitleaks finds API keys, tokens, and passwords, even if they were committed three years ago. In one project, we found an AWS key that had been in the git history for three years.

SAST Tools

Semgrep — fast, supports 30+ languages, custom rules. Example basic scan and a custom rule for detecting direct SQL concatenation:

# Installation
pip install semgrep

# Scan with security rule sets
semgrep scan --config=p/security-audit \
  --config=p/owasp-top-ten \
  --config=p/typescript \
  --json > semgrep-results.json

# Custom rule: find direct SQL concatenation
cat > rules/sql-injection.yml << 'EOF'
rules:
  - id: raw-sql-concatenation
    patterns:
      - pattern: |
          "SELECT ... " + $VAR
      - pattern: |
          `SELECT ... ${$VAR}`
    message: "Potential SQL injection: use parameterized queries"
    severity: ERROR
    languages: [typescript, javascript]
EOF

semgrep scan --config=rules/sql-injection.yml src/

GitHub Advanced Security (CodeQL) — data flow analysis for complex vulnerabilities:

# .github/workflows/codeql.yml
name: CodeQL
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 0 * * 1' # Weekly
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
    strategy:
      matrix:
        language: [javascript-typescript]
    steps:
      - uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
      - name: Analyze
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"

Secrets Scanning

# Gitleaks: search for secrets in code and git history
docker run --rm -v $(pwd):/path \
  zricethezav/gitleaks:latest detect \
  --source /path \
  --report-format json \
  --report-path /path/gitleaks-report.json

# truffleHog: analyze git history
trufflehog git file://. --json > secrets-report.json

# GitHub Actions: pre-commit hook for secrets
- name: Check for secrets
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

ESLint Security Plugins

npm install --save-dev eslint-plugin-security eslint-plugin-no-unsanitized @microsoft/eslint-plugin-sdl
cat > .eslintrc.json << 'EOF'
{
  "plugins": ["security", "no-unsanitized", "@microsoft/sdl"],
  "extends": [
    "plugin:security/recommended",
    "plugin:@microsoft/sdl/required"
  ],
  "rules": {
    "security/detect-object-injection": "error",
    "security/detect-non-literal-regexp": "warn",
    "security/detect-possible-timing-attacks": "error",
    "no-unsanitized/method": "error",
    "no-unsanitized/property": "error"
  }
}
EOF

CI/CD Integration

Combine Semgrep and Gitleaks in one pipeline (GitHub Actions example):

# .github/workflows/sast.yml
name: SAST
on: [push, pull_request]
jobs:
  combined:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/typescript
          auditOn: push
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
      - name: Secrets scan (Gitleaks)
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

SAST Tools Comparison

SAST Implementation Phases

How to Interpret SAST Results?

Each warning includes a vulnerability description, code line, and call stack. HIGH and CRITICAL block PRs—they must be fixed immediately. WARNING and INFO go into a backlog and are assigned to the code owner. We recommend weekly triage of new findings. This reduces ignored vulnerabilities and keeps the codebase clean.

How to Set Up SAST in CI/CD in 1–2 Days?

We connect the chosen tools to your repository: create a workflow file, configure rules for your stack (React, Node, Python—pull ready-made sets). Then we adjust blocking thresholds: HIGH and CRITICAL fail the build; everything else goes into the backlog. Your team gets a report via the GitHub Security tab or a Semgrep dashboard.

Why Semgrep Over Custom Scripts?

Custom regexes fail on obfuscated code and lack context. Semgrep analyzes the AST—it distinguishes eval(user_input) from eval(sanitized). In our projects, this reduces false positives by 40% compared to grep-based approaches. Plus, custom rules are written in 15 minutes and applied to hundreds of files.

What's Included in SAST Setup

• Selection and installation of one or more tools (Semgrep/CodeQL/Gitleaks)
• Rule adaptation to your technology stack
• Integration into CI/CD (GitHub Actions, GitLab CI, Jenkins)
• Documentation on interpreting results
• Team training (1-hour workshop)
• 2 weeks of support after deployment

With our 5+ years of experience and 50+ projects, SAST setup is performed without disruptions. We guarantee that critical vulnerabilities are blocked before merge. Contact us to assess your project—we'll evaluate it within one day.

SAST rule: we don't block PRs on every warning, only on HIGH and CRITICAL. The rest go into a security debt backlog.