S

SAST

SAST Analyzer based on Semgrep

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

GitLab's semgrep container image augmented with hundreds of additional Node.js/JavaScript/Typescript and Go rules from Semgrep's rule repository.

Rule Repository for GitLab SAST

SAST Analyzer for detecting leaked secrets

Veracode Pipeline Scan Component This Veracode Pipeline Scan component runs the Veracode pipeline-scan as an action on any GitHub pipeline

The only pre-requisites is to have the application compiled/packaged according the Veracode Packaging Instructions here

About The pipeline-scan component is designed to be used in a CI/CD pipeline to submit a binary or source code zip to Veracode for security scanning.

For more information on Pipeline Scan, visit the Veracode Docs.

Veracode upload and scan component. This component will run a Veracode static scan as Sandbox scan or as policy scan.

This GitLab CI/CD pipeline implements a complete DevSecOps and GitOps workflow for a containerized application. It performs Dockerfile linting, builds and pushes images with Kaniko, runs Gitleaks and Trivy security scans, generates a CycloneDX SBOM, updates Kubernetes manifests through GitOps, performs DAST using OWASP ZAP and Nuclei, and generates a unified HTML security report with all scan results.

Setup Static Application Secret Testing (SAST) in GitLab CI pipeline using NJSScan and Semgrep.

A project containing "vulnerable" code for testing GitLab SAST functionality.

Test project with: Language: Elixir - Package Manager: Mix - Framework: Phoenix

A project containing clientside javascript (*.js & *.html)

A composite project that features all the languages supported by GitLab SAST.

Test project with: Languages: Ruby, JS - Package Managers: Bundler, Yarn

Test project with: Language: Ruby - Package Manager: Bundler - Framework : Rails

SAST Analyzer based on ESLint and its security plugin.

SAST Analyzer for NodeJS projects