# Goal Deliver a new SAST analyzer that leverages a software factory to dramatically accelerate our coverage and scan performance. ### Coverage * Language support for Objective-C, Swift * OWASP Mobile Top 10 support except for M3 and M9 * M3 and M9 will be covered by Semgrep until we have de-duplication logic in the next phase ### Quality * Build pipeline: Recall \>= 90%, Precision \>= 80% * MR: Recall \>= 80%, Precision \>= 90% * Results are consistent across runs * Findings are comparable in format and usefulness ### Deployment * Available in the pipeline and on MRs * Enabled via a variable: GITLAB_NEXT_GEN_SAST_ENABLED: true (default is true) ### Performance P95 runtime targets: * Build pipeline: \<= 10 minutes * MR: \<= 3 minutes * Large mono-repos (build pipeline): \< 30 minutes ### Features * Generates code flow to surface in GitLab's UI * Generates the same metadata provided by GLAS results for GitLab's UI * Available in the [Scan Configuration profile](https://docs.gitlab.com/user/application_security/configuration/security_configuration_profiles/) * _Note: Likely a no-op — dependency to track on the SRM team_ * Fully compatible with [security policies](https://docs.gitlab.com/user/application_security/policies/) * Collect the following [metrics](https://docs.google.com/document/d/1WAU0SjMim0eGiHRH8rC-nvPuILliSE25bsE7cGR0hC8/edit?tab=t.0) * Documentation (including supported rules) * Compatible with FP detection and vulnerability resolution ### Adoption Goals * Used in dogfooding * 3–5 design partner customers using Next-Gen SAST in their pipelines * Users of design partners are triaging or fixing findings