Static application security testing

Craft it

1. Run a pattern scanner with a community rule pack and record the baseline.
2. Write custom rules for your own wrappers (your query builder, your HTTP client), each with a positive and negative test file.
3. Scan only changed files on PRs (diff-aware mode) and the whole repository on a schedule.

Reverse engineer it

Signs that a codebase already runs this technique, and where to read how it is configured.

• A codeql-analysis workflow, .semgrep.yml or a rules/ directory with YAML rules.
• bandit, gosec or security-code-scan in CI or pre-commit.
• SARIF uploads (github/codeql-action/upload-sarif) in workflows.

Where the scanned repositories configure it:

• .github/workflows/*.yml in 70 repositories
• .pre-commit-config.yaml in 4 repositories
• pyproject.toml in 1 repositories
• tox.ini in 1 repositories

Detected by the scanner as: Security scanning (injection, unsafe apis and tainted data reaching a sink.)