Sast Tooling

SAST Tooling

Overview

Static Application Security Testing (SAST) — find security defects in source code without running it. SAST catches the LOW-MEDIUM hygiene defects (verify=False, eval(user_input), hardcoded password= strings, unsafe deserialisation, weak cryptography) that secret-scanning and dep-currency-check don't cover. Per the S038 alf sweep verdict, this skill closes the "no SAST runner" gap (finding F-H2).

The runner choices in 2026, with Gemini freshness-probe corroboration (2026-05-22):

Companion skills:

• python-auth-security — what the findings SHOULD look like (no eval, parameterised SQL, etc.)
• secret-scanning — sister skill for secrets (gitleaks/trufflehog)
• dep-currency-check — sister skill for dependency CVEs (orthogonal to source-level SAST)
• llm-security — sister skill for LLM-specific defects
• _meta/gates.py (G_SECURE) — the gate this skill feeds

1. Tool selection — when to use which

The default 2026 setup for a polyglot CI gate: semgrep + bandit (Python) + eslint-security (JS/TS), each emitting SARIF, aggregated by G_SECURE. CodeQL adds the dataflow tier when budget / license permits.

2. Install Commands

RHEL 9 / AlmaLinux 9 / Rocky 9

# bandit
pip install --user bandit
bandit --version  # expects 1.9.x

# semgrep
pip install --user semgrep
semgrep --version  # expects 1.16x.x

# eslint-security (Node.js project)
npm install --save-dev eslint eslint-plugin-security

# CodeQL CLI (standalone — for use outside GHAS)
# Download from: https://github.com/github/codeql-cli-binaries/releases
# Place under ~/.local/bin/codeql

Debian 12 / Ubuntu 24.04

# Same pip / npm commands as RHEL
pip install --user bandit semgrep
# eslint-security per project

Windows 11

# Via pip (Python tools)
py -m pip install --user bandit semgrep
# Or scoop/chocolatey:
scoop install semgrep

Verify via env-adoption (S038 Batch A added these to the inventory):

jq '.tools | {bandit, semgrep, "pip-audit", "osv-scanner"}' ~/.claude/state/inventory.json

3. SARIF as the canonical output

SARIF 2.1.0 is the multi-tool standard. Every wrapper this skill describes emits SARIF, and G_SECURE consumes SARIF. This means findings from bandit / semgrep / eslint-security / CodeQL aggregate uniformly into one report, ingestable by GitHub Advanced Security, VS Code, JetBrains, Sonarqube, and most enterprise dashboards.

# bandit → SARIF
bandit -r src/ -f sarif -o /tmp/bandit.sarif

# semgrep → SARIF
semgrep --config auto --sarif --output /tmp/semgrep.sarif

# eslint-security → SARIF
npx eslint --format @microsoft/eslint-formatter-sarif --output-file /tmp/eslint.sarif src/

# CodeQL → SARIF (via Action; CLI: codeql database analyze --format=sarif-latest)

G_SECURE aggregates by reading SARIF and applying the configured severity threshold.

4. Canonical CI integration

4.1 GitHub Actions (.github/workflows/sast.yml)

name: sast
on: [pull_request, push]
jobs:
  semgrep:
    runs-on: ubuntu-latest
    permissions: { security-events: write }
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/python p/javascript p/typescript p/security-audit p/secrets
            p/r2c-security-audit p/owasp-top-ten
          generateSarif: true
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: semgrep.sarif }

  bandit:
    runs-on: ubuntu-latest
    if: contains(github.event.repository.topics, 'python') # gate on python repos
    permissions: { security-events: write }
    steps:
      - uses: actions/checkout@v4
      - run: pip install bandit
      - run: bandit -r . -ll -f sarif -o bandit.sarif || true
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: bandit.sarif }

  codeql:
    # Optional — CodeQL for deeper dataflow
    runs-on: ubuntu-latest
    permissions: { security-events: write }
    strategy:
      matrix: { language: [python, javascript] }
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with: { languages: ${{ matrix.language }} }
      - uses: github/codeql-action/analyze@v3

4.2 Pre-commit hook (POSIX)

# .git/hooks/pre-commit (extract)
if command -v semgrep >/dev/null 2>&1; then
  semgrep --config auto --error --quiet --skip-unknown-extensions $(git diff --cached --name-only) \
    || { echo "[semgrep] BLOCKING — review findings"; exit 1; }
fi

4.3 The G_SECURE gate (S038 Batch E)

python3 ~/.claude/skills/_meta/gates.py G_SECURE /path/to/project \
  --sast-mode advisory                # never blocks; reports
python3 ~/.claude/skills/_meta/gates.py G_SECURE /path/to/project \
  --sast-mode strict \
  --severity high                     # blocks on high+critical
python3 ~/.claude/skills/_meta/gates.py G_SECURE /path/to/project \
  --sast-mode strict \
  --severity critical \
  --runner semgrep                    # explicit runner choice

Exit codes mirror the family:

• 0 = pass (no findings at/above severity, OR advisory mode)
• 2 = fail (strict mode AND findings at/above severity)
• 3 = environmental error (no SAST runner available)

5. Per-runner notes

5.1 bandit (Python)

• Confidence levels: HIGH / MEDIUM / LOW. Default rules-loaded at all levels. -ll = medium-or-higher severity + medium-or-higher confidence. Recommended CI baseline.
• -ll filter is the most-cited 2026 baseline by the OpenSSF Python WG (the LOW-confidence rules produce too many FPs).
• Common-rule cheat-sheet:
  • B101 — assert outside tests (False in production)
  • B105/106/107 — hardcoded password strings/funcargs/defaults
  • B301 — pickle deserialisation (HIGH severity)
  • B324 — weak hash (md5/sha1)
  • B501 — verify=False in requests
  • B602/603/605/607 — subprocess shell-injection variants
  • B608 — SQL string concat
  • B701 — Jinja2 autoescape disabled
• Inline suppress: # nosec: <rule-id> — justification
• Project config: bandit.yaml or pyproject.toml [tool.bandit]

5.2 semgrep (multi-language)

• Free-tier rulesets: p/security-audit, p/owasp-top-ten, p/secrets, language-specific p/python / p/javascript / etc. The 2026 build has Agentic IDE hooks (Claude Code / Windsurf integration).
• Autofix: semgrep --autofix for the small subset of rules marked fix: in the YAML. Safe-by-default — only applies fixes that don't change semantics.
• Custom rules: YAML under .semgrep/. Pattern-based matching with metavariables; far more flexible than bandit.
• Inline suppress: // nosemgrep: <rule-id> (or language-comment variant)
• Project config: .semgrep.yml or --config <path>

5.3 eslint-security (JS/TS)

• eslint-plugin-security provides a focused security-only ruleset; add to your eslint config:

  {"extends": ["plugin:security/recommended"], "plugins": ["security"]}
  

• Coverage is narrower than semgrep for JS — they're complementary, not redundant.
• Key rules: detect-eval-with-expression, detect-non-literal-fs-filename, detect-non-literal-regexp, detect-unsafe-regex, detect-object-injection.

5.4 CodeQL

• GHAS Code Security add-on standalone: $30/committer/month (since Apr 2025 — Gemini freshness probe).
• Open-source / public repos: free via GitHub Actions.
• Strengths: deep dataflow analysis catches taint flows that pattern-matchers miss.
• Slow (compile-then-analyse) — use for nightly / pre-release scans, not every PR.
• Output: SARIF, ingestable by GHAS or third parties.

6. Security Hardening (the rules for THIS skill's usage)

1. Layer SAST + secrets + deps + LLM-security — each tool catches different things; none is sufficient alone.
2. Run advisory first, baseline existing findings, then go strict.
3. Document every suppression — # nosec: B608 — reason not bare # nosec.
4. CI gates use SARIF — feed into GitHub Advanced Security / Sonarqube / enterprise dashboards.
5. CI runs at least one SAST runner (semgrep is the cheapest baseline).
6. Pin SAST runner versions — semgrep's rule packs change, bandit's rule list updates; record the version in CI logs (bandit --version / semgrep --version).
7. Keep SAST runner versions current via dep-currency-check — semgrep ships new rule packs continuously.
8. Don't --autofix blindly in CI — review the diff. Auto-fixed code can change semantics for edge cases the fix-rule didn't anticipate.
9. Custom rules are project-specific — file under .semgrep/ in the repo, code-review additions.
10. alf sweep includes SAST runner currency — sees bandit/semgrep/gitleaks versions in the inventory and flags if the project's pinned version drifts.

7. Anti-patterns

8. Selection Cheatsheet

• Polyglot CI gate, fast → semgrep --config auto with --severity ERROR --error
• Python project + needs deep dataflow → bandit + CodeQL (Python)
• JS/TS in mixed repo → semgrep p/javascript + eslint-security inside ESLint
• Just want quick "is this code obviously bad" check locally → semgrep --config p/security-audit --autofix (local only)
• Need SARIF aggregated to GitHub Advanced Security → upload via github/codeql-action/upload-sarif@v3
• Need G_SECURE for bob WP-completion gate → python3 ~/.claude/skills/_meta/gates.py G_SECURE --sast-mode strict
• Need an advisory pass for forge Step 1 → --sast-mode advisory

9. Gotchas

10. Update triggers (alf scans these)

• bandit major version bump (currently 1.9.x as of 2026-05)
• semgrep major version bump (still on 1.x, but 2.0 would be material)
• semgrep rule pack additions for new attack patterns
• ESLint flat-config completion (deprecation of .eslintrc.* formats)
• New OWASP Top 10 edition (rules need re-mapping)
• CodeQL pricing / availability change
• New SARIF version (currently 2.1.0)
• Annual review on 2027-05-24

11. See Also