# Sast Configuration

> Iron Law: NO SAST CONFIGURATION WITHOUT READING THE CUSTOM RULES FILE FIRST

- Skill: `kumaran-is/sast-configuration` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add kumaran-is/sast-configuration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kumaran-is/sast-configuration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: kumaran-is (https://skillmd.com/u/kumaran-is)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kumaran-is/sast-configuration

---


## Iron Law: NO SAST CONFIGURATION WITHOUT READING THE CUSTOM RULES FILE FIRST

Read `references/semgrep-custom-rules.md` before writing or modifying any SAST configuration.

## When to Use

- Setting up scanning for a new service → tool selection + config templates
- Writing or modifying Semgrep rules → custom rules reference
- Integrating SAST into CI/CD → GitHub Actions example in tool config
- Triaging SAST findings → risk scoring and false positive suppression

## Process

1. **Detect languages** — Check for `pom.xml` (Java), `package.json` (TS), `pyproject.toml` (Python), `pubspec.yaml` (Dart)
2. **Load custom rules** — Read `references/semgrep-custom-rules.md` for project-specific rules already in place
3. **Select tools** — Java → SpotBugs + Semgrep; TS/Angular/NestJS → ESLint security + Semgrep; Python → Bandit + Semgrep; Dart → dart analyze
4. **Configure** — See `references/sast-tool-config.md` for config file templates and CI/CD step
5. **Run and triage** — Execute `/security-sast [path]`, classify findings, suppress false positives per the suppression patterns in tool config

## References

| File | Content |
|------|---------|
| `references/semgrep-custom-rules.md` | 10 custom Semgrep rules for Java/TS/Python, usage, suppression syntax |
| `references/sast-tool-config.md` | Tool comparison matrix, config templates (Bandit/.bandit, ESLint, dart analyze, Semgrep CI), risk scoring thresholds |

## Error Handling

If a scanner is not installed, report the install command from the tool config reference rather than skipping the scan silently.