---
metadata:
  - name: generator
    content: Diplodoc Platform v5.57.3
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/sast.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/sast.md
  - href: en/sourcecraft/operations/sast.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt

# Static application security testing in SourceCraft

<!-- source: en/_includes/sourcecraft/sast-intro.md -->
_Static application security testing_ ([SAST](https://en.wikipedia.org/wiki/Static_application_security_testing)) analyzes source code to identify vulnerabilities, errors, and security standard violations without executing the actual code.

SourceCraft offers the following SAST tools:
* Built-in analyzers:
  * [OpenGrep](https://github.com/opengrep/opengrep), which follows the community-developed rules to identify vulnerabilities that are typical for popular programming languages.
  * [KICS](https://github.com/Checkmarx/kics), made to analyze and search for vulnerabilities in infrastructure configurations (Infrastructure as Code), along with other types of analysis.
* [Custom analyzer integration](https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/custom-security-analyzers.md) with uploading of results in SARIF format via the [CI process](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md).

The scan results originating from OpenGrep, KICS, and custom analyzers appear in [pull requests](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#pr) as comments submitted by the ![image](../../_assets/console-icons/shield-check.svg) **SourceCraft Security Bot**.
<!-- endsource: en/_includes/sourcecraft/sast-intro.md -->

To view the general list of detected issues:
1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories** and select a repository.
1. Under ![image](../../_assets/console-icons/shield-exclamation.svg) **Security** on the repository page, go to ![image](../../_assets/console-icons/square-dashed-letter-a.svg) **Code scanning**.

    {% note info %}

    Similarly, you can view a general list of issues for all repositories in the organization.

    {% endnote %}

    This list displays:
    * Issue name and number.
    * Last detected date.
    * Path to the problem file.
    * Risk level.
    * Incident status: **Open** or **Resolved**.
    * False positive mark (if any).

    To download a SARIF (Static Analysis Results Interchange Format) file for audit or integration with external systems, click **Download SARIF**.

    {% note tip %}

    You can filter issues by status (**Open**, **Solved**, and **False positive**), severity (**Critical**, **High**, **Medium**, and **Low**), scanner type, or file name.
    
    Also, you can sort ![image](../../_assets/console-icons/bars-descending-align-left.svg) issues by status or severity.

    {% endnote %}

1. To view detailed information about a specific issue, select it from the list.

    The page that opens displays the issue description, code block where it was detected, and history of events: when the warning was opened, who and when marked it as resolved or reopened it.

    {% note tip %}

    On this page, you can also [run](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/ca-triage.md) AI-powered vulnerability analysis.

    {% endnote %}

1. Optionally, to view the code trace (the route of malicious data from the source to the sink), click ![image](../../_assets/console-icons/route.svg) **Open trace** above the code block.

    The window that opens will display the source code of the file with step-by-step data transfer annotation. If multiple routes are available for the issue, you can switch between them using the drop-down list at the top right.

1. To mark an incident as resolved, follow these steps:
    1. Next to the incident, click **Resolve**.
    1. Add a comment for the incident.
    1. Optionally, mark the incident as a false positive.
    1. Click **Resolve**.
1. To reopen an incident, click **Reopen** next to it.

#### Useful links {#see-also}

* [Demo repository with vulnerabilities](https://sourcecraft.dev/examples/vulnerable-repo)
* [Security in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview.md)
* [Setting up a custom security analyzer in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/custom-security-analyzers.md)
* [Security dashboard in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/security-dashboard.md)
* [Analyzing vulnerabilities in SourceCraft repository dependencies](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/supply-chain.md)
* [Secret scanning in a SourceCraft repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/secret-scan.md)
* [AI-powered vulnerability analysis and prioritization in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/ca-triage.md)