---
metadata:
  - name: generator
    content: Diplodoc Platform v5.57.3
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/custom-security-analyzers.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/tutorials/custom-security-analyzers.md
  - href: en/sourcecraft/tutorials/custom-security-analyzers.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
title: Setting up a custom security analyzer in SourceCraft
description: In this tutorial, you will set up a custom security analyzer in a SourceCraft repository.
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt


<!-- source: en/_tutorials/security/custom-security-analyzers.md -->
# Setting up a custom security analyzer in SourceCraft

In this tutorial, you will set up SourceCraft not only to help you with coding but also to scan the code for vulnerabilities and misconfigurations. You will do it by hooking up a code analyzer and linter to the [repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#repos) and integrating the scan results directly into the [pull request](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#pr).

To set up a custom analyzer in a SourceCraft repository:

1. [Create a repository](#create-repository).
1. [Set up an analyzer](#config-ci-cd).
1. [Create a pull request](#create-pr).
1. [Check the result](#check-ci-cd).

If you no longer need the resources you created, [delete them](#clear-out).


## Create a repository {#create-repository}

Create a repository in SourceCraft and enable security scanning.

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  1. Open the [service home page](https://sourcecraft.dev).
  1. In the left-hand panel, click ![image](../../_assets/console-icons/plus.svg) **Create repository**.
  1. In the window that opens, select ![image](../../_assets/console-icons/archive.svg) **Blank repository**.
  1. Under **Your new repository details**:
      * In the **Owner** field, select the [organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#org).
      * In the **Name** field, specify a name for the repository.

          The name must be unique within the organization and can include the following [ASCII characters](https://en.wikipedia.org/wiki/ASCII): lowercase and uppercase Latin letters, numbers, commas, hyphens, and underscores.

          The repository’s address is displayed below its name.

  1. Under **Configuration**, enable **Initialize repository with a README**.
  1. Click **Create repository**.
  1. Wait until the repository is created, then navigate to ![image](../../_assets/console-icons/shield.svg) **Security** under ![image](../../_assets/console-icons/gear.svg) **Repository settings** on the repository page.
  1. Enable **Repository scanning**.

{% endlist %}


## Set up an analyzer {#config-ci-cd}

Set up CI/CD to run a custom security analyzer. Do it by creating a configuration file that defines two pipelines: one to run [Golangci-lint](https://golangci-lint.run/) and the other to run [Semgrep](https://semgrep.dev/), the static analysis tool.

For SourceCraft integration, make sure your analyzers outputs the results in [SARIF](https://sarif.info/) format. This format supports standardization of static analysis results and their integration into the platform's UI.

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, navigate to ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace** → ![image](../../_assets/console-icons/archive.svg) **Repositories**.
  1. Select the repository you created earlier.
  1. Under ![image](../../_assets/console-icons/code.svg) **Code** on the repository page, go to ![image](../../_assets/console-icons/archive.svg) **Overview**.
  1. Click ![image](../../_assets/console-icons/plus.svg) **New** → ![image](../../_assets/console-icons/file.svg) **File**.
  1. In the window that opens, specify the `.sourcecraft/ci.yaml` file path and click **Create file**.
  1. Insert the following code:

      ```yaml
      on:
        pull_request:
          - workflows: [ security-pipeline1, security-pipeline2 ]
            filter:
              source_branches: [ "**" ]
              target_branches: [ "main", "develop" ]

        push:
          - workflows: [ security-pipeline ]
            filter:
              branches: [ "main", "develop" ]

      workflows:
        security-pipeline1:
          tasks:
            - name: golangci-lint-security-scan
              cubes:
                - name: env
                  script:
                    - env
                # Step 1: Run your security scanner
                - name: run-security-scanner
                  image:
                    name: golangci/golangci-lint:v2.5.0-alpine
                  script:
                    - cd $SOURCECRAFT_WORKSPACE
                    - golangci-lint run --output.sarif.path $SOURCECRAFT_WORKSPACE/result.sarif || true

                # Step 2: Optional - Debug/validate results
                - name: validate-scan-results
                  script:
                    - cat $SOURCECRAFT_WORKSPACE/result.sarif

                # Step 3: Upload results to SourceCraft
                - name: upload-sarif-to-sourcecraft
                  image:
                    name: sourcecraft/scan-result-uploader:0.6.0
                  script:
                    - export APPSEC_CUSTOM_ENGINE_NAME="golangci-lint"
                    - /app/bin/scan-result-uploader

        security-pipeline2:
          tasks:
            - name: semgrep-security-scan
              cubes:
                - name: env
                  script:
                    - env
                # Step 1: Run your security scanner
                - name: semgrep-scan
                  image:
                    name: semgrep/semgrep:latest
                  script:
                    - semgrep --config=auto --sarif --output $SOURCECRAFT_WORKSPACE/result.sarif $SOURCECRAFT_WORKSPACE || true

                # Step 2: Optional - Debug/validate results
                - name: validate-scan-results
                  script:
                    - cat $SOURCECRAFT_WORKSPACE/result.sarif

                # Step 3: Upload results to SourceCraft
                - name: scan-result-uploader
                  image:
                    name: sourcecraft/scan-result-uploader:0.6.0
                  script:
                    - export APPSEC_CUSTOM_ENGINE_NAME="Semgrep OSS"
                    - /app/bin/scan-result-uploader
      ```

  1. In the top-right corner, click **Commit changes**.
  1. In the window that opens:
      1. In the **Commit message** field, enter this comment:

          ```text
          Setting up a security analyzer
          ```

      1. Under **Commit branch**, select `Save directly to the branch: main`.
      1. Under **After commit action**, select `Just commit`.
      1. Click **Commit changes**.

{% endlist %}


## Create a pull request {#create-pr}

Create a test file and a pull request to automatically run security checks.

This example uses test code from OWASP Juice Shop, an intentionally vulnerable web application created for security training. You can check it out in the [juice-shop](https://github.com/juice-shop/juice-shop) GitHub repository.

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, navigate to ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace** → ![image](../../_assets/console-icons/archive.svg) **Repositories**.
  1. Select the repository you created earlier.
  1. Under ![image](../../_assets/console-icons/code.svg) **Code** on the repository page, go to ![image](../../_assets/console-icons/archive.svg) **Overview**.
  1. Click ![image](../../_assets/console-icons/plus.svg) **New** → ![image](../../_assets/console-icons/file.svg) **File**.
  1. In the window that opens, specify the path with the file name, e.g., `routes/redirect.ts`, and click **Create file**.
  1. Copy and paste the code from the [relevant file](https://github.com/juice-shop/juice-shop/blob/master/routes/redirect.ts) in the `juice-shop` repository.
  1. In the top-right corner, click **Commit changes**.
  1. In the window that opens:
      1. In the **Commit message** field, enter this comment:

          ```text
          Security analyzer test code
          ```

      1. Under **Commit branch**, select `Create a new branch for these changes` and enter `test-analyzer` for branch name.
      1. Under **After commit action**, select `Commit and create a new pull request`.
      1. Click **Commit changes**.

  1. In the **Create pull request** window that opens, click **Publish pull request** in the top-right corner.

      You will now see the pull request page showing the checks currently running. Refresh it and wait for the `security-pipeline1` and `security-pipeline2` checks to complete.

{% endlist %}


## Check the result {#check-ci-cd}

Check the security scan output shown on the pull request page and containing the following information:

* Comments and warnings from the pull request author.
* List of results from the configured analyzers and linters.
* Detailed descriptions of detected issues with their locations in code.

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, navigate to ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace** → ![image](../../_assets/console-icons/archive.svg) **Repositories**.
  1. Select the repository you created earlier.
  1. Under ![image](../../_assets/console-icons/code.svg) **Code** on the repository page, go to ![image](../../_assets/console-icons/code-pull-request.svg) **Pull requests**.
  1. Select the `test-analyzer` pull request.
  1. Under **Activity**, review the comments from `SourceCraft Security Bot`.

      Here is an example of a comment based on the check results:

      ```text
      ...
      res.redirect(toUrl)
      ...

      🔒 [Semgrep OSS] has found the potential problem

      ⚠️ Problem: The application redirects to a URL specified by user-supplied input query that is not
      validated. This could redirect users to malicious locations. Consider using an allow-list approach
      to validate URLs, or warn users they are being redirected to a third-party website.

      Short Description: Semgrep Finding: javascript.express.security.audit.express-open-redirect.express-open-redirect

      Full Description: The application redirects to a URL specified by user-supplied input $REQ that is
      not validated. This could redirect users to malicious locations. Consider using an allow-list
      approach to validate URLs, or warn users they are being redirected to a third-party website.
      ```

{% endlist %}


## How to delete the resources you created {#clear-out}

If you no longer need the repository you created, [delete](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/repo-delete.md) it.


## Useful links {#see-also}

* [Setting up CI/CD to deploy an application to Yandex Serverless Containers using GitHub Actions](https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/ci-cd-sourcecraft-github-actions.md)
* [Configuring CI/CD between SourceCraft and Yandex Cloud Functions](https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/ci-cd-sourcecraft-functions.md)
* [Configuring a service connection to Yandex Cloud in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/service-connections.md)
* [Integration with GitHub Actions in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/gh-actions.md)
<!-- endsource: en/_tutorials/security/custom-security-analyzers.md -->