Skip to main content

SAST — Static Application Security Testing

SAST inspects source code for insecure patterns, hardcoded secrets, and vulnerable dependencies without ever executing the application. Cybrium runs SAST directly against a connected Git repository and streams findings back into your workspace.

What it discovers​

  • Secret detection — API keys, tokens, private keys, and cloud credentials checked into history.
  • Dependency CVEs — vulnerable library versions across manifests and lockfiles.
  • Code pattern analysis — insecure sinks, injection risks, weak cryptography, and risky API usage.

When to use it​

Run SAST on every pull request for diff-aware feedback, and on a schedule against the default branch to catch drift. Use it before releases to confirm no new secrets or high-severity code patterns slipped through.

Connect an SCM integration first​

Tenant admin only

Connecting an SCM provider requires the Tenant Admin role.

  1. Go to Settings -> Integrations -> Source Control.
  2. Choose GitHub, GitLab, Azure Repos, or Bitbucket.
  3. Authenticate with a Personal Access Token, OAuth, or App Password. Pick the usage scope (Scan, Fix, or Both).
  4. Save. The integration now appears in the repo picker.

Screenshot: Source control integration setup with provider list

Launch a SAST scan​

  1. From the chat bar, type sast or scan repo and select a repository from the picker modal.
  2. Choose a branch or tag. For PR scans, pick the source and target branches; Cybrium only reports findings introduced by the diff.
  3. Confirm and start. The phase tracker shows a dedicated SAST phase ahead of any network phases.

What findings look like​

Each finding includes the file path, line range, a snippet of the offending code, the rule that matched, severity, and a suggested fix. Secret findings include a liveness check result showing whether the credential still authenticates.

Where results appear​

  • Findings tab, grouped by repository, file, and severity.
  • Topology tab as a code-level map of vulnerable modules and their callers.
  • A pull-request comment summarising new findings when the scan is attached to a PR.

Screenshot: SAST finding card showing code snippet and fix suggestion