S

SAST

GitLab's semgrep container image augmented with hundreds of additional Node.js/JavaScript/Typescript and Go rules from Semgrep's rule repository.

Go package for implementing customized rulesets for SAST analyzers

SAST Analyzer based on Semgrep

SAST Analyzer for Salesforce Apex projects based on pmd

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

A project containing "vulnerable" code for testing GitLab SAST functionality.

GitLab Analyzer for Infrastructure as Code (IaC) projects that calls kics. This analyzer is written in Go using the command library shared by all analyzers.

Static Application Security Testing (SAST) checks your source code for known vulnerabilities.

SAST Analyzer for detecting leaked secrets

SAST Analyzer for Kubernetes manifests based on kubesec

SAST Analyzer based on SpotBugs and Find Sec Bugs.

SAST Analyzer for Phoenix Elixir projects based on sobelow

Go package for implementing shared vulnerability structs for secure analyzers

GitLab PipeIntel - Scan GitLab CI pipelines for security and correctness issues using OPA policies and ShellCheck

Toolkit local-first de agentes IA para OpenCode. Orquesta subagentes cloud (OpenCode Go) y locales (Ollama), con memoria persistente (engram), OCR local (uocr) y generación/edición de imágenes (ComfyUI). Incluye dos agentes primary — agente-pobre (orquestador, optimización de costo) y agente-hacker-pobre (pentesting ético autorizado + auditoría de seguridad) — con skills de SAST/pentest, y un vault Obsidian de conocimiento. TypeScript (bun) + plugins de OpenCode.

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

Anura is an open-source harness platform built by the security research community to create an independent, realistic benchmark for AI systems used in security research. It runs models and agents against real public, authorized bug bounty scopes and security artifacts, then measures what they actually discover, validate, and reject in practical investigations.

A post-processor for computing the scope+offset fingerprint.

Qualor CI/CD component: code quality and security scanning with a quality gate, uploaded to your self-hosted Qualor server. Source: github.com/qualor-dev/qualor

Rule Repository for GitLab SAST