Sast on Software Factory

Secure

Mon, 01 Jan 0001 00:00:00 +0000

GitLab Ultimate embeds a suite of security scanners directly into your CI/CD pipelines. They cover two complementary approaches: static analysis (source code, dependencies, secrets) and dynamic analysis (running application). All results are centralised in a single vulnerability report within GitLab.

Tip

Not familiar with the terminology? See SAST, DAST, SCA and other security terms in the glossary.

Coverity

Mon, 01 Jan 0001 00:00:00 +0000

Coverity is SAST tool developed by Synopsys that detects software defects and security vulnerabilities through deep code analysis.

Info

This page describes the tool independently of any platform-specific details. For the service URL and other platform-specific configuration, please refer to your platform’s dedicated page .

Static Application Security Testing (SAST)

Mon, 01 Jan 0001 00:00:00 +0000

GitLab Ultimate provides a SAST tool already integrated in your development environment. It helps developers identify security issues in their code during the development process, allowing them to fix vulnerabilities before they reach production.

The SAST scanner uses analyzers to detect vulnerabilities in source code. Currently, there are six officially supported analyzers:

GitLab Advanced Security: analyzer designed to discover vulnerabilities by performing cross-function and cross-file taint analysis
Semgrep: standard static scanner for most programming languages
Kubesec: designed to scan Kubernetes manifests and Helm Charts
sobelow: designed to scan Elixir applications
spotbug: designed to scan Java and Groovy applications
pmd-apex: designed to scan Apex code used in Salesforce applications

When the SAST scanner is integrated into your pipeline, it will select the scanner that best suits your repository.