rune-sast

Invoke the SAST scan on changed files or the full project. It detects your language from config files like package.json or pyproject.toml, runs all available analyzers such as ESLint, Bandit, or Semgrep, and returns findings normalized to BLOCK, WARN, and INFO severities.

Regex scanning catches obvious patterns like hardcoded secrets or SQL string concatenation. SAST tools like Semgrep and Bandit understand data flow and taint tracking, catching subtle issues like tainted data flowing through multiple function calls into a sink.

Bandit is the primary Python security scanner, run with medium-plus severity filtering in JSON mode. Ruff with security rules serves as a fallback, and Semgrep provides additional cross-language pattern analysis when installed.

The scan marks missing tools as SKIP with an explicit install instruction rather than failing. It continues with whatever tools are available and reports full tool coverage so you know exactly what ran and what was skipped.

Semgrep runs regardless of the primary language when installed, using community rules with cross-language support. Output is filtered to ERROR and WARNING severities to reduce noise from informational findings.

Use deep static analysis for security-sensitive code paths such as authentication, cryptography, and payments, or when a review flags suspicious patterns. Standard lint and type checks cover correctness but not taint flow or vulnerability patterns.