sast-configuration

Static application security testing in CI/CD pipelines is configured by integrating tools like Semgrep, SonarQube, or CodeQL to automate vulnerability detection. This Skill generates CI-ready scanning setups, defines quality gates, and outputs SARIF reports to block risky deployments.

False positive tuning in SonarQube and Semgrep is achieved by customizing rules and adjusting quality thresholds to fit your organization. This Skill configures language-aware scanning setups and manages rule policies to minimize noisy alerts while retaining critical findings.

CodeQL supports language-aware scanning for automated vulnerability detection across common application stacks. This Skill helps you select the best SAST toolset, configuring CodeQL alongside Semgrep and SonarQube to baseline repositories and enforce pre-commit checks.

SARIF-ready reports for security scanning are generated by configuring static analysis tools within your CI workflows. This Skill sets up Semgrep, SonarQube, or CodeQL to output SARIF format, enabling automated vulnerability detection and release gate enforcement.

Custom rule authoring for code vulnerability scanning is needed when baseline security scans produce excessive false positives or miss organization-specific threats. This Skill configures custom rules and quality gates to standardize security checks across projects.