SAST Scan

Static Application Security Testing (SAST) examines source code to detect vulnerabilities without executing the application. Gerion uses Opengrep with rules from the Semgrep Registry.

Run

gerion sast-scan [PATH]

# Scan the current directory
gerion sast-scan .

# Save results as SARIF
gerion sast-scan . --format sarif --output-file sast.sarif

# Send results to the Gerion API
gerion sast-scan . --api-url $GERION_API_URL --api-key $GERION_API_KEY

Supported languages

Language	Extensions
Python	.py
JavaScript	.js, .jsx, .mjs
TypeScript	.ts, .tsx
Java	.java
Go	.go
C	.c, .h
C++	.cpp, .cc, .cxx, .hpp
C#	.cs
PHP	.php
Ruby	.rb
Kotlin	.kt
Scala	.scala
Rust	.rs
Swift	.swift
Dart	.dart
Bash / Shell	.sh, .bash
Dockerfile	Dockerfile
Terraform	.tf
YAML	.yml, .yaml
JSON	.json

Tip

Opengrep uses --config auto to automatically select the most relevant rules based on the languages detected in your project.

Detected vulnerability types

Category	Examples
Injection	SQL injection, command injection, LDAP injection
XSS	Reflected and stored cross-site scripting
Authentication	Hardcoded passwords, unsigned JWTs
Cryptography	Weak algorithms (MD5, SHA1, RC4), static IVs
Deserialization	Unsafe object deserialization
Path traversal	File access outside the allowed directory
SSRF	Server-side request forgery
Logic	Incorrect security comparisons

Options

Option	Description
--format	Output format: json | markdown | sarif
--output-file	Save results to a file (disables API submission)
--api-url	Gerion API Gateway URL
--api-key	M2M API key
--timeout	Timeout in seconds (default: 180)
--log-level	debug | info | warning | error

Reading results

┌──────────────┬───────────────────────────────┬────────────────┐
│ Severity     │ Rule                          │ File:Line      │
├──────────────┼───────────────────────────────┼────────────────┤
│ 🔴 High      │ python.lang.security.sql-inj  │ db.py:42       │
│ 🟡 Medium    │ javascript.crypto.weak-hash   │ auth.js:15     │
└──────────────┴───────────────────────────────┴────────────────┘

For full descriptions and recommended mitigations, see the Gerion Dashboard.