SAST Scan
Static Application Security Testing (SAST) examines source code to detect vulnerabilities without executing the application. Gerion uses Opengrep with rules from the Semgrep Registry.
gerion sast-scan [PATH]# Scan the current directorygerion sast-scan .
# Save results as SARIFgerion sast-scan . --format sarif --output-file sast.sarif
# Send results to the Gerion APIgerion sast-scan . --api-url $GERION_API_URL --api-key $GERION_API_KEYSupported languages
Section titled “Supported languages”| Language | Extensions |
|---|---|
| Python | .py |
| JavaScript | .js, .jsx, .mjs |
| TypeScript | .ts, .tsx |
| Java | .java |
| Go | .go |
| C | .c, .h |
| C++ | .cpp, .cc, .cxx, .hpp |
| C# | .cs |
| PHP | .php |
| Ruby | .rb |
| Kotlin | .kt |
| Scala | .scala |
| Rust | .rs |
| Swift | .swift |
| Dart | .dart |
| Bash / Shell | .sh, .bash |
| Dockerfile | Dockerfile |
| Terraform | .tf |
| YAML | .yml, .yaml |
| JSON | .json |
Detected vulnerability types
Section titled “Detected vulnerability types”| Category | Examples | |---|---| | Injection | SQL injection, command injection, LDAP injection | | XSS | Reflected and stored cross-site scripting | | Authentication | Hardcoded passwords, unsigned JWTs | | Cryptography | Weak algorithms (MD5, SHA1, RC4), static IVs | | Deserialization | Unsafe object deserialization | | Path traversal | File access outside the allowed directory | | SSRF | Server-side request forgery | | Logic | Incorrect security comparisons |
Options
Section titled “Options”| Option | Description |
|---|---|
| --format | Output format: json | markdown | sarif |
| --output-file | Save results to a file (disables API submission) |
| --api-url | Gerion API Gateway URL |
| --api-key | M2M API key |
| --timeout | Timeout in seconds (default: 180) |
| --log-level | debug | info | warning | error |
Reading results
Section titled “Reading results”┌──────────────┬───────────────────────────────┬────────────────┐│ Severity │ Rule │ File:Line │├──────────────┼───────────────────────────────┼────────────────┤│ 🔴 High │ python.lang.security.sql-inj │ db.py:42 ││ 🟡 Medium │ javascript.crypto.weak-hash │ auth.js:15 │└──────────────┴───────────────────────────────┴────────────────┘For full descriptions and recommended mitigations, see the Gerion Dashboard.