SAST Configuration

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

Use this skill when

• •Set up SAST scanning in CI/CD pipelines
• •Create custom security rules for your codebase
• •Configure quality gates and compliance policies
• •Optimize scan performance and reduce false positives
• •Integrate multiple SAST tools for defense-in-depth

Do not use this skill when

• •You only need DAST or manual penetration testing guidance
• •You cannot access source code or CI/CD pipelines
• •You need organizational policy decisions rather than tooling setup

Instructions

1. •Identify languages, repos, and compliance requirements.
2. •Choose tools and define a baseline policy.
3. •Integrate scans into CI/CD with gating thresholds.
4. •Tune rules and suppressions based on false positives.
5. •Track remediation and verify fixes.

Safety

• •Avoid scanning sensitive repos with third-party services without approval.
• •Prevent leaks of secrets in scan artifacts and logs.

Overview

This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.

Core Capabilities

🧠 Knowledge Modules (Fractal Skills)

1. 1. Semgrep Configuration

2. 2. SonarQube Setup

3. 3. CodeQL Analysis

4. Initial Assessment

5. Basic Setup

6. CI/CD Pipeline Integration

7. Pre-commit Hook

8. New Project Setup

9. Custom Rule Development

10. Compliance Scanning

11. High False Positive Rate

12. Performance Issues

13. Integration Failures