Secure › Module 7 › Lesson 4
SAST Lab
Run SAST on YOUR $REPO, triage two findings, add CI job — local or fork only.
Visual · t17_sast_lab
Lab: SAST scan + triage + CI on $REPO. Original Cyberlium.
Opening
One SARIF upload from your repo beats reading ten vendor whitepapers.
On $REPO: (1) run chosen SAST tool locally or in Actions; (2) triage at least two findings — fix one, document one false positive; (3) add or update CI workflow step with documented threshold. Save triage notes chmod 600 under $HOME/cyberlium-lab. No scanning repos you do not own, no posting raw findings from third-party codebases.
1. Scan
Command or workflow line recorded redacted if tokens involved.
Capture before/after finding count when you fix one issue.
Command guide
Try these commands — Scan
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Bandit — https://bandit.readthedocs.io/ Code review — https://owasp.org/www-project-code-review-guide/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t17-lab.env" 2>/dev/null || MY_REPO=$HOME/cyberlium-lab/t17-toy
mkdir -p "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}"
printf '%s
' 'password = "demo-not-secret"' > "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}/bad_demo.py"
grep -n password= "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}/bad_demo.py"
python3 -m py_compile "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}/bad_demo.py" && echo 'SAST lab: write finding + fix note'Primary tools to practice this lesson: grep, python3. Reference sites: Bandit (https://bandit.readthedocs.io/); Code review (https://owasp.org/www-project-code-review-guide/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage record
File:line, rule ID, true/false positive, action taken.
Link commit or local diff for fix.
3. Teardown
Remove any test secrets introduced for demo. chmod 600 notes.
Do not leave CI failing silently disabled — document warn vs fail.
4. What you ship: SAST lab pack
Scan output summary + triage table + CI snippet — chmod 600.
5. What you record before the next lesson
SAST lab notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mass-scan public GitHub trending repos and post results.
Right
SAST lab on $REPO. Next: quiz.
Mission: SAST lab
1) Scan $REPO. 2) Fix one finding; document one FP. 3) Add CI step; secure notes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Baseline debt before fail gate?”
Knowledge Check
APPLY: SAST lab target:
Multiple choice
Knowledge Check
APPLY: True or False: Public shame scans on stranger repos is OK.
True or False
Knowledge Check
APPLY: After fix re-scan:
Multiple choice