Secure › Module 7 › Lesson 1
SAST Named
Static analysis finds patterns in source — run on YOUR $REPO, never stranger codebases without scope.
Visual · t17_sast_named
SAST = analyze source without running the app. Original Cyberlium.
Opening
SAST reads your mistakes before attackers do — but only on repos you are allowed to scan.
Static Application Security Testing tools (Semgrep, CodeQL, Bandit, ESLint security plugins) pattern-match source for injection, hardcoded secrets, weak crypto, and dangerous APIs. SAST runs in IDE or CI on commits you own. Learn tool categories and false-positive culture on $REPO — never point scanners at employer monoliths, open-source projects for 'practice,' or classmate private repos without permission. Defenders gate merges on SAST; attackers hope you skip it.
1. What SAST sees
Source paths, AST patterns, taint flows (in advanced tools), config files in repo.
Cannot fully verify runtime config — complements DAST and review.
Command guide
Try these commands — What SAST sees
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SAST — https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html Bandit — https://bandit.readthedocs.io/ (Python SAST on YOUR repo)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t17-lab.env" 2>/dev/null || MY_REPO=$HOME/cyberlium-lab/t17-toy
grep -rE 'eval\(|exec\(|pickle\.loads' "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}" 2>/dev/null | head -10 || echo 'SAST grep: no eval/exec/pickle in MY_REPO'
python3 -c "print('SAST = static analysis on YOUR repo — triage findings')"Primary tools to practice this lesson: grep, python3. Reference sites: SAST (https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html); Bandit (https://bandit.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tool families
Language-specific (Bandit for Python, gosec for Go) vs multi-language (Semgrep).
IDE plugins for fast feedback; CI for team gate.
3. Scope
Default lab: clone and scan YOUR $REPO or course starter you forked.
No bulk scanning GitHub orgs you do not own — rate limits and ethics apply.
4. What you ship: SAST vocabulary
SAST definition + two tool names + $REPO-only scan rule.
5. What you record before the next lesson
SAST named paragraph.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Semgrep against employer private repo without authorization.
Right
Name SAST and tools. Next: findings triage.
Mission: SAST literacy sheet
1) Define SAST in one sentence. 2) Name two tools for your stack. 3) Write NEVER scan stranger repos.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Semgrep vs CodeQL tradeoff?”
Knowledge Check
APPLY: SAST analyzes:
Multiple choice
Knowledge Check
APPLY: True or False: Scanning classmate private repo without OK is lab.
True or False
Knowledge Check
APPLY: SAST runs best early:
Multiple choice