Category Direction - Static Application Security Testing (SAST)

1. You are here:
2. GitLab Direction
3. Product Stage Direction - Application Security Testing
4. Static Analysis group priorities
5. Category Direction - Static Application Security Testing (SAST)

• SAST
  • Introduction and how you can help
  • Overview
  • Strategy and themes
  • Specific product areas
    • Language support
    • Detection accuracy
  • 1 year plan
    • What is next for us
    • What we recently completed
    • What is not planned right now

SAST

Stage	Application Security Testing
Maturity	Viable
Content Last Reviewed	2024-12-17

Introduction and how you can help

This direction page describes GitLab's plans for the SAST category, which checks source code to find possible security vulnerabilities.

This page is maintained by the Product Manager for Static Analysis, Connor Gilbert.

Everyone can contribute to where GitLab SAST goes next, and we'd love to hear from you. The best ways to participate in the conversation are to:

• Comment or contribute to existing SAST issues in the public gitlab-org/gitlab issue tracker.
• If you don't see an issue that matches, file a new issue.
  • Post a comment that says @gitlab-bot label ~"group::static analysis" ~"Category:SAST" so your issue lands in our triage workflow.
• If you're a GitLab customer, contact Support or discuss your needs with your account team.

Overview

GitLab SAST runs on merge requests and the default branch of your software projects so you can continuously monitor and improve the security of the code you write. SAST jobs run in your CI/CD pipelines alongside existing builds, tests, and deployments, so it's easy for developers to interact with.

While SAST uses sophisticated techniques, we want it to be simple to understand and use day-to-day, especially by developers who may not have specific security expertise. So, when you enable GitLab SAST, it automatically detects the programming languages used in your project and runs the right security analyzers.

While basic SAST scans are available in every GitLab tier, organizations that use GitLab SAST in their security programs should use Ultimate. Only GitLab Ultimate includes:

• Advanced SAST: proprietary scanning technology that delivers higher-quality results.
• Advanced Vulnerability Tracking: proprietary technology that keeps track of vulnerabilities as they move around a codebase.
• Workflows: SAST results integrated into the merge request workflow.
• Related security and compliance features: Vulnerability Management, Security Policies, and other capabilities that help you enforce security requirements.

Strategy and themes

Our strategy depends on understanding our customers and the broader market.

Specific product areas

This section summarizes our plans for specific parts of GitLab SAST.

Language support

We are currently working to upgrade additional languages to Advanced SAST. We will continue until we have enabled Advanced SAST for all languages that GitLab SAST currently scans using Semgrep-based scanning, though we may pause language expansion in particular development milestones to focus on other features or further improvements to already-supported languages.

The status of this initiative, and the priority order between languages, is tracked in epic 14312.

We intend to enable Advanced SAST by default in 18.0; it will take over coverage for the languages it supports at that time. When we complete this initiative, we will then evaluate the future plans for the Semgrep-based analyzer, because it will serve fewer Ultimate customers over time.

We are not currently:

1. Expanding the set of languages that GitLab SAST supports, overall. That is, we are not adding new-new languages that aren't already supported by an official GitLab SAST analyzer.
2. Migrating additional language-specific analyzers to Advanced SAST or to Semgrep-based scanning.

For details, see What is not planned right now.

Detection accuracy

GitLab Vulnerability Research analyzes and improves coverage for already-supported languages as part of a continuous program of assessment and improvement. This program includes:

• In-house security research.
• Proactive assessments of real-world codebases and benchmark/example projects.
• Reacting to feedback from customers and from internal users within GitLab.
• Identifying opportunities to improve the Advanced SAST engine to enable new detection techniques.

1 year plan

GitLab Static Analysis and Vulnerability Research teams are collaborating to improve the customer experience with SAST.

Our plans align with the themes for the Security use case:

1. Detection accuracy: Security professionals and developers should be able to trust every result from GitLab SAST. This work improves the user experience directly, but also indirectly by reducing the number of times users have to go through other workflows.
2. Shift left security: GitLab SAST already scans code as soon as it's pushed, before code reviews even begin. But, we can make it easier to improve security by scanning code even earlier, including before code leaves developer machines.
3. Faster remediation: We value our users' time, and we know that vulnerabilities are resolved more often if they're easier to understand and interact with.

What is next for us

In the next 3 months, we are planning to work on:

Name	Overall status	One-month plan	Three-month plan
Add new code-flow UI to explain Advanced SAST results Tracking issue/epic	Shipped in the vuln report, MR widget, and pipeline security report. Expected completion in 17.7.	Complete implementation in MR changes view; address UX issues. (Development work is being handled by the Security Platform Management group.)
Real-time SAST scanning in the IDE: initial release Tracking issue/epic	Expecting 17.6 (November 2024) for Experiment release on GitLab.com.	Deliver Experiment release	Move on to post-initial-release improvements, as listed below
Provide guidance on how to evaluate GitLab SAST Tracking issue/epic	Initial guide shipped	Implement further edits to the evaluation guide	Publish benchmark/example project guide, based on analysis project listed below
Restructure and update Advanced SAST docs now that the feature is GA Tracking issue/epic	In progress. (Primarily documentation.)	Complete most issues in this epic	Complete entire epic
Advanced SAST engine maintenance, testing, and stability improvements Tracking issue/epic	High-priority items preparing for release	Implement improvements
Analyze Advanced SAST performance against standard benchmarks Tracking issue/epic	Analysis and rule updates in progress. (Handled primarily by Vulnerability Research.)	Continue analysis and rule updates	Complete work; use results to update documentation
Implement the next level of documentation for rule/CWE coverage Tracking issue/epic	Assessing implementation options. (Handled primarily by Vulnerability Research.)	Interview internal users and develop technical plan	Ship documentation
Enable Advanced SAST for PHP Tracking issue/epic	Ready to begin implementation after a pause. ETA TBD.	Finalize engine support, migrate/implement rules
Expand coverage for Vulnerability Resolution to more CWE types Tracking issue/epic		Finalize technical plan. Complete prerequisite changes so that we can test new feature iterations.	Begin executing the technical plan.
Expand real-time SAST in the IDE Tracking issue/epic	Will beging after the initial Experiment release	Respond to feedback and next steps after the initial Experiment release	Work toward self-managed support; improve user-perceived latency

After the next 3 months, we plan to work on:

Name	Overall status
Implement Advanced SAST for C/C++ Tracking issue/epic
Incremental pipeline-based scans (skip unmodified code) Tracking issue/epic	Currently blocked by database decomposition
Enable Advanced SAST for additional languages Tracking issue/epic	Waiting for other languages, as listed above. See epic for language priority order.
Reshape SAST customization; allow org-specific Advanced SAST Tracking issue/epic	Analyzing customer use cases to develop requirements
Enable Advanced SAST by default Tracking issue/epic	Likely to occur in GitLab 18.0 due to breaking-change requirements.
Make SAST results easier to understand and triage Tracking issue/epic	Coordinating with Security Risk Management stage for scheduling

What we recently completed

Our recent work includes:

• Ruby support and rule updates for Advanced SAST, including new documentation of Advanced SAST CWE coverage.
• Releasing GitLab Advanced SAST as a GA feature, and adding support for JavaScript, TypeScript, C#, and Java Server Pages (JSP) in GitLab 17.4
• Implementing a data migration to automatically resolve findings from now-removed analyzers in GitLab 17.3.1.
• Adding a variable to prevent local config files from interfering with policy-driven scans in GitLab 17.3.
• Releasing GitLab Advanced SAST for Python, Go, and Java as a Beta feature.
• Introducing GitLab-managed rules for multiple programming languages and consolidating analyzer coverage in GitLab 17.0.
• Significant and ongoing improvements to the default SAST ruleset used in Semgrep-based scanning. This delivers substantially fewer false-positive and false-negative results in 16.8 and future releases. See epic 10907 for further progress.

Check older release posts for our previous work in this area.

What is not planned right now

We understand the value of many potential improvements to GitLab SAST, but aren't currently planning to work on the following initiatives:

• Expanding language support: Currently, we're focusing on delivering better-quality results, faster, for the many languages and frameworks we already support. We're not actively adding adding support for new languages. However, if we don't support a language you use, you can:
  • Integrate third-party tools (open-source or proprietary) using our documented, open report format.
  • Document your request by opening an issue or commenting on an existing issue in epic 297.
• More analyzer consolidations: We are not currently focusing on consolidating more analyzers into Semgrep-based scanning with GitLab-managed rules.
  • We recently completed work to consolidate scanning coverage from many language-specific scanners to Semgrep-based scanning. This provides a simpler, more consistent operational experience; allows GitLab to directly manage rules; and makes scans run faster.
  • We released these changes as part of GitLab 17.0, GitLab 16.0, and GitLab 15.4.
  • The remaining analyzers cover less-commonly-used languages that we cannot immediately convert due to technical limitations.