SAST analyzes source code and finds security flaws before deployment. SQL injection, XSS, hardcoded secrets — all caught in CI/CD.

Semgrep — fast and flexible¶

Installation and run¶

pip install semgrep semgrep –config auto . semgrep –config p/owasp-top-ten .

Custom rule¶

rules: - id: sql-injection patterns: - pattern: cursor.execute(f”… {$VAR} …”) message: “Possible SQL injection” severity: ERROR

SonarQube¶

Docker¶

docker run -d –name sonar -p 9000:9000 sonarqube:lts

Scanner¶

sonar-scanner -Dsonar.projectKey=myapp -Dsonar.sources=src

CI/CD integration¶

GitHub Actions¶

• name: Semgrep uses: semgrep/semgrep-action@v1 with: config: p/ci

Key Takeaway¶

Semgrep for fast scanning, SonarQube for comprehensive quality gates. Integrate into CI/CD — block merge on findings.